[DSECRG-09-038] Sun Glassfish Woodstock Project - Linked XSS Vulnerability

["Digital Security Research Group [DSecRG]" <research@xxxxxxxxxx>]

Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-038

Original advisory: http://dsecrg.com/pages/vul/show.php?id=138

Application:                Sun Glassfish Woodstock Project (part of Glassfish 
Enterprise Server)
Versions Affected:          4.2
Vendor URL:                 https://woodstock.dev.java.net/
Bug:                        Linked XSS Vulnerability
Exploits:                   YES
Reported:                   19.03.2009
Vendor response:            20.03.2009
Solution:                   YES    
Date of Public Advisory:    05.05.2009
Author:                     Digital Security Research Group [DSecRG] (research 
[at] dsecrg [dot] com)



Description
***********

Woodstock components are User Interface Components for the web, based on Java 
Server Faces and AJAX.

Woodstock also is part Glassfish Enterprise Server.

Woodstock has linked XSS vulnerability in 404 Error page.



Details
*******

Using this vulnerability attacker can steal admin's cookie and then 
authentificate as administrator or perform certain administrative 
actions.

Attacker can inject XSS in URL string using UTF-7 encoding.

Exploiting this issue required Auto-Select encoding in browser 
configuration.

Example:

http://[server]/theme/META-INF/>+ACJ-+AD4APB-SCRIPT+AD7-alert(+ACI-DSecRG_XSS+ACI-)+ADz-/SCRIPT+AD7-



Solution
********

This security vulnerabilities fixed in CVS.

The following link to the commit email message for the changes to fix these 
issue:

https://woodstock.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=4041



Credits
*******

http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html

About
*****

Digital Security is leading IT security company in Russia, providing 
information security consulting, audit and penetration testing services, risk 
analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and 
PCI DSS standards. Digital Security Research Group focuses on web application 
and database security problems with vulnerability reports, advisories and 
whitepapers posted regularly on our website.


Contact:    research [at] dsecrg [dot] com
            http://www.dsecrg.com 
            http://www.dsec.ru