MapInfo Discovery Multiple Remote Vulnerabilities
BID:10927
Info
MapInfo Discovery Multiple Remote Vulnerabilities
| Bugtraq ID: | 10927 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 15 2003 12:00AM |
| Updated: | Apr 15 2003 12:00AM |
| Credit: | An anonymous person disclosed these vulnerabilities. |
| Vulnerable: |
MapInfo MapInfo Discovery 1.1 MapInfo MapInfo Discovery 1.0 |
| Not Vulnerable: | |
Discussion
MapInfo Discovery Multiple Remote Vulnerabilities
Multiple remote vulnerabilities are reported in MapInfo Discovery.
The first issue is reported to be an information disclosure vulnerability. An attacker may gain access to potentially sensitive error log information that could aid an attacker in further system compromise.
The second issue is reported to be a cross-site scripting vulnerability. The application fails to properly sanitize user-supplied URI argument data. This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site. This code execution would occur in the security context of the site hosting the vulnerable software. Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.
The third issue is reported to be a plaintext password information disclosure vulnerability. An attacker with the ability to sniff network traffic could capture user and SQL database credentials.
The fourth issue is reported to be an administrative login authentication bypass vulnerability. An attacker with a regular user account on the application can gain administrative access.
MapInfo Discovery versions 1.0 and 1.1 are reported susceptible to these vulnerabilities.
Multiple remote vulnerabilities are reported in MapInfo Discovery.
The first issue is reported to be an information disclosure vulnerability. An attacker may gain access to potentially sensitive error log information that could aid an attacker in further system compromise.
The second issue is reported to be a cross-site scripting vulnerability. The application fails to properly sanitize user-supplied URI argument data. This could allow for execution of hostile HTML and script code in the web client of a user who visits a malicious link to the vulnerable site. This code execution would occur in the security context of the site hosting the vulnerable software. Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.
The third issue is reported to be a plaintext password information disclosure vulnerability. An attacker with the ability to sniff network traffic could capture user and SQL database credentials.
The fourth issue is reported to be an administrative login authentication bypass vulnerability. An attacker with a regular user account on the application can gain administrative access.
MapInfo Discovery versions 1.0 and 1.1 are reported susceptible to these vulnerabilities.
Exploit / POC
MapInfo Discovery Multiple Remote Vulnerabilities
An exploit is not required. Proof of concept examples were provided:
Issue 1, the URI to retrieve the error log of the application:
http://www.example.com/midiscovery/ErrLog/mi3errors.log
Issue 2, an example URI containing a cross-site scripting attack:
http://www.example.com/midiscovery/MapFrame.asp?mapID=5&mapname=<script>
Issue 3, this URI handles user authentication in plaintext over a non-encrypted HTTP session:
http://www.example.com/midiscovery/asplib/SignIn.asp
Issue 3, an example of HTML form data containing SQL database credentials:
<INPUT TYPE="text" size="30" maxlength="50" NAME="DatabaseName" Value="MIDiscovery" >
<INPUT TYPE="text" size="30" maxlength="50" NAME="DatabaseServerName" Value="10.0.0.2">
<INPUT TYPE="text" size="30" maxlength="70" NAME="DatabaseUserName" Value="midiscovery">
<INPUT TYPE="password" size="21" maxlength="20" NAME="DatabaseUserPassword1" Value="lirumisu69">
<INPUT TYPE="password" size="21" maxlength="20" NAME="DatabaseUserPassword2" Value="lirumisu69">
Issue 4, an example of a URI containing the 'ps' administrative flag:
http://www.example.com/midiscovery/asplib/MapPassword.asp?id=140&ps=0&Wrong=1
An exploit is not required. Proof of concept examples were provided:
Issue 1, the URI to retrieve the error log of the application:
http://www.example.com/midiscovery/ErrLog/mi3errors.log
Issue 2, an example URI containing a cross-site scripting attack:
http://www.example.com/midiscovery/MapFrame.asp?mapID=5&mapname=<script>
Issue 3, this URI handles user authentication in plaintext over a non-encrypted HTTP session:
http://www.example.com/midiscovery/asplib/SignIn.asp
Issue 3, an example of HTML form data containing SQL database credentials:
<INPUT TYPE="text" size="30" maxlength="50" NAME="DatabaseName" Value="MIDiscovery" >
<INPUT TYPE="text" size="30" maxlength="50" NAME="DatabaseServerName" Value="10.0.0.2">
<INPUT TYPE="text" size="30" maxlength="70" NAME="DatabaseUserName" Value="midiscovery">
<INPUT TYPE="password" size="21" maxlength="20" NAME="DatabaseUserPassword1" Value="lirumisu69">
<INPUT TYPE="password" size="21" maxlength="20" NAME="DatabaseUserPassword2" Value="lirumisu69">
Issue 4, an example of a URI containing the 'ps' administrative flag:
http://www.example.com/midiscovery/asplib/MapPassword.asp?id=140&ps=0&Wrong=1
Solution / Fix
MapInfo Discovery Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
MapInfo Discovery Multiple Remote Vulnerabilities
References:
References: