JEUS Web Server Input Validation Flaw Permits Remote Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1007004
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 17 2003
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 3.2.2
|
Description: A vulnerability was reported in the Java Enterprise User Solution (JEUS) web application server. A remote user can conduct cross-site scripting attacks.
STG Security reported that the JEUS web application server does not properly filter user-supplied input. A remote user can create
a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's
browser. The code will originate from the site running the JEUS software and will run in the security context of that site. As a
result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the
site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target
user.
A demonstration exploit URL is provided:
http://[target]/url.jsp?foo=<script>alert('XSS vulnerability exists!')</script>
It
is reported that a remote user can hijack an administrator's session.
The following notification timeline is provided:
2002-10-12
Tmax Soft notified.
2002-10-17 Second attempt at vendor contact.
2002-10-17 Fixed version released.
2003-05-21 Last attempt at
vendor contact.
2003-06-17 Public disclosure.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
JEUS server software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
|
Solution: The vendor has issued a fixed versions (3.2.2 and later), available at:
http://www.tmax.co.kr/product_jeus.htm
|
Vendor URL: www.tmax.co.kr/product_jeus.htm (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: "SSR Team" <advisory@stgsecurity.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 17 Jun 2003 10:19:55 +0900
From: "SSR Team" <advisory@stgsecurity.com>
Subject: [Full-Disclosure] STG Security Advisory: JEUS Web Application Server Cross Site Scripting Vulnerability
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
STG Security Advisory: JEUS Web Application Server Cross Site Scripting
Vulnerability
Revision: 1.0
Date Published: 2003-06-17 (KST)
Last Update: 2003-06-17
Product Description
=========
JEUS (Java Enterprise User Solution) is a J2EE compatible web application
server, developed by Tmax Soft, providing a clustering system especially
designed for large enterprise business applications.
Vulnerability Class
================
Implementation Error: Inappropriate Input Validation
Affected Products
================
This vulnerability was found at JEUS 3.1.4p1. The vendor confirmed all
versions below 3.2.2 have this vulnerability.
Details
======
JEUS Web Application Server has a cross site scripting vulnerability
invoking a JavaScript as following:
Proof of Concept
http://vulnerable.com/url.jsp?foo=<script>alert('XSS vulnerability
exists!')</script>
An attacker could hijack the session of an administrator or spread viruses
or worms using vulnerabilities of Web browsers.
Impact
======
At August 2002, Eye on Security released an article entitled "Bypassing
JavaScript Filters - the Flash! Attack" on the attacking method utilizing
cross site scripting vulnerabilities. An attacker could use a highly
effective automated tool using this method for session hijacking in the
wild to acquire the privilege of administrators and to alter or erase the
web pages of an victim site.
Solutions
========
STG Security has notified this vulnerability to the vendor, which fixed this
problem and released JEUS 3.2.2 on October 2002.
Much detailed information is found at http://www.tmax.co.kr
Vendor Status: FIXED
===================
2002-10-12 Tmax Soft notified.
2002-10-17 Second attempt at vendor contact.
2002-10-17 Fixed version released.
2003-05-21 Last attempt at vendor contact.
2003-06-17 Public disclosure.
Credits
======
Jeremy Bae at STG Security SSR Team
About STG Security
=================
STG Security Inc. is a affiliated company of STG Group which has its head
office in the States founded in march 2000. Its core business area is
Information Security Consulting Service based on 30 years of various
Information Security Consulting experiences in the States including more
than 100 projects of Risk Assessment and Penetration testing implemented for
the American government organizations. Also STG Group is a member company
to undertake Safeguard project which is government Information Security
project initiated by the Clinton cabinet. Those experiences and
methodologies are applied to the Korean Information Security market by STG
Security Inc.
http://www.stgsecurity.com/
Phone +82-2-6333-4500
FAX +82-2-6333-4545
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
iQA/AwUBPu5saT9dVHd/hpsuEQJ/IQCgocpu50rK+tqmlhQ9cS7vawtu1XMAn1uh
exTHNRRklHJVZ3XaYQzlIeCH
=8SZ9
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
