SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   HPE WebInspect Vendors:   SPI Dynamics
SPI Dynamics WebInspect Reporting Function Lets Remote Sites Execute Scripting Code on the Target System
SecurityTracker Alert ID:  1014582
SecurityTracker URL:  http://securitytracker.com/id/1014582
CVE Reference:   CVE-2005-2442   (Links to External Site)
Updated:  Jul 6 2008
Original Entry Date:  Jul 26 2005
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  

Description:   A vulnerability was reported in SPI Dynamics WebInspect. A remote user can cause arbitrary scripting code to be executed on the target user's system in certain cases.

Portions of a scanned site (e.g., URLs) are included by WebInspect in a local HTML file that, when viewed by the target user as part of the WebInspect reporting function, will cause scripting code from the scanned site to be executed by the target user's browser.

The file location is:

C:\Program Files\SPIDynamics\WebInspect\Working\vulnerability.htm

The script may run in the Internet zone, but that was not confirmed in the report. However, scripting code can be executed in the Local Computer zone by referring to a file with a known location. An example is provided:

<script>window.open('file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm')</script>

A remote user can create specially crafted web content (containing arbitrary scripting code) on a web site. When the web site is scanned by the target user with WebInspect and then the target user views a report of the scan results, the remote user's scripting code will be executed on the target user's system.

A demonstration exploit ASP file is provided:

<*****************iisstart.asp***********************>

<HTML><HEAD><BODY>
<%
if request.querystring<>"" then
response.write request.querystring
end if
%>
<form action="script>/<script>window.open(%27file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Please login:<br>
<input type=submit value="Login"><br> <input type=hidden name='hidden' value="Login"><br> </form>
</BODY></HTML>

</*****************iisstart.asp***********************>

The vendor was notified on April 15, 2005.

QQLan reported this vulnerability.

The original advisory is available at:

http://www.security.nnov.ru/Fnews30.html

Impact:   A remote user (on a scanned web site) can cause arbitrary scripting code to be executed on the target user's computer when a report is viewed.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.spidynamics.com/products/webinspect/index.html (Links to External Site)
Cause:   Input validation error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [Full-disclosure] SPIDynamics WebInspect Cross-Application


Dear bugTraq,

  Cross  application  scripting  attacks  (data  obtained from untrusted
  source  is  sent  unfiltered  from  trusted application to browser) in
  different applications are reported by anonymous author.

  In  Russian  version  of  article  "XSS  -  WEB  =  Cross-Applications
  Scripting" (signed (c)oded by QQLan@yandex.ru)
  http://www.security.nnov.ru/articles/xas/
  there  are  remote  cross-application  scripting attack in SPIDynamics
  WebInspect  and  domain  level cross-application attack with potential
  privilege  escalation for user with limited delegated control under OU
  to  domain  administrator account is also described for Windows domain
  group  policy  editor (gpedit.msc) under Windows XP and Windows Server
  2003.

  Below  is original anonymous report for cross application scripting in
  SPIDynamics WebInspect
  (http://www.security.nnov.ru/Fnews30.html)



SPIDynamics WebInspect Cross-Application Scripting (XAS)

I. BACKGROUND

SPIDynamics WebInspect is powerful security assessment tool for Web application vulnerable to XAS which
could lead to remote code execution.

II. DESCRIPTION

As many applications WebInspect uses external programs and Windows components for different purposes.
It is very common to use COM object of Internet Explorer for render reports and displays data. WebInspect
in not an exception.
When reports is generated, some parts of scanned site (for example URLs) are included into HTML file
(file://C:\Program Files\SPIDynamics\WebInspect\Working\vulnerability.htm), which opens in IE.
Because WebInspect doesn't properly normalize displayed data, part of URL or other data can be parsed by IE
as DHTML, for example JavaScript, and leads to code execution on the computer where scanner is installed.

III. ANALYSIS

Successful exploitation allows remote attackers to execute arbitrary script code on the host, where
scanner is installed with privileges of user who launch the scanner. Victim should scan site and open
report.
Typically scanner runs on administrator's or security auditor's box with a lot of interesting data.
It possibly runs under high-privileged account.
Attacker should create specially crafted site with vulnerability to be displayed in report.
"Vulnerable" URL should include script code. Example of such report is a "Hidden Form Value Vulnerability
ID: 4727".
By default script is executed in Internet Security Zone of IE (not sure). But with little effort attacker
can use predictable resource location to bypass restrictions of Internet Zone and execute script in "My
Computer" security zone.
Example:

 <script>window.open('file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm')</script>

Attacker can use social engineering to install full featured application, for example new version of
"SPIDynamics Reported ActiveX".

IV. DETECTION/POC

Following asp file can be used to reproduce vulnerability:

<*****************iisstart.asp***********************>

<HTML><HEAD><BODY>
<%
if request.querystring<>"" then
response.write request.querystring
end if
%>
<form action="script>/<script>window.open(%27file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Please login:<br>
<input type=submit value="Login"><br> <input type=hidden name='hidden' value="Login"><br> </form>
</BODY></HTML>

</*****************iisstart.asp***********************>

You should change default error page to iisstart.asp (see screenshot in attach). Scan results can be found
in attached files.

V. VENDOR RESPONSE

Initial vendor response received

VII. DISCLOSURE TIMELINE

04/15/2005 Initial vendor notification
04/15/2005 Initial vendor response

VIII. WORKAROUND

Disable Active Scripting in My  Computer Zone
(http://support.microsoft.com/default.aspx?scid=kb;en;833633)


IX. LEGAL NOTICES

This advisory is being provided to you under the RFPolicy documented at
http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this policy; however, in the interim,
you have approximately 5 days to respond to this initial email.

Thanks: 3APA3A for spellcheck & malware.com for some ideas.



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC