Multiple vulnerabilities found in CSGuestbook by CoolSerlets.com

Josh884_at_hotmail.com
Date: 02/24/05

  • Next message: Walton, John Michael (John): "RE: Avaya IP Office Phone Manager - Sensitive Information Cleartext Vulnerability" 
    Date: 24 Feb 2005 01:28:04 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

    Audit of the script: http://www.coolservlets.com/CSGuestbook/
    About this script: This is an open source GuestBook script offered by CoolServlets.com
    About the audit: This audit was performed by Daxgrapol and Dopel for RACAT (a subgroup of CASOS in the cyberarmy.net community).

    Note in advance: The script is dated at Feb 10, 2000, suggesting it is about 5 years old.

    Exploits found:

    File name: CSGuesbook.java
    Method name: public void service()
    Vulnerability Description: Although there is only one user mode currently implemented,
    the client could potentially send any user mode it wanted including "admin"
    which currently is not authenticated.

    File name: GuesbookFilter.java
    Method name: public String filterBadwords()
    Vulnerability Description: Only the first special character is filtered off of the return string.
    This can lead to string being return with escape characters concatenated
    on the user input.

    Ex. "Hello\\"
    (found by: Dopel).

    - Buffer overflow is possible (input field length not checked).
    (found by: Daxgrapol).

    Some logical coding errors:
    - the resulting hyperlink in the URL field (website of the signer) is something like this:
    http://localhost:8080/guestbook/www.sitename.com
    (where localhost:8080/guestbook refers to my local configuration)
    The error is in GuestBookEntry.java, line 59:
    return "<a href=\"" + url + "\">" + url + "</a>";
    must be :
    return "<a href=\"http://" + url + "\">" + url + "</a>";
    This because the transmission protocol is not specified.

    - In the method addDatabaseEntry(req, res, db) the input fields presence are validate like this:
    String entry_name = request.getParameter("name");
    if (entry_name == null) entry_name = "";
    Better solution is:
    String entry_name = "";
    entry_name = request.getParameter("name").trim();
    (This in order to avoid a 'valid' entry like ' x').

    - There is not a check on the maxlenght of each input field. Wherever I can put the entire 'Divine Commedy'. This check is imperative in the servlet code, suggested in the html form.

    - The email address is not checked as a real one (like the web address). Not really important in a guestbook, but if I ask for them why not to check them?
    (found by: Daxgrapol).

    Conclusion:
    This project is actually outdated by so much that we hope no-one uses it anymore, if you still do, you should really consider updating to something more safe, and coded to more recent standards.
    Still this report should show you how important proper coding is.

    On behalf of RACAT and CASOS,
    Anvar

  • Next message: Walton, John Michael (John): "RE: Avaya IP Office Phone Manager - Sensitive Information Cleartext Vulnerability"

    Relevant Pages

    • Re: How to rewrite with awk?
      ... > I'm unfamiliar with tools such as sed & awk. ... Extract the string that matches a RE. ... This script will not only expand all the lines that say "include ... file) and not resetting ARGV(the tmp file), it then lets awk do any ...
      (comp.unix.shell)
    • Re: Slow string
      ... I see virtually no difference in execution time for the code you posted when using cscript versus using wscript; to confirm, I bracketed the code with an initial ... Are you actually entering the script name into a console window? ... You can use the exact same line for every wrapper script - and that includes wsf and js scripts; all you need to do is change the final "vbs" to "wsf" or "js" as appropriate. ... If you build a large string by small concatenations, the performance degrades geometrically - so does array resizing, because they both use the same nasty technique inherited from VB1 of copying the entire data structure to a new structure with the added element. ...
      (microsoft.public.scripting.vbscript)
    • Re: Function that returns date of file.
      ... string after the date/time when it is used by itself. ... Is that your entire script? ... I make an IF statement that required the 'equals equals'. ... designed database your job will be all that much harder. ...
      (alt.php)
    • Allen Brownes Audit Trail code, Run-time error 3825
      ... db.Execute sSQL, dbFailOnError ... Audit trail, to track Deletes, Edits, and Inserts. ... "GetUserNameA" (ByVal lpBuffer As String, ... ' Append record to the temp audit table. ...
      (microsoft.public.access.formscoding)
    • Re: Update Notes Field
      ... I was able to run the script without any problems. ... The info attribute can be assigned a value when the user object is created, but I don't see where dsadd can do it. ... Most attributes are string values, and VBScript strings can include the character vbCrLf. ... If there is another way to add the information to the Notes field, ...
      (microsoft.public.windows.server.active_directory)