SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Commerce)  >   WebSeries Vendors:   Bottomline
Bottomline WebSeries Discloses Information to Remote Authenticated Users and Lets Users Bypass Password Policy
SecurityTracker Alert ID:  1012854
SecurityTracker URL:  http://securitytracker.com/id/1012854
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Jan 12 2005
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information
Exploit Included:  Yes  

Description:   Several vulnerabilities were reported in WebSeries. A remote authenticated can determine the installation path and directory structure and can run arbitrary reports in certain cases. A user can also bypass password policy.

Portcullis reported that several internal variables contained within HTML web pages on the application disclose the installation path to remote authenticated users.

A remote authenticated user can modify variables provided to 'BTInteractiveViewer.asp' during report selection to determine part of the directory structure on the target system. If the user-supplied 'ReportName' contains a filename that exists in the user-supplied 'ReportPath' filepath, the system will indicate:

Unable to load report

If the filename does not exist in that filepath, the system will indicate:

The system cannot find the file specified

If the filepath (directory) does not exist, the system will indicate:

The system cannot find the path specified

It is reported that the password policy (such as the minimum length of a password) is enforced via Javascript on the target user's system rather than on the server. As a result, a user can set their password to a length that is not permitted by the policy (e.g., a single-character password).

A remote authenticated user can modify their password without having to re-enter the original password.

A remote authenticated user can modify certain parameters when selecting a report to cause the application to download and execute arbitrary reports from any system on the network that supports Windows shares. It may be possible to execute a report that displays sensitive information, such as usernames and passwords.

Impact:   A remote authenticated can determine the installation path and directory structure on the target system.

A remote user can run arbitrary reports in certain cases.

A user can also bypass password policy.

Solution:   No solution was available at the time of this entry.
Vendor URL:  www.bottomline.co.uk/bacstel-ip/webseries.htm (Links to External Site)
Cause:   Access control error

Message History:   This archive entry has one or more follow-up message(s) listed below.
Feb 3 2005 (Vendor Issues Fix) Bottomline WebSeries Discloses Information to Remote Authenticated Users and Lets Users Bypass Password Policy
The vendor has issued a fix for one flaw.



 Source Message Contents

Subject:  Portcullis Security Advisory 05-005


Portcullis Security Advisory
 
Vulnerable System: 
      
Webseries Payment Application
 
Vulnerability Title:  
 
Internal Path Disclosure in HTTP Variables
 
Vulnerability discovery and development: 
 
Portcullis Security Testing Services
 
Affected systems: 
 
Bottomline Webseries Payment Application 
 
Details:
 
Several HTTP variables in use by the application were found to directly
reference directories and files on the web server.  An example of this
behaviour is listed below:
 
        ConfigFile=blah.cfg
        ReportName=User%20Activity%20Report.rpt
        ReportPath=E:\server\apps\WSWEB\Web+Application+Files\reports\
Impact:
 
An attacker can use the information obtained by this issue to gain a better
understanding of the structure of the underlying file system of the web
server.  This type of information is often essential in launching exploits
against the web server itself.
 
Exploit:
 
Exploit code not required.
 
Copyright: 
 
Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without
 the express written consent of Portcullis Computer Security Limited.
 
Disclaimer: 
 
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition.
 There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the
 user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever
 arising out of or in connection with the use or spread of this information.
 
 
 
 
 
 


*************************************************************
The information in this email is confidential and may be
legally privileged. It is intended solely for the addressee.
Any opinions expressed are those of the individual and do not
represent the opinion of the organisation. 
Access to this email by persons other than the intended
recipient is strictly prohibited.
If you are not the intended recipient, any disclosure, copying,
distribution or other action taken or omitted to be taken in
reliance on it, is prohibited and may be unlawful. 
When addressed to our clients any opinions or advice contained
in this email is subject to the terms and conditions expressed
in the applicable Portcullis Computer Security Limited terms
of business.
**************************************************************


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC