WildFly[1], formerly known as JBoss AS, or simply JBoss, is an application server authored by JBoss, now developed by Red Hat. WildFly is written in Java, and implements the Java Platform, Enterprise Edition (Java EE) specification. It runs on multiple platforms.
WildFly is free and open-source software, subject to the requirements of the GNU Lesser General Public License (LGPL), version 2.1."
Directory traversal[2] vulnerability in WildFly 8.1.0.Final allows remote attackers to read arbitrary files via a .. (dot dot) in the URI parameter in a render action to standalone/configuration/standalone.xml or any other configuration file.
The vendor has proveid patches that fix the flaws. Our advisory with more detailed information can be found at our website[3]. CVE mitre website[4].
[1] http://wildfly.org/
[2] https://www.owasp.org/index.php/Testing_Directory_traversal/file_include_(OTG-AUTHZ-001)
[3] https://www.conviso.com.br/advisories/CVE-2014-7816.txt
[4] http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2014-7816
Mostrando postagens com marcador Advisories. Mostrar todas as postagens
Mostrando postagens com marcador Advisories. Mostrar todas as postagens
terça-feira, 9 de dezembro de 2014
segunda-feira, 4 de março de 2013
Spree Commerce Multiple Unsafe Reflection Vulnerabilities (CVE-2013-1656)
Spree Commerce [1] is "a 100% open source e-commerce platform powered by the popular Ruby on Rails framework. It was designed to make customization and upgrades as simple as possible". We have found Multiple Unsafe Reflection [2] vulnerabilities on it that affected any version >= 1.0.0.
The vendor has provided patches that fix the flaws [3]. Our advisory with more detailed information can be found at our website [4].
[1] http://spreecommerce.com
[2] http://blog.conviso.com.br/2013/02/exploiting-unsafe-reflection-in.html
[3] http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed
[4] https://www.conviso.com.br/advisories/CVE-2013-1656.txt
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
sexta-feira, 15 de junho de 2012
Ruby on Rails SQL Injection (CVE-2012-2695)
We found a SQL Injection vulnerability in Ruby on Rails that affected all versions and reported it to the Rails security team. On the 12th of June, they released an advisory [1], patches and new versions that fix it. This vulnerability was also independently reported by other researchers.
These new patches actually fixed two variants of the CVE-2012-2661 case. We will cover them later. First let's see the original vulnerability fixed on CVE-2012-2661. This vulnerability occurred during the processing of code like "Post.where(:id => params[:id]).all". In this case, the attacker was able to change the query by manipulating the hash to include any table/column pair.
Example:
---
Request: controller?id=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`id` = '123'
Request: controller?id[table.column]=123
Query: SELECT `posts`.* FROM `posts` WHERE `table`.`column` = '123'
---
After the release of the patches for CVE-2012-2661, we did some investigation and still were able to exploit the same piece of code with two different variants. The first one was simply a small change in the way the hash is passed.
Example:
---
Request: controller?id=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`id` = '123'
Request: controller?id[table][column]=123
Query: SELECT `posts`.* FROM `posts` WHERE `table`.`column` = '123'
---
And the second one exploited a flaw which allowed the attacker to specify the database name to be used in a SHOW TABLES query. Since the name was user-supplied and not quoted, we were able to execute a Blind SQL Injection (tested on MySQL) and an Error-Based SQL Injection in case Rails is misconfigured to exhibit the exception/stacktrace pages. There is also a blog [2] that talks about this case.
Example:
---
Request: controller?id=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`id` = '123
Request: controller?id[mysql%20where%20(select%200)%20or%20sleep(1).xxx][yyy]=123
Queries:
SHOW TABLES
SHOW TABLES IN mysql where (select 0) or sleep(1)
(...)
SELECT `posts`.* FROM `posts` WHERE `mysql where (select 0) or sleep(1)`.`xxx`.`yyy` = '123'
---
These are the variants covered on CVE-2012-2695. There are also some other tricky cases of the use of hashes in queries which are considered expected behavior by the Rails developers and were not fixed with these patches. One of them occurs when a developer sets a column name to be the same as the table name. Then, he uses "Post.where(:posts => params[:id]).all" to search all posts which have the "posts" column with the value of the parameter, but the attacker can control the hash to search by another column name.
Example:
---
Request: controller?id=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`posts` = '123'
Request: controller?id[column]=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`column` = '123'
---
Another tricky case happens when a developer uses a piece of code like "Post.where(params[:foo] => params[:bar]).all" pretending to let the user search over any post column. In this case, the attacker can actually control not only the columns to be queried, but also the table name.
Example:
---
Request: controller?foo=column&bar=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`column` = '123'
Request: controller?foo=table.column&bar=123
Query: SELECT `posts`.* FROM `posts` WHERE `table`.`column` = '123'
---
Hopefully, all these cases will be detailed in the Rails Security Guide in the near future. We recommend everyone to update their Rails to the fixed versions 3.2.6, 3.1.6, 3.0.14 or to apply the patches.
by Gabriel Quadros - Security Research in Conviso Application Security
[1] http://seclists.org/oss-sec/2012/q2/504
[2] http://blog.pentesterlab.com/2012/06/cve-2012-2661-exploitation-write-up.html
These new patches actually fixed two variants of the CVE-2012-2661 case. We will cover them later. First let's see the original vulnerability fixed on CVE-2012-2661. This vulnerability occurred during the processing of code like "Post.where(:id => params[:id]).all". In this case, the attacker was able to change the query by manipulating the hash to include any table/column pair.
Example:
---
Request: controller?id=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`id` = '123'
Request: controller?id[table.column]=123
Query: SELECT `posts`.* FROM `posts` WHERE `table`.`column` = '123'
---
After the release of the patches for CVE-2012-2661, we did some investigation and still were able to exploit the same piece of code with two different variants. The first one was simply a small change in the way the hash is passed.
Example:
---
Request: controller?id=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`id` = '123'
Request: controller?id[table][column]=123
Query: SELECT `posts`.* FROM `posts` WHERE `table`.`column` = '123'
---
And the second one exploited a flaw which allowed the attacker to specify the database name to be used in a SHOW TABLES query. Since the name was user-supplied and not quoted, we were able to execute a Blind SQL Injection (tested on MySQL) and an Error-Based SQL Injection in case Rails is misconfigured to exhibit the exception/stacktrace pages. There is also a blog [2] that talks about this case.
Example:
---
Request: controller?id=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`id` = '123
Request: controller?id[mysql%20where%20(select%200)%20or%20sleep(1).xxx][yyy]=123
Queries:
SHOW TABLES
SHOW TABLES IN mysql where (select 0) or sleep(1)
(...)
SELECT `posts`.* FROM `posts` WHERE `mysql where (select 0) or sleep(1)`.`xxx`.`yyy` = '123'
---
These are the variants covered on CVE-2012-2695. There are also some other tricky cases of the use of hashes in queries which are considered expected behavior by the Rails developers and were not fixed with these patches. One of them occurs when a developer sets a column name to be the same as the table name. Then, he uses "Post.where(:posts => params[:id]).all" to search all posts which have the "posts" column with the value of the parameter, but the attacker can control the hash to search by another column name.
Example:
---
Request: controller?id=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`posts` = '123'
Request: controller?id[column]=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`column` = '123'
---
Another tricky case happens when a developer uses a piece of code like "Post.where(params[:foo] => params[:bar]).all" pretending to let the user search over any post column. In this case, the attacker can actually control not only the columns to be queried, but also the table name.
Example:
---
Request: controller?foo=column&bar=123
Query: SELECT `posts`.* FROM `posts` WHERE `posts`.`column` = '123'
Request: controller?foo=table.column&bar=123
Query: SELECT `posts`.* FROM `posts` WHERE `table`.`column` = '123'
---
Hopefully, all these cases will be detailed in the Rails Security Guide in the near future. We recommend everyone to update their Rails to the fixed versions 3.2.6, 3.1.6, 3.0.14 or to apply the patches.
by Gabriel Quadros - Security Research in Conviso Application Security
[1] http://seclists.org/oss-sec/2012/q2/504
[2] http://blog.pentesterlab.com/2012/06/cve-2012-2661-exploitation-write-up.html
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
quinta-feira, 31 de março de 2011
Atualização de Security Advisories
Consideramos Security Advisories uma importante ferramenta de contribuição para a comunidade, onde de uma forma responsável, sempre que identificamos falhas em aplicações entramos em contato com o desenvolvedor para buscar uma solução que corrija o ponto em questão e permita o uso de forma segura.
Até ontem tínhamos sete documentos publicados de forma distribuída em mais de um repositório, porém para assegurar que o acesso seja feito de forma mais adequada, estamos agora concentrando todo o material somente em nosso blog e mantendo o histórico na página de Recursos em nosso web site, o que leva a duas considerações:
Dois de nossos Security Advisories não estavam com o formato txt disponível em nosso web site, e foram hoje atualizados, a saber:
Foram adicionados dois recursos para facilitar a busca e acompanhamento deste tipo de publicação.
Com isso, estamos concentrando todos os Security Advisories publicados pelo Conviso Labs em nosso blog e mantendo o histórico em um repositório único.
Até ontem tínhamos sete documentos publicados de forma distribuída em mais de um repositório, porém para assegurar que o acesso seja feito de forma mais adequada, estamos agora concentrando todo o material somente em nosso blog e mantendo o histórico na página de Recursos em nosso web site, o que leva a duas considerações:
Atualização do Formato
Dois de nossos Security Advisories não estavam com o formato txt disponível em nosso web site, e foram hoje atualizados, a saber:
- Security Advisory CVE 2010-158224/7 Real Media’s Open AdStream v.5.7, publicado em 05/05/2010
- Security Advisory CVE-2010-3977 cform Wordpress Plugin V 11.5, publicado em 19/10/2010
Acompanhamento das Publicações
Foram adicionados dois recursos para facilitar a busca e acompanhamento deste tipo de publicação.
- Todos os Security Advisories atuais foram categorizados com a tag "advisories" em nosso blog. Assim, você sempre poderá utilizar o link http://blog.conviso.com.br/category/advisories/ para ter acesso as publicações.
- Foi criado o Feed RSS http://blog.conviso.com.br/category/advisories/feed/ para acompanhamento de novos documentos.
Com isso, estamos concentrando todos os Security Advisories publicados pelo Conviso Labs em nosso blog e mantendo o histórico em um repositório único.
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
Security Advisory | CVE-2010-3977 | cform Wordpress Plugin V 11.5
Introduction
1. Copyright and Disclaimer
The information in this advisory is Copyright 2010 Conviso and provided so that the society can understand the risk they may be facing by running affected software, hardware or other components used on their systems. In case you wish to copy information from this advisory, you must either copy all of it or refer to this document (including our URL). No guarantee is provided for the accuracy of this information, or damage you may cause your systems in testing.
2. About Conviso
Founded on 2008 by a team of professionals working the IT Security market since 1997, Conviso is a consulting company specialized on network and application security services. Our values are based on the allocation of the adequate competencies on the field, a clear and direct speech with the market, collaboration and partnership with our customers and business partners and constant investments on methodology and research improvement.
This advisory has been discovered as part of a general investigation into the security of software used in the IT environments of our customers. For more information about our company and services provided, please check our website at www.conviso.com.br.
3. The Security Research
Conviso maintains a virtual team dedicated to explore our customer’s environments in order to identify technical vulnerabilities in software and hardware, developing real-world mitigation solutions and processes to maintain more secure environments. Leaded by Wagner Elias, our CTO, this team is named Conviso Labs and also contribute to important world-class organizations projects and organizations.
The vulnerability described in this security advisory was discovered by Wagner Elias on July 24th 2010 during a penetration test project.
Security Advisory
1. Issue Description
Created and distributed by Delicious Days (http://www.deliciousdays.com/), cforms is a rich form plugin for WordPress, offering deployment of multiple Ajax driven contact forms throughout user’s blog or even on the same page. An issue on version 11.5 allows the exploit of a Cross Site Scripting (XSS) vulnerability and the consequent capability of client-side attacks for data leaking and malware propagation.
2. Affected Components
File lib_ajax.php on version 11.5.
3. Details
The file lib_ajax.php on version 11.5 creates a data array with all values inserted on the form’s fields on a POST requisition. As there is no data validation of the rs and rsargs parameters, it is possible to inject malformed data by Javascript.
Request:
http://www.siteexample.com/wp-content/plugins/cforms/lib_ajax.php
POST /wp-content/plugins/cforms/lib_ajax.php HTTP/1.1
Host: www.siteexample.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 219
Cookie: wp-settings-1=m0%3Do%26m1%3Do%26m2%3Do%26m3%3Do%26m4%3Do%26m5%3Do%26m6%3
Do%26m7%3Do%26m8%3Do%26urlbutton%3Dnone%26editor%3Dtinymce%26imgsize%3
Dfull%26align%3Dcenter%26hidetb%3D1%26m9%3Dc%26m10%3Do%26uploader%3D1%26m11%3Do;
wp-settings-time-1=1285758765; comment_author_93f41ba0b16f34676f802058e82388f6=teste; comment_author_email_93f41ba0b16f34676f802058e82388f6=welias%40conviso.com.br
Pragma: no-cache
Cache-Control: no-cache
rs=<script>alert(1)</script>&rst=&rsrnd=1287506634854&rsargs[]=1$#$<script>alert(1)</script>
$#$welias@conviso.com.br$#$http://blog.conviso.com.br$#$<script>alert(1)</script>
4. Issue Mitigation
Update to version 11.6.1.
5. Additional Information
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2010-3977 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
6. CVSS Issue Severity Scores
Conviso calculated the scores of this vulnerability using the online CVSS calculator found at http://www.patchadvisor.com/PatchAdvisor/CVSSCalculator.aspx and described at http://www.first.org/cvss/cvss-guide.pdf.
- Base Metrics | Value: 5,7
- Temporal Metrics | Value: 4,5
- Environmental Metrics | Value: 0
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
Security Advisory CVE 2010-1582 24/7 Real Media’s Open AdStream v.5.7
Introduction
1. Copyright and Disclaimer
The information in this advisory is Copyright 2010 Conviso and provided so that the society can understand the risk they may be facing by running affected software, hardware or other components used on their systems. In case you wish to copy information from this advisory, you must either copy all of it or refer to this document (including our URL). No guarantee is provided for the accuracy of this information, or damage you may cause your systems in testing.
2. About Conviso
Founded on 2008 by a team of professionals working the IT Security market since 1997, Conviso is a consulting company specialized on network and application security services. Our values are based on the allocation of the adequate competencies on the field, a clear and direct speech with the market, collaboration and partnership with our customers and business partners and constant investments on methodology and research improvement.
This advisory has been discovered as part of a general investigation into the security of software used in the IT environments of our customers. For more information about our company and services provided, please check our website at www.conviso.com.br.
3. The Security Research
Conviso maintains a virtual team dedicated to explore our customer’s environments in order to identify technical vulnerabilities in software and hardware, developing real-world mitigation solutions and processes to maintain more secure environments. Leaded by Wagner Elias, our CTO, this team is named Conviso Labs and also contribute to important world-class organizations projects and organizations.
The vulnerability described in this security advisory was discovered by Wagner Elias on January 14th 2010 during a malware investigation project.
Security Advisory
1. Issue Description
This advisory describes a vulnerability in the permission of the directory RealMedia created as default during the installation of Open AdStream, an ad campaign management platform provided by 24/7 Real Media, which exposes directly to the Internet the configuration files, including .sql which contains access credentials.
As a result, a cracker can use this flaw to install a backdoor or take the ownership of the affected component as he/she had access to all configuration files and access credentials.
2. Affected Components
The vulnerability was identified on the deployment of Open AdStream Version 5.7 in several large Brazilian Internet portals and media delivery websites. The product’s webpage is located at http://www.247realmedia.com/EN-US/us/open-ad-stream.html.
This version of the product can be used only with MySQL 3.23 and Apache 1.36.x, versions which are outdated and vulnerable to several exploits as described on the security advisories posted on the Internet at http://www.securityfocus.com/bid/11357 and http://httpd.apache.org/security/vulnerabilities_13.html.
The vulnerability described in this advisory can easily be found by “script kid” style hackers, making non-targeted attacks, by searching Google using “Google Hacking” techniques.
3. Details
The deployment process performed by 24/7 Real Media keeps the default configuration on Open AdStream which publishes the configuration files of the host exposed to the Internet on a format such as http://admXX.customername.com.br/RealMedia. As a result the following example files can be fully accessed:
ads oasis_mysql_insertdb.sqlbcrypt oasis_mysql_insertdb.sql.templateClasses oasis_mysql_insertuser.sqlConvertNotification.ini oasis_mysql_insertuser.sql.templatehash.txt oasis_mysql_testdb.sqlindex.html oasis_mysql_testdb.sql.templateini oasis_mysql_uninstalldb.sqlinstall.sh oasis_mysql_uninstalldb.sql.templatelibstdc++.so.2.10 oasis_mysql_uninstallOAS.sqllicense.txt oasis_mysql_uninstallOAS.sql.templatelicense.txt.bfe oasis_params.cfgoasis_apache.layout oasis_path_substitution.shoasis.cfg oasis_ReportFormat.awkoasis_cfg_apache.sh oasis_ReportFormat_mapping.5.1.1oasis_cfg_cron.sh oasis_ReportFormat_mapping.5.1.2oasis_cfg_distrib.sh oasis.shoasis_cfg_mysql.sh oasis_upgrade_apache.cfgoasis_cfg_ns.sh oasis_upgrade_de.shoasis_copysofiles.sh oasis_upgrade_ns.cfgoasis_errorlog.sh oasis_upgrade_ns.shoasis_example.cfg oasis_util.shoasis_find_apache.sh oasis_validate_config.shoasis_finish_upgrade.sh oasis_wsusr_apache.cronoasis_install.ini oasis_wsusr_bean.cronoasis_install_oas.sh oasis_wsusr_bean.cron.templateoasis.log oasis_wsusr_nightly.cronoasis_mysql_createdb.sql oasis_wsusr_nightly.cron.templateoasis_mysql_createdb.sql.template
The database server location as well as access credentials of administrative accounts can be found within the files oasis_mysql_insertuser.sql and oasis_params.cfg. With this information, an attacker could gain access to the database and perform any malicious activity. Other files such as oasis_install.ini and install.sh discloses the directory organization of Open AdStream server, which could be useful in combination with another attack.
Other problem we found is related to the old versions of Apache HTTP server and MySQL that must be installed to use the affected software.
Apache Foundation released the final release of version 1.3 of the Apache HTTP Server on February 3rd 2010, stating that no more full releases will be produced, although critical security updates may be made available as described on their mailing lists archives at http://mail-archives.apache.org/mod_mbox/httpd-announce/201002.mbox/%3C20100203000334.GA19021@infiltrator.stdlib.net%3E. They recommend that users update to the current 2.2 version.
4. Issue Mitigation
The permission of the directory RealMedia should be changed in order to deny access to the configuration files.
5. Additional Information
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2010-1582 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
6. CVSS Issue Severity Scores
Conviso calculated the scores of this vulnerability using the online CVSS calculator found at http://www.patchadvisor.com/PatchAdvisor/CVSSCalculator.aspx and described at http://www.first.org/cvss/cvss-guide.pdf.
- Base Metrics | Value: 9
- Temporal Metrics | Value: 9
- Environmental Metrics | Value: 7
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
quinta-feira, 24 de março de 2011
Related Posts Word Press Plugin Cross Site Scripting Vulnerability - CVE-2011-0760
Introduction
Copyright and Disclaimer
The information in this advisory is Copyright 2010 Conviso and provided so that the society can understand the risk they may be facing by running affected software, hardware or other components used on their systems. In case you wish to copy information from this advisory, you must either copy all of it or refer to this document (including our URL). No guarantee is provided for the accuracy of this information, or damage you may cause your systems in testing.
About Conviso
Conviso is a consulting company specialized on application security. Our values are based on the allocation of the adequate competencies on the field, a clear and direct speech with the market, collaboration and partnership with our customers and business partners and constant investments on methodology and research improvement.
This advisory has been discovered as part of a general investigation into the security of software used in the IT environments of our customers. For more information about our company and services provided, please check our website at www.conviso.com.br.
The Security Research
Conviso maintains a virtual team dedicated to explore our customer’s environments in order to identify technical vulnerabilities in software and hardware, developing real-world mitigation solutions and processes to maintain more secure environments. Leaded by Wagner Elias, our CTO, this team is named Conviso Labs and also contribute to important world-class organizations projects and organizations.
The vulnerability described in this security advisory was discovered by Gabriel Quadros on December 22nd 2010 during a internal security research.
Security Advisory
Issue Description
The WordPress Related Posts Plugin, available at http://WordPress.org/extend/plugins/wp-related-posts/ shows the posts related to others posts. This advisory describes multiple Stored Cross Site Scripting (XSS) vulnerabilities and one Cross Site Request Forgery (CSRF) vulnerability on the plugin.
As a result, an attacker can gain elevated access privileges to sensitive page content, session cookies, and a variety of other information maintained by the web browser on behalf of the WordPress administrator. Furthermore, the attacker can perform actions with administrative privileges.
Affected Components
This problem was confirmed in the latest version of the plugin - WP Related Posts 1.0, other versions maybe also affected.
CVSS Scoring System
Conviso calculated the scores using the online CVSS calculator found at http://www.patchadvisor.com/PatchAdvisor/CVSSCalculator.aspx and described at http://www.first.org/cvss/cvss-guide.pdf.
The CVSS score is: 6.4
- Base Score: 6.7
- Temporal Score: 6.4
We used the following values to calculate the scores:
- Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:N
- Temporal score is: E:F/RL:U/RC:C
Details
The plugin's configuration page is vulnerable to Stored Cross Site Scripting. The three fields wp_relatedposts_ title, wp_relatedposts_num and wp_relatedposts_type are received through POST or GET and included on the response page with inadequate sanitization. The vulnerable code is shown bellow:
158: <tr valign="top">
159: <th scope="row">Title:</th>
160: <td><input type="text"
name="wp_relatedposts_title" value="<?=$options['
title']?>"></td>
161: </tr>
162: <tr valign="top">
163: <th scope="row">Number posts:</th>
164: <td><input type="text"
name="wp_relatedposts_num" value="<?=$options['
count']?>"></td>
165: </tr>
166: <tr valign="top">
167: <th scope="row">Related on:</th>
168: <td>
169: <select name="wp_relatedposts_type">
170: <option
selected value="<?=$options['type']?>"><?=$options['type']?></option>
171: <option
value="Tags">Tags</option>
172: <option
value="Category">Category</option>
173: </select>
174: </td>
Another vulnerable piece of code is the one which prints the related posts list. The title, eceived through the parameter wp_relatedposts_title, is included with little sanitization into suchs lists. The vulnerable code is shown bellow:
79: $relatedpost.= '<br><br><br><h3>' . $options['title'] . '</h3><ul>';
(...)
120: $relatedpost.= '<br><br><br><h3>' . $options['title'] . '</h3><ul>';
These vulnerabilities allow an attacker to insert HTML/JavaScript commands to be interpreted in the session of an authenticated administrator. Since the plugin's configuration page is not protected against Cross Site Request Forgery, the exploitation permits the attacker to inject configuration values. Proof of concept exploitation code is available to interested parties.
Issue Mitigation
The developers have not provided a patch or workaround. The solution should add code to sanitize the values before including them using the htmlspecialchars() function or equivalent. Furthermore, a mechanism to protect against the CSRF is needed to prevent an attacker from changing the plugin's configuration.
Additional Information
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2011-0760 to this issue.
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
Security Advisory: Recaptcha Word Press Plugin Cross Site Scripting Vulnerability | CVE 2011-0759
Introduction
Copyright and Disclaimer
The information in this advisory is Copyright 2010 Conviso and provided so that the society can understand the risk they may be facing by running affected software, hardware or other components used on their systems. In case you wish to copy information from this advisory, you must either copy all of it or refer to this document (including our URL). No guarantee is provided for the accuracy of this information, or damage you may cause your systems in testing.
About Conviso
Conviso is a consulting company specialized on application security. Our values are based on the allocation of the adequate competencies on the field, a clear and direct speech with the market, collaboration and partnership with our customers and business partners and constant investments on methodology and research improvement.
This advisory has been discovered as part of a general investigation into the security of software used in the IT environments of our customers. For more information about our company and services provided, please check our website at www.conviso.com.br.
The Security Research
Conviso maintains a virtual team dedicated to explore our customer’s environments in order to identify technical vulnerabilities in software and hardware, developing real-world mitigation solutions and processes to maintain more secure environments. Leaded by Wagner Elias, our CTO, this team is named Conviso Labs and also contribute to important world-class organizations projects and organizations.
The vulnerability described in this security advisory was discovered by Gabriel Quadros on December 22nd 2010 during a internal security research.
Security Advisory
Issue Description
The WordPress Recaptcha Plugin integrates reCAPTCHA antispam methods with WordPress including comment, registration, and email spam protection and is available at http://wordpress.org/extend/plugins/wp-recaptcha/.
This advisory describes multiple Stored Cross Site Scripting (XSS) vulnerabilities and one Cross Site Request Forgery (CSRF) vulnerability on the plugin. As a result, an attacker can gain elevated access privileges to sensitive page content, session cookies, and a variety of other information maintained by the browser on behalf of the WordPress administrator user. Furthermore, the attacker can perform actions administrative privileges.
Affected Components
This problem was confirmed in the latest version of the plugin - WP-reCAPTCHA 2.9.8.2, other versions maybe also affected.
CVSS Scoring System
Conviso calculated the scores using the online CVSS calculator found at http://www.patchadvisor.com/PatchAdvisor/CVSSCalculator.aspx and described at http://www.first.org/cvss/cvss-guide.pdf.
The CVSS score is: 6.4
- Base Score: 6.7
- Temporal Score: 6.4
We used the following values to calculate the scores:
- Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:N
- Temporal score is: E:F/RL:U/RC:C
Details
The plugin's configuration page is vulnerable to Stored Cross Site Scripting. Several fields are received through POST and included on the response page with inadequate sanitization. The vulnerable code is shown bellow:
749: <input name="recaptcha_opt_pubkey" id="recaptcha_opt_pubkey" size="40"
value="<?php echo $optionarray_def['pubkey']; ?>" />
753: <input name="recaptcha_opt_privkey" id="recaptcha_opt_privkey" size="40"
value="<?php echo $optionarray_def['privkey']; ?>" />
782: <input name="re_tabindex" id="re_tabindex" size="5" value="<?php echo
$optionarray_def['re_tabindex']; ?>" />
814: <input name="error_blank" id="error_blank" size="80" value="<?php
echo $optionarray_
def['error_blank']; ?>" />
818: <input name="error_incorrect" id="error_incorrect" size="80" value="<?php
echo $optionarray_def['error_incorrect']; ?>" />
865: <input name="mailhide_pub" id="mailhide_pub" size="40" value="<?php echo
$optionarray_def['mailhide_pub']; ?>" />
869: <input name="mailhide_priv" id="mailhide_priv" size="40" value="<?php echo
$optionarray_def['mailhide_priv']; ?>" />
888: <input name="mh_replace_link" id="mh_replace_link" size="40" value="<?php
echo $optionarray_def['mh_replace_link']; ?>" />
891: <input name="mh_replace_title" id="mh_replace_title" size="40" value="<?php
echo $optionarray_def['mh_replace_title']; ?>" />
As a result, an attacker may insert HTML/JavaScript commands to be interpreted in the session of an authenticated administrator and, as the plugin's configuration page is not protected against Cross Site Request Forgery, the exploitation can be used to inject configuration values and change the reCAPTCHA configuration, disabling CAPTCHA for comments and registration forms. Proof of concept exploitation code is available to interested parties.
Issue Mitigation
The developer did not provided a patch or workaround. The solution for this issue should add code to sanitize the values before including them using the htmlspecialchars() function or equivalent. Furthermore, a mechanism to protect against the CSRF is needed to prevent an attacker from changing the plugin's configuration.
Additional Information
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2011-0759 to this issue.
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
segunda-feira, 27 de dezembro de 2010
LiveZilla Cross Site Scripting Vulnerability | CVE-2010-4276
Introduction
Copyright and Disclaimer
The information in this advisory is Copyright 2010 Conviso and provided so that the society can understand the risk they may be facing by running affected software, hardware or other components used on their systems. In case you wish to copy information from this advisory, you must either copy all of it or refer to this document (including our URL). No guarantee is provided for the accuracy of this information, or damage you may cause your systems in testing.
About Conviso
Founded on 2008 by a team of professionals working the IT Security market since 1997, Conviso is a consulting company specialized on network and application security services. Our values are based on the allocation of the adequate competencies on the field, a clear and direct speech with the market, collaboration and partnership with our customers and business partners and constant investments on methodology and research improvement.
This advisory has been discovered as part of a general investigation into the security of software used in the IT environments of our customers. For more information about our company and services provided, please check our website at www.conviso.com.br.
The Security Research
Conviso maintains a virtual team dedicated to explore our customer’s environments in order to identify technical vulnerabilities in software and hardware, developing real-world mitigation solutions and processes to maintain more secure environments. Leaded by Wagner Elias, our R&D Manager, this team is named Conviso Labs and also contribute to important world-class organizations projects and organizations.
The vulnerability described in this security advisory was discovered by Ulisses Castro on November 1st 2010 during an internal research procedure.
Issue Description
LiveZilla is an application provided by LiveZilla GmbH to provide Live Chats, monitor website visitors in real-time and convert them in to customers. LiveZilla is affected by Reflected Cross Site Scripting on server.php in the “module” track which calls a vulnerable javascript function.
Affected Components
The issue was confirmed on version 3.2.0.2 but other other versions maybe also affected.
Issue Mitigation
LiveZilla released an update to fix the vulnerability, please check the availability at their changelog page.
CVSS Scoring System
The CVSS score is: 6.4
- Base Score: 6.7
- Temporal Score: 6.4
We used the following values to calculate the scores:
- Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:N
- Temporal score is: E:F/RL:U/RC:C
Details
The request http://<server>/livezilla/server.php?request=track&livezilla=<script>alert('xss')</script> pass through the following files:
- htdocs\livezilla\server.php
- htdocs\livezilla\track.php
- htdocs\livezilla\templates\jscript\jstrack.tpl
And land in this code exception:
--- 207 208 function lz_tracking_set_sessid(_userId, _browId) 209 { 210 if(lz_session.UserId != _userId) 211 { 212 lz_session.UserId = _userId; 213 lz_session.BrowserId = _browId; 214 lz_session.Save(); 215 } 216 } 217 ---The javascript file “jstrack.tpl” is called by track.php and contains a function named “lz_tracking_set_sessid()” which does not sanitize data and may allow an attacker to inject a malicious javascript code to support Reflected Cross Site Script attacks against users.
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
sexta-feira, 24 de dezembro de 2010
Embedded Video WordPress Plugin Cross Site Vulnerability (XSS) - CVE-2010-4277
Introduction
Copyright and Disclaimer
The information in this advisory is Copyright 2010 Conviso and provided so that the society can understand the risk they may be facing by running affected software, hardware or other components used on their systems. In case you wish to copy information from this advisory, you must either copy all of it or refer to this document (including our URL). No guarantee is provided for the accuracy of this information, or damage you may cause your systems in testing.
About Conviso
Founded on 2008 by a team of professionals working the IT Security market since 1997, Conviso is a consulting company specialized on network and application security services. Our values are based on the allocation of the adequate competencies on the field, a clear and direct speech with the market, collaboration and partnership with our customers and business partners and constant investments on methodology and research improvement.
This advisory has been discovered as part of a general investigation into the security of software used in the IT environments of our customers. For more information about our company and services provided, please check our website at www.conviso.com.br.
The Security Research
Conviso maintains a virtual team dedicated to explore our customer’s environments in order to identify technical vulnerabilities in software and hardware, developing real-world mitigation solutions and processes to maintain more secure environments. Leaded by Wagner Elias, our R&D Manager, this team is named Conviso Labs and also contribute to important world-class organizations projects and organizations.
The vulnerability described in this security advisory was discovered by Wagner Elias on October 20th 2010 during the Bug Hunting Day at Conviso Labs.
Issue Description
Embedded Video is a WordPress Plugin created by Jovel Stefan to easily embedded videos in blog posts. The videos can be uploaded to the web server or come from external portals (like YouTube, Google Video and others) and links to the video on the video portal or for download of the video can be automatically generated as well.
The plugin has a Cross Site Script (XSS) vulnerability.
Affected Components
Version 4.1 of Embedded Video Word Press Plugin.
Issue Mitigation
This problem was confirmed in the latest version of the plugin, other versions maybe also affected. The developer replied to the advisory in a very responsible manner but unfortunately there will be no updates due to the fact that this component is not maintained anymore.
CVSS Scoring System
The CVSS score is: 6.4
- Base Score: 6.7
- Temporal Score: 6.4
We used the following values to calculate the scores:
- Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:N
- Temporal score is: E:F/RL:U/RC:C
Details
The file lembedded-video.php does not sanitize content variable, it is possible to inject malformed data by Javascript.
Code affected:
function embeddedvideo_plugin($content) { $output = preg_replace_callback(REGEXP_1, 'embeddedvideo_plugin_callback', $content); $output = preg_replace_callback(REGEXP_2, 'embeddedvideo_plugin_callback', $output); $output = preg_replace_callback(REGEXP_3, 'embeddedvideo_plugin_callback', $output); return ($output); }Request:
http://<server>/wordpress/wp-admin/post.php POST /wordpress/wp-admin/post.php HTTP/1.1 Host: <server> User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http://<server>/wordpress/wp-admin/post.php?post=8&action=edit&message=1 C o o k i e : w o r d p r e s s _ b b f a 5 b 7 2 6 c 6 b 7 a 9 c f 3 c d a 9 3 7 0 b e 3 e e 9 1 = a d m i n %7C1290110435%7C7f9fa1a66aec0259906ea15086aea0c8; wp-settings-time-1=1289940308; w o r d p r e s s _ t e s t _ c o o k i e = W P + C o o k i e + c h e c k ; w o r d p r e s s _ l o g g e d _ i n _ b b f a 5 b 7 2 6 c 6 b 7 a 9 c f 3 c d a 9 3 7 0 b e 3 e e 9 1 = a d m i n %7C1290110435%7C68b064d813dd8bfaa5d2d2cdf757848e; wp-settings-1=m1%3Do %26m6%3Dc%26m7%3Do Content-Type: application/x-www-form-urlencoded Content-Length: 1786 _wpnonce=b2bc367f9c&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fpost.php%3Fpost % 3 D 8 % 2 6 a c t i o n % 3 D e d i t % 2 6 m e s s a g e %3D1&user_ID=1&action=editpost&originalaction=editpost&post_author=1&post_type=post&original_ post_status=publish&referredby=http%3A%2F%2Flocalhost%2Fwordpress%2Fwp-admin %2Fpost.php%3Fpost%3D8%26action%3Dedit&_wp_original_http_referer=http%3A%2F %2Flocalhost%2Fwordpress%2Fwp-admin%2Fpost.php%3Fpost%3D8%26action % 3 D e d i t & p o s t _ I D = 8 & a u t o s a v e n o n c e = 9 6 2 9 3 9 1 7 c 9 & m e t a - b o x - o r d e r - n o n c e = c 2 f e 5 5 3 5 c 4 & c l o s e d p o s t b o x e s n o n c e = b a d 9 d c 7 7 5 b & w p - preview=&hidden_post_status=publish&post_status=publish&hidden_post_password=&hidden_post_v isibility=public&visibility=public&post_password=&mm=11&jj=17&aa=2010&hh=00&mn=05&ss=33&hi dden_mm=11&cur_mm=11&hidden_jj=17&cur_jj=17&hidden_aa=2010&cur_aa=2010&hidden_hh=00 &cur_hh=00&hidden_mn=05&cur_mn=36&original_publish=Update&save=Update&post_category % 5 B % 5 D = 0 & p o s t _ c a t e g o r y % 5 B % 5 D = 1 & n e w c a t e g o r y = N e w + C a t e g o r y +Name&newcategory_parent=-1&_ajax_nonce-add-category=62352e38f5&tax_input%5Bpost_tag % 5 D = & n e w t a g % 5 B p o s t _ t a g %5D=&post_title=testando&samplepermalinknonce=4a0d9c8491&content=%5Byoutube+%3Cscript +type%3D%22text%2Fjavascript%22%3E%2F%2F+%3C%21%5BCDATA%5B%0D%0Aalert %281%29%0D%0A%2F%2F+%5D%5D%3E%3C%2Fscript%3E+%3Cscript+type%3D%22text %2Fjavascript%22%3E%2F%2F+%3C%21%5BCDATA%5B%0D%0Aalert%282%29%0D%0A%2F %2F+%5D%5D%3E%3C%2Fscript%3E%5D&excerpt=&trackback_url=&meta%5B6%5D%5Bkey %5D=_edit_last&_ajax_nonce=5453d93de8&meta%5B6%5D%5Bvalue%5D=1&meta%5B9%5D %5Bkey%5D=_edit_lock&_ajax_nonce=5453d93de8&meta%5B9%5D%5Bvalue %5D=1289954192&meta%5B8%5D%5Bkey%5D=_wp_old_slug&_ajax_nonce=5453d93de8&meta % 5 B 8 % 5 D % 5 B v a l u e % 5 D = & m e t a k e y i n p u t = & m e t a v a l u e = & _ a j a x _ n o n c e - a d d - meta=9453fa7f77&advanced_view=1&comment_status=open&ping_status=open&post_name=testan do&post_author_override=1
Issue History
- October 20, 2010: Issue discovered by Wagner Elias at Conviso Labs.
- October 22, 2010: Issue informed to the author.
- October 30, 2010: Author informed that the plugin is not maintained anymore.
- December 17, 2010: Security Advisory published.
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
sábado, 13 de novembro de 2010
Security Advisory: Spree e-commerce JSON v.0.11x
Uma versão em PDF também está disponível | A PDF version is also available
Spree e-commerce is an open source commerce platform written for the Ruby on Rails framework supporting "Over 100 extensions created by our active and dedicated community". This problem was confirmed in the following versions of the Spree e-commerce, other versions maybe also affected.
The CVSS score is: 2.7
We used the following values to calculate the scores:
There are multiple JSON Hijacking vulnerabilities and as result, an attacker can steal confidential information such as product costs, price and quantities and users email, encrypted password, tokens, OpenID identifier, phone and address as well as orders count and values by period.
There are some pages within the default Spree installation that use JavaScript Object Notation (JSON) as a transport mechanism between the client and the server. As the application cannot differentiate real requests from forged requests, and the JSON object returned can be accessed by the attacker's malicious code via a script tag, those pages are vulnerable to an attack known as JSON Hijacking.
The affected pages are:
- /admin/products.json
- /admin/users.json
- /admin/overview/get_report_data
Proof of concept exploitation code is available to interested parties.
The vulnerability described in this security advisory was discovered by Gabriel Quadros on October 1st 2010 during a internal security research.
Spree e-commerce JSON Hijacking Vulnerabilities - CVE-2010-3978
Introduction
Spree e-commerce is an open source commerce platform written for the Ruby on Rails framework supporting "Over 100 extensions created by our active and dedicated community". This problem was confirmed in the following versions of the Spree e-commerce, other versions maybe also affected.
- All 0.11.x versions
- The upcoming code 0.30.x versions
CVSS Scoring System
The CVSS score is: 2.7
- Base Score: 3.3
- Temporal Score: 2.7
We used the following values to calculate the scores:
- Base score is: AV:N/AC:L/Au:N/C:C/I:N/A:N
- Temporal score is: E:F/RL:OF/RC:C
Details
There are multiple JSON Hijacking vulnerabilities and as result, an attacker can steal confidential information such as product costs, price and quantities and users email, encrypted password, tokens, OpenID identifier, phone and address as well as orders count and values by period.
There are some pages within the default Spree installation that use JavaScript Object Notation (JSON) as a transport mechanism between the client and the server. As the application cannot differentiate real requests from forged requests, and the JSON object returned can be accessed by the attacker's malicious code via a script tag, those pages are vulnerable to an attack known as JSON Hijacking.
The affected pages are:
- /admin/products.json
- /admin/users.json
- /admin/overview/get_report_data
Proof of concept exploitation code is available to interested parties.
Credits
The vulnerability described in this security advisory was discovered by Gabriel Quadros on October 1st 2010 during a internal security research.
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
quarta-feira, 3 de novembro de 2010
JSON Hijacking Vulnerability
Trabalhando em conjunto com o Spree e a Locaweb, identificamos uma vulnerabilidade na aplicação que foi trabalhada junto com o fabricante dentro de nossa política de Responsible Disclosure, resultando em alterações no release 0.11.2 que corrigem o problema.
Nos próximos dias iremos publicar o Security Advisory detalhando este ponto, mas você já pode ver no blog da Spree a descrição da falha e a correção disponibilizada.
Nos próximos dias iremos publicar o Security Advisory detalhando este ponto, mas você já pode ver no blog da Spree a descrição da falha e a correção disponibilizada.
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
sábado, 30 de outubro de 2010
Security Advisory: Cform Wordpress Plugin v 11 | CVE-2010-3977
Uma versão em PDF está também disponível | A PDF version is also available
According to Delicious Days, "cforms is a powerful and feature rich form plugin for WordPress, offering convenient deployment of multiple Ajax driven contact forms throughout your blog or even on the same page."
This problem was confirmed in the following versions of the cforms WordPress Plugin, other versions maybe also affected.
The CVSS score is: 5.5
A data array is created in lib_ajax.php using values from a form field in a POST request. The parameters rs and rsargs are not validated and thus it is possible to inject code.
This vulnerability has been brought to our attention by Wagner Elias from Conviso IT Security company and researched internally by Rodrigo Rubira Branco from the Check Point Vulnerability Discovery Team (VDT).
Introduction
According to Delicious Days, "cforms is a powerful and feature rich form plugin for WordPress, offering convenient deployment of multiple Ajax driven contact forms throughout your blog or even on the same page."
This problem was confirmed in the following versions of the cforms WordPress Plugin, other versions maybe also affected.
- cforms v11.5
CVSS Scoring System
The CVSS score is: 5.5
- Base Score: 6.7
- Temporal Score: 5.5
- We used the following values to calculate the scores:
- Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:N
- Temporal score is: E:F/RL:OF/RC:C
Details
A data array is created in lib_ajax.php using values from a form field in a POST request. The parameters rs and rsargs are not validated and thus it is possible to inject code.
Request:
http://<server>/wp-content/plugins/cforms/lib_ajax.php
POST /wp-content/plugins/cforms/lib_ajax.php HTTP/1.1
Host: <server>
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:
1.9.2.10) Gecko/20100914 Firefox/3.6.10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 219
Cookie: wp-settings-1=m0%3Do%26m1%3Do%26m2%3Do%26m3%3Do%26m4%3Do%26m5%3Do
%26m6%3Do%26m7%3Do%26m8%3Do%26urlbutton%3Dnone%26editor%3Dtinymce
%26imgsize%3Dfull%26align%3Dcenter%26hidetb%3D1%26m9%3Dc%26m10%3Do
%26uploader%3D1%26m11%3Do; wp-settings-time-1=1285758765;
c o m m e n t _ a u t h o r _ 9 3 f 4 1 b a 0 b 1 6 f 3 4 6 7 6 f 8 0 2 0 5 8 e 8 2 3 8 8 f 6 = t e s t ;
comment_author_email_93f41ba0b16f34676f802058e82388f6=rbranco_nospam
%40checkpoint.com
Pragma: no-cache
Cache-Control: no-cache
rs=<script>alert(1)</script>&rst=&rsrnd=1287506634854&rsargs[]=1$#
$<script>alert(1)</script>$#$rbranco_nospam@checkpoint.com$#$http://
www.checkpoint.com$#$<script>alert(1)</script>
Credits
This vulnerability has been brought to our attention by Wagner Elias from Conviso IT Security company and researched internally by Rodrigo Rubira Branco from the Check Point Vulnerability Discovery Team (VDT).
Enviar por e-mailPostar no blog!Compartilhar no XCompartilhar no FacebookCompartilhar com o Pinterest
Marcadores:
Advisories
Neste blog você irá se informar sobre as atividades da Conviso Application Security. Visite o site e conheça a empresa: https://www.conviso.com.br
Assinar:
Postagens (Atom)