S21SEC-024 - Vignette TCL Injection
From: S21SEC (vul-serv_at_s21sec.com)
Date: 05/26/03
- Previous message: S21SEC: "S21SEC-020 - Vignette user enumeration"
- Next in thread: Stefan Bethke: "Re: S21SEC-024 - Vignette TCL Injection"
- Reply: Stefan Bethke: "Re: S21SEC-024 - Vignette TCL Injection"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 26 May 2003 16:14:17 +0200 To: bugtraq@securityfocus.com
###############################################################
ID: S21SEC-024-en
Title: Vignette TCL Injection
Date: 03/04/2003
Status: Vendor contacted and solution available
Scope: TCL code Execution, Remote command execution
Platforms: All
Author: rpinuaga
Location: http://www.s21sec.com/es/avisos/s21sec-024-en.txt
Release: External
###############################################################
S 2 1 S E C
Vignette TCL Injection
About Vignette
--------------
Vignette develops Content Management and Application Portal Software.
Description of vulnerability
----------------------------
Vignette Software presents a vulnerability in some propietary commands that permits the injection of TCL code under some circunstances.
The affected Vignette commands are:
- NEEDS
- VALID_PATHS
All the TCL templates or scripts, that use this commands, are vulnerable to remote code injection.
The source code of both commands is located in a file called "stdlib.tcl" at the Vignette library directory. The offending code is the following:
========== stdlib.tcl (Extracted from Vignette 5.6.3) ==========
-- Lines 1049/1053 (NEEDS command) --
SET cookieName "vgn_creds"
SET formPath [CURL /vgn/login]
SET queryString [SHOW HTTP_QUERY_STRING] <--- (!)
} elseif {[llength $args] < 2} {
error "Usage: NEEDS LOGIN cookieName URL\n"
--
-- Lines 1141/1146 (NEEDS command) --
} elseif {![string compare $arg "COOKIE"]} {
global _Cookie HTTP_COOKIE
regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString <--- (!)
set cookies [split $cookieString { }]
foreach c $cookies {
--
-- Lines 1272/1277 (VALID_PATHS command) --
global _Path
if {[info exists _Path] == 1 && [lsearch $paths $_Path] == -1} {
system_error "Invalid path \"$_Path\" for template (referer='[SHOW HTTP_REFERER]')" <--- (!)
}
return ""
--
=================================================
As seen, the value of some unfiltered variables is used and evaluated with the SHOW command. If the external variable contains Vignette code, then arbitrary TCL execution is posible. The affected input variables are:
- HTTP_QUERY_STRING, converted to queryString in NEEDS command.
- HTTP_COOKIE, converted to cookieString in NEEDS command.
- HTTP_REFERER, showed in VALID_PATHS command.
This three variables are received directly form the web client, and aren't sanitized in any way. If the Vignette/TCL escape characters are included "[" and "]" the code between them is evaluated as valid TCL code.
The VALID_PATHS command is very few used in Vignette Applications, but the NEEDS command is extensively used, even in the default Vignette templates. The following default installed templates are vulnerables and remotely exploitables:
/vgn/ac/edit - [NEEDS LOGIN]
/vgn/ac/index - [NEEDS LOGIN]
/vgn/vr/Editing - [NEEDS LOGIN]
/vgn/vr/Select - [NEEDS LOGIN]
/vgn/legacy/edit - [NEEDS LOGIN]
/vgn/ppstats - [NEEDS LOGIN]
It's important to note that the bug not only affect the default Vignette Applications, nor it affects all the applications developed over a Vignette Server Software, that use the affected commands.
Affected Versions and platforms
-------------------------------
This vulnerability has been tested in Vignette StoryServer 5, and Vignette V/6. But it seems that all currently avaliable versions are vulnerable.
Solution
--------
Replace the offending SHOW evaluations in stdlib.tcl with directly passed variables. For example:
instead: SET queryString [SHOW HTTP_QUERY_STRING]
use ==> SET queryString $HTTP_QUERY_STRING
instead: regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString
use ==> regsub -all {; } $HTTP_COOKIE { } cookieString
instead: system_error "Invalid path \"$_Path\" for template (referer='[SHOW HTTP_REFERER]')"
use ==> system_error "Invalid path \"$_Path\" for template (referer='$HTTP_REFERER')"
Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution.
Additional information
----------------------
These vulnerabilities have been found and researched by:
Ramon Pinuaga Cascales rpinuaga@s21sec.com
You can find the last version of this warning in:
http://www.s21sec.com/es/avisos/s21sec-024-en.txt
And other S21SEC warnings in http://www.s21sec.com/es/avisos/
- Previous message: S21SEC: "S21SEC-020 - Vignette user enumeration"
- Next in thread: Stefan Bethke: "Re: S21SEC-024 - Vignette TCL Injection"
- Reply: Stefan Bethke: "Re: S21SEC-024 - Vignette TCL Injection"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
