###############################################################
ID: S21SEC-024-en
Title: Vignette TCL Injection
Date: 03/04/2003
Status: Vendor contacted and solution available
Scope: TCL code Execution, Remote command execution
Platforms: All
Author: rpinuaga
Location: http://www.s21sec.com/es/avisos/s21sec-024-en.txt
Release: External
###############################################################

                                S 2 1 S E C

                           http://www.s21sec.com

                           Vignette TCL Injection


About Vignette
--------------

Vignette develops Content Management and Application Portal Software.


Description of vulnerability
----------------------------

Vignette Software presents a vulnerability in some propietary commands that permits the injection of TCL code under some circunstances.

The affected Vignette commands are:
- NEEDS
- VALID_PATHS


All the TCL templates or scripts, that use this commands, are vulnerable to remote code injection.

The source code of both commands is located in a file called "stdlib.tcl" at the Vignette library directory. The offending code is the following:

========== stdlib.tcl (Extracted from Vignette 5.6.3) ==========

-- Lines 1049/1053 (NEEDS command) --

        SET cookieName "vgn_creds"
        SET formPath [CURL /vgn/login]


                SET queryString [SHOW HTTP_QUERY_STRING]        <--- (!)


        } elseif {[llength $args] < 2} {
        error "Usage: NEEDS LOGIN cookieName URL\n"

--

-- Lines 1141/1146 (NEEDS command) --

    } elseif {![string compare $arg "COOKIE"]} {
        global _Cookie HTTP_COOKIE

        
        regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString            <--- (!)

        
        set cookies [split $cookieString { }]
        foreach c $cookies {

--

-- Lines 1272/1277 (VALID_PATHS command) --

    global _Path
    if {[info exists _Path] == 1 && [lsearch $paths $_Path] == -1} {
    
    
    system_error "Invalid path \"$_Path\" for template (referer='[SHOW HTTP_REFERER]')"         <--- (!)
    
    
    }
    return ""

--

=================================================


As seen, the value of some unfiltered variables is used and evaluated with the SHOW command. If the external variable contains Vignette code, then arbitrary TCL execution is posible. The affected input variables are:
- HTTP_QUERY_STRING, converted to queryString in NEEDS command.
- HTTP_COOKIE, converted to cookieString in NEEDS command.
- HTTP_REFERER, showed in VALID_PATHS command.


This three variables are received directly form the web client, and aren't sanitized in any way. If the Vignette/TCL escape characters are included "[" and "]" the code between them is evaluated as valid TCL code.

The VALID_PATHS command is very few used in Vignette Applications, but the NEEDS command is extensively used, even in the default Vignette templates. The following default installed templates are vulnerables and remotely exploitables:

/vgn/ac/edit - [NEEDS LOGIN]
/vgn/ac/index - [NEEDS LOGIN]
/vgn/vr/Editing - [NEEDS LOGIN]
/vgn/vr/Select - [NEEDS LOGIN]
/vgn/legacy/edit - [NEEDS LOGIN]
/vgn/ppstats - [NEEDS LOGIN]


It's important to note that the bug not only affect the default Vignette Applications, nor it affects all the applications developed over a Vignette Server Software, that use the affected commands.


Affected Versions and platforms
-------------------------------

This vulnerability has been tested in Vignette StoryServer 5, and Vignette V/6. But it seems that all currently avaliable versions are vulnerable.


Solution
--------

Replace the offending SHOW evaluations in stdlib.tcl with directly passed variables. For example:

instead: SET queryString [SHOW HTTP_QUERY_STRING]
use ==> SET queryString $HTTP_QUERY_STRING

instead: regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString
use ==> regsub -all {; } $HTTP_COOKIE { } cookieString

instead: system_error "Invalid path \"$_Path\" for template (referer='[SHOW HTTP_REFERER]')"
use ==> system_error "Invalid path \"$_Path\" for template (referer='$HTTP_REFERER')"

Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution.


Additional information
----------------------

These vulnerabilities have been found and researched by:

 Ramon Pinuaga Cascales         rpinuaga@s21sec.com

You can find the last version of this warning in:

        http://www.s21sec.com/es/avisos/s21sec-024-en.txt

And other S21SEC warnings in http://www.s21sec.com/es/avisos/