[Full-Disclosure] STG Security Advisory: JEUS Web Application Server Cross Site Scripting Vulnerability

From: SSR Team (advisory_at_stgsecurity.com)
Date: 06/17/03

  • Next message: Justin Shin: "[Full-Disclosure] weasel32" 
    To: "Full Disclosure" <full-disclosure@lists.netsys.com>
Date: Tue, 17 Jun 2003 10:19:55 +0900

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    STG Security Advisory: JEUS Web Application Server Cross Site Scripting
    Vulnerability

    Revision: 1.0
    Date Published: 2003-06-17 (KST)
    Last Update: 2003-06-17

    Product Description
    =========
    JEUS (Java Enterprise User Solution) is a J2EE compatible web application
    server, developed by Tmax Soft, providing a clustering system especially
    designed for large enterprise business applications.

    Vulnerability Class
    ================
    Implementation Error: Inappropriate Input Validation

    Affected Products
    ================
    This vulnerability was found at JEUS 3.1.4p1. The vendor confirmed all
    versions below 3.2.2 have this vulnerability.

    Details
    ======
    JEUS Web Application Server has a cross site scripting vulnerability
    invoking a JavaScript as following:

    Proof of Concept
    http://vulnerable.com/url.jsp?foo=>alert('XSS vulnerability
    exists!')</script>

    An attacker could hijack the session of an administrator or spread viruses
    or worms using vulnerabilities of Web browsers.

    Impact
    ======
    At August 2002, Eye on Security released an article entitled "Bypassing
    JavaScript Filters - the Flash! Attack" on the attacking method utilizing
    cross site scripting vulnerabilities. An attacker could use a highly
    effective automated tool using this method for session hijacking in the
    wild to acquire the privilege of administrators and to alter or erase the
    web pages of an victim site.

    Solutions
    ========
    STG Security has notified this vulnerability to the vendor, which fixed this
    problem and released JEUS 3.2.2 on October 2002.
    Much detailed information is found at     http://www.tmax.co.kr

    Vendor Status: FIXED
    ===================
    2002-10-12 Tmax Soft notified.
    2002-10-17 Second attempt at vendor contact.
    2002-10-17 Fixed version released.
    2003-05-21 Last attempt at vendor contact.
    2003-06-17 Public disclosure.

    Credits
    ======
    Jeremy Bae at STG Security SSR Team

    About STG Security
    =================
    STG Security Inc. is a affiliated company of STG Group which has its head
    office in the States founded in march 2000. Its core business area is
    Information Security Consulting Service based on 30 years of various
    Information Security Consulting experiences in the States including more
    than 100 projects of Risk Assessment and Penetration testing implemented for
    the American government organizations. Also STG Group is a member company
    to undertake Safeguard project which is government Information Security
    project initiated by the Clinton cabinet. Those experiences and
    methodologies are applied to the Korean Information Security market by STG
    Security Inc.

    http://www.stgsecurity.com/

    Phone +82-2-6333-4500
    FAX +82-2-6333-4545

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQA/AwUBPu5saT9dVHd/hpsuEQJ/IQCgocpu50rK+tqmlhQ9cS7vawtu1XMAn1uh
    exTHNRRklHJVZ3XaYQzlIeCH
    =8SZ9
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Justin Shin: "[Full-Disclosure] weasel32"