|
|
|
|
| |
| The PeopleSoft IScript environment allows developers to produce custom environments, tailored to an organization's needs. By using a malformed URL in an HTTP request to the IScript application, it is possible to achieve an XSS attack, potentially giving access to confidential information, such as session cookies etc. |
| |
Credit:
The information has been provided by Glyn Geoghegan.
|
| |
Vulnerable systems:
* PeopleTools version 8.20, 8.43 and prior
The IScript interface accepts a number of arguments via HTTP POST/GET calls.
By using a carefully constructed URL, mobile code such as JAVA, can be executed within the users context. This style of attack can be used to gain access to sensitive information, such as session cookies etc.
Recommendations:
PeopleSoft have released details of this and other issues under security rollup vulnerability ID 20031112, which is available to registered users from the PeopleSoft support site.
PeopleSoft recommends that customers address the vulnerability by applying the following fixes available on PeopleSoft Customer Connection.
Release Patch
8.18 8.18.15
8.19 8.19.12
8.20 8.20.03
8.42 8.42.14
8.43 8.43.11
For those who can not implement the patches promptly, as a mitigating strategy a firewall or other HTTP filtering device can be used to block queries containing sensitive strings, or as a last resort all access to the PeopleSoft application can be disabled in entirety.
|
|
|
|
|
