SPI Dynamics WebInspect Reporting Function Lets Remote Sites Execute Scripting Code on the Target System
|
|
SecurityTracker Alert ID: 1014582
|
|
SecurityTracker URL: http://securitytracker.com/id?1014582
|
|
CVE Reference: CVE-2005-2442
(Links to External Site)
|
Updated: Jul 6 2008
|
Original Entry Date: Jul 26 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Exploit Included: Yes
|
Description: A vulnerability was reported in SPI Dynamics WebInspect. A remote user can cause arbitrary scripting code to be executed on the target user's system in certain cases.
Portions of a scanned site (e.g., URLs) are included by WebInspect in a local HTML file that, when viewed by the target user as part
of the WebInspect reporting function, will cause scripting code from the scanned site to be executed by the target user's browser.
The
file location is:
C:\Program Files\SPIDynamics\WebInspect\Working\vulnerability.htm
The script may run in the Internet zone,
but that was not confirmed in the report. However, scripting code can be executed in the Local Computer zone by referring to a
file with a known location. An example is provided:
<script>window.open('file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm')</script>
A remote user can create specially crafted web content (containing arbitrary scripting code) on a web site. When the web site
is scanned by the target user with WebInspect and then the target user views a report of the scan results, the remote user's scripting
code will be executed on the target user's system.
A demonstration exploit ASP file is provided:
<*****************iisstart.asp***********************>
<HTML><HE
AD><BODY>
<%
if request.querystring<>"" then
response.write request.querystring
end if
%>
<form action="script>/<script>window.open(%27file://C:\\Program
Files\\SP
IDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Please login:<br>
<input type=submit value="Login"><br>
<input type=hidden name='hidden' value="Login"><br> </form>
</BODY></HTML>
</*****************iisstart.asp***********************>
The
vendor was notified on April 15, 2005.
QQLan reported this vulnerability.
The original advisory is available at:
http://www.security.nnov.ru/Fnews30.html
|
Impact: A remote user (on a scanned web site) can cause arbitrary scripting code to be executed on the target user's computer when a report is viewed.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.spidynamics.com/products/webinspect/index.html (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: 3APA3A <3APA3A@SECURITY.NNOV.RU>
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 26 Jul 2005 13:45:29 +0400
From: 3APA3A <3APA3A@SECURITY.NNOV.RU>
Subject: [Full-disclosure] SPIDynamics WebInspect Cross-Application
|
Dear bugTraq,
Cross application scripting attacks (data obtained from untrusted
source is sent unfiltered from trusted application to browser) in
different applications are reported by anonymous author.
In Russian version of article "XSS - WEB = Cross-Applications
Scripting" (signed (c)oded by QQLan@yandex.ru)
http://www.security.nnov.ru/articles/xas/
there are remote cross-application scripting attack in SPIDynamics
WebInspect and domain level cross-application attack with potential
privilege escalation for user with limited delegated control under OU
to domain administrator account is also described for Windows domain
group policy editor (gpedit.msc) under Windows XP and Windows Server
2003.
Below is original anonymous report for cross application scripting in
SPIDynamics WebInspect
(http://www.security.nnov.ru/Fnews30.html)
SPIDynamics WebInspect Cross-Application Scripting (XAS)
I. BACKGROUND
SPIDynamics WebInspect is powerful security assessment tool for Web application vulnerable to XAS whi
ch
could lead to remote code execution.
II. DESCRIPTION
As many applications WebInspect uses external programs and Windows components for different purposes.
It is very common to use COM object of Internet Explorer for render reports and displays data. WebIns
pect
in not an exception.
When reports is generated, some parts of scanned site (for example URLs) are included into HTML file
(file://C:\Program Files\SPIDynamics\WebInspect\Working\vulnerability.htm), which opens in IE.
Because WebInspect doesn't properly normalize displayed data, part of URL or other data can be parsed
by IE
as DHTML, for example JavaScript, and leads to code execution on the computer where scanner is instal
led.
III. ANALYSIS
Successful exploitation allows remote attackers to execute arbitrary script code on the host, where
scanner is installed with privileges of user who launch the scanner. Victim should scan site and open
report.
Typically scanner runs on administrator's or security auditor's box with a lot of interesting data.
It possibly runs under high-privileged account.
Attacker should create specially crafted site with vulnerability to be displayed in report.
"Vulnerable" URL should include script code. Example of such report is a "Hidden Form
Value Vulnerability
ID: 4727".
By default script is executed in Internet Security Zone of IE (not sure). But with little effort atta
cker
can use predictable resource location to bypass restrictions of Internet Zone and execute script in "
My
Computer" security zone.
Example:
<script>window.open('file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm')</script>
Attacker can use social engineering to install full featured application, for example new version of
"SPIDynamics Reported ActiveX".
IV. DETECTION/POC
Following asp file can be used to reproduce vulnerability:
<*****************iisstart.asp***********************>
<HTML><HEAD><BODY>
<%
if request.querystring<>"" then
response.write request.querystring
end if
%>
<form action="script>/<script>window.open(%27file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Pl
ease login:<br>
<input type=submit value="Login"><br> <input type=hidden name='hidden' value
="Login"><br> </form>
</BODY></HTML>
</*****************iisstart.asp***********************>
You should change default error page to iisstart.asp (see screenshot in attach). Scan results can be
found
in attached files.
V. VENDOR RESPONSE
Initial vendor response received
VII. DISCLOSURE TIMELINE
04/15/2005 Initial vendor notification
04/15/2005 Initial vendor response
VIII. WORKAROUND
Disable Active Scripting in My Computer Zone
(http://support.microsoft.com/default.aspx?scid=kb;en;833633)
IX. LEGAL NOTICES
This advisory is being provided to you under the RFPolicy documented at
http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this policy; however, in the inte
rim,
you have approximately 5 days to respond to this initial email.
Thanks: 3APA3A for spellcheck & malware.com for some ideas.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
