Oracle 9iAS OJSP Demo Scripts Cross-Site Scripting Vulnerability

Bugtraq ID:	5452
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 13 2002 12:00AM
Updated:	Aug 13 2002 12:00AM
Credit:	Discovery of this issue is credited to Matt Moore of Westpoint Limited.
Vulnerable:	Oracle Oracle9i Application Server 9.0.2 Oracle Oracle9i Application Server 1.0.2 .2 Oracle Oracle9i Application Server 1.0.2 .1s Oracle Oracle9i Application Server 1.0.2
Not Vulnerable:

Oracle 9iAS OJSP Demo Scripts Cross-Site Scripting Vulnerability

Oracle 9iAS is bundled with a number of sample JSP scripts that are prone to cross-site scripting attacks. This is due to insufficient sanitization of HTML tags from data submitted via text fields in forms used by the vulnerable scripts. This data may also be submitted via parameters in a CGI query string.
'hellouser.jsp', 'welcomeuser.jsp' and 'usebean.jsp' are all affected by this issue.

This potentially be exploited to cause script code to be executed in the browser of a legitimate user of Oracle 9iAS and may lead to disclosure of the user's JSESSIONID credential.

Oracle 9iAS OJSP Demo Scripts Cross-Site Scripting Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Oracle 9iAS OJSP Demo Scripts Cross-Site Scripting Vulnerability

Solution:
The vendor advises administrators to remove the OJSP demo scripts. This may be accomplished by remnoving the following JSP files:

/ora9ias/j2ee/OC4J_Demos/applications/ojspdemos/ojspdemos-web/basic/simple
/ora9ias/j2ee/OC4J_Demos/applications/ojspdemos/ojspdemos-web/basic/hellouser

This issue will reportedly be addressed in Oracle 9iAS version 9.0.3, which is expected to be released in the fall of 2002.

Oracle 9iAS OJSP Demo Scripts Cross-Site Scripting Vulnerability

References:

• Oracle Security Alert #41 (Oracle)