|
BEA WebLogic Administration Console error page cross-site scripting vulnerability
May 27, 2005
Risk Level: High
Affected versions:
BEA WebLogic Server 7.0 and 8.1
Credits:
This vulnerability was discovered and researched by Agustín Martínez Fayó of Argeniss for Application Security Inc.
Background:
The Administration Console is a web browser-based, graphical user interface used to manage a WebLogic Server domain. The Administration Console supports a full range of product administrative tasks. A cross-site scripting vulnerability exists in the login page of the Console.
Details:
Cross-site scripting vulnerabilities occur when an attacker tricks a legitimate web application into sending malicious code, generally in the form of a script, to an unsuspecting end user. The attack usually involves crafting a hyperlink with malicious script code embedded within it. A valid user is likely to click on this link since it points to a resource on a trusted domain. The link can be posted on a web page, or sent in an instant message, or email. Clicking the link executes the attacker-injected code in the context of the trusted web application. Typically, the code steals session cookies, which can then be used to impersonate a valid user.
Parameters provided to the error page are vulnerable to cross-site scripting attacks. User-supplied input to these parameters is returned without proper sanitization, allowing a malicious attacker to inject arbitrary scripting code.
To get the session cookie a remote attacker could send this link to the administrator:
http://vulnerablesite:7001/console/a?=<script>alert(document.cookie)</script>
Impact:
Attackers can steal administrator's session cookies and password, thereby allowing the attacker to impersonate the valid user.
Workaround:
There is no workaround for this issue.
Vendor Status:
Vendor was contacted and a patch was released.
Fix:
For BEA WebLogic Server and WebLogic Express 8.1 upgrade to Service Pack 4. Apply the patch on top of it located at ftp://ftpna.bea.com/pub/releases/security/CR202495_810sp4.jar on top of the service packs.
For BEA WebLogic Server and WebLogic Express 7.0 upgrade to Service Pack 6. Apply the patch located at ftp://ftpna.bea.com/pub/releases/security/CR214457_700sp6.jar on top of the service packs.
Links:
BEA Advisory: http://dev2dev.bea.com/pub/advisory/130
|
