[NEWS] Verity K2 Toolkit Query Builder XSS Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 07/03/03

  • Next message: SecuriTeam: "[NT] Windows 2000 ShellExecute() API Lets Applications to Cause a Buffer Overflow" 
    To: list@securiteam.com
Date: 3 Jul 2003 12:13:35 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security in Canada

    Toronto-based Sunrays Technologies is now Beyond Security's representative in Canada.
    We welcome ISPs, system integrators and IT systems resellers
    to promote the most advanced vulnerability assessment solutions today.

    Contact us at 416-482-0038 or at canadasales@beyondsecurity.com

    - - - - - - - - -

      Verity K2 Toolkit Query Builder XSS Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.ultraseek.com/products/oem_solutions/k2_developer/index.html>
    Verity's K2 Toolkit provides e-commerce developers with text retrieval
    capabilities and application integration features necessary for
    customization including catalog navigation and content search functions.

    Verity's K2 Toolkit has a XSS vulnerability in the Query Builder.

    DETAILS

    Vulnerable systems:
     * Verity K2 Toolkit v2.20

    Query Builder in Verity K2 Toolkit executes a malicious JavaScript command
    injected in query string when displaying error messages.

    Proof of Concept:
    http://[victim site]/[search].jsp?[query]=><img
    src=javascript:alert(document.cookie)>

    Result:
    Internal Servlet Error: Error E1-0111 (Query Builder): Syntax error in
    query string near character [foo]
    Error E1-0111 (Query Builder): Syntax error in query string near character
    [bar]
    Error E1-0114 (Query Builder): Error parsing query: [JAVASCRIPT RUNS
    HERE!]
    ..

    Using this cross site scripting vulnerability, an attacker can hijack the
    session of an administrator and deploy viruses or worms via vulnerable web
    browsers.

    Workaround:
    A workaround this problem, programmers must implement below exception
    process mechanisms.

    1. Catch exceptions and redirect users to a static error page predefined.
    2. Log all errors to a log file for your debugging purpose.

    Vendor Status:
    2003-06-17 Verity notified.
    2003-06-18 Verity replied.
    2003-06-18 Second attempt at vendor contact.
    2003-06-23 Third attempt at vendor contact.
    2003-06-24 Verity resisted following up the problem.
    2003-07-01 Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by Jeremy Bae at
    <mailto:advisory@stgsecurity.com> SSR Team.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Windows 2000 ShellExecute() API Lets Applications to Cause a Buffer Overflow"