[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
MVSA-10-001 - Google Message Security SaaS - SQL Injection vulnerabilities
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: MVSA-10-001 - Google Message Security SaaS - SQL Injection vulnerabilities
- From: marian.ventuneac@xxxxxxxxx
- Date: 15 Sep 2010 20:22:23 -0000
Security Advisory: MVSA-10-001
Vendor: Google
Service: Google Message Security SaaS (powered by Postini)
- Message Center II
Vulnerabilities: SQL Injection
Risk: High
Attack Vector: From Remote
Authentication: Required
Reference: http://www.ventuneac.net/security-advisories/MVSA-10-001
http://secureappdev.blogspot.com/2010/09/testing-google-message-security-saas.html
Description
Message Center II service (build 6_24) was found vulnerable to SQL Injection
attacks. When exploited by an attacker, the identified vulnerability could lead
to Information Disclosure (map database structure, extract data from available
tables), Denial of Service (consume server resources by injecting SQL heavy
queries), etc.
An authenticated attacker without administrative privileges can inject
arbitrary code into the SQL query built to generate the list of
quarantined/deleted e-mails. This can be achieved by manipulating the
sort_direction parameter of /junk_quarantine/process and /trash/process
resources.
Test case: sort_direction='
POST https://mc-s200.postini.com/app/msgctr/junk_quarantine/process HTTP/1.1
Host: mc-s200.postini.com
...
Content-Type: multipart/form-data;
boundary=---------------------------26418279386900
Content-Length: 1351
-----------------------------26418279386900
Content-Disposition: form-data; name="_submitted_junk_quarantine_form"
1
...
-----------------------------26418279386900
Content-Disposition: form-data; name="range_menu"
1-14
-----------------------------26418279386900
Content-Disposition: form-data; name="sort_menu"
from_asc
-----------------------------26418279386900
Content-Disposition: form-data; name="sort_direction"
desc'
-----------------------------26418279386900
...
Due to the unsafe inclusion of user provided content into the dynamically built
SQ statement, the system returns an error including details on the database
engine used, error type, middleware settings, and SQL error stack trace. Such
information allowed devising further SQL Injection test cases.
Affected Versions
Message Center II service of Google Message Security SaaS build 6_24 (January
2010).
Mitigation
Google fixed the issue in Message Center II build 6_25 (February 2010).
Disclosure Timeline
2010, January 29: Vulnerability discovered and documented
2010, January 30: First notification sent to Google
2010, February 1: Second notification sent to Google
2010, February 2: Third notification sent to Google
2010, February 3: Google acknowledges the vulnerability
2010, February 22: Fix deployed in production (build 6_25)
2010, September 15: MVSA-10-001 advisory published
Credits
Dr. Marian Ventuneac
http://ventuneac.net