Progress WebSpeed Administration Utility Configuration Vulnerability
BID:969
Info
Progress WebSpeed Administration Utility Configuration Vulnerability
| Bugtraq ID: | 969 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 03 2000 12:00AM |
| Updated: | Feb 03 2000 12:00AM |
| Credit: | Posted to Bugtraq on February 3, 2000 by Geo. <[email protected]>. |
| Vulnerable: |
Progress WebSpeed 3.0 |
| Not Vulnerable: | |
Discussion
Progress WebSpeed Administration Utility Configuration Vulnerability
Progress WebSpeed is an Internet Transaction Processing (ITP) web application which allows for database connectivity and transaction management.
The WEbSpeed WSISA Messenger Administration Utility is remotely accessible from any web browser. This utility displays sensitive web server statistics and grants capabilities to administer certain functions of the web server, and can be accessed without any authentication requirements whatsoever.
The WebSpeed WSISA Messenger Administration Utility cannot be disabled through the program itself even though it gives you an option to do so through the Java GUI interface.
Progress WebSpeed is an Internet Transaction Processing (ITP) web application which allows for database connectivity and transaction management.
The WEbSpeed WSISA Messenger Administration Utility is remotely accessible from any web browser. This utility displays sensitive web server statistics and grants capabilities to administer certain functions of the web server, and can be accessed without any authentication requirements whatsoever.
The WebSpeed WSISA Messenger Administration Utility cannot be disabled through the program itself even though it gives you an option to do so through the Java GUI interface.
Exploit / POC
Progress WebSpeed Administration Utility Configuration Vulnerability
In order to access the WebSpeed WSISA Messenger Administration Utility, append "WService=anything?WSMadmin" (case sensitive) after wsisa.dll/ in the URL.
eg.:
http://www.domain.com/scripts/wsisa.dll/WService=anything?WSMadmin
Once the Messenger Administration Utility is accessed, configuration utilities will be displayed and can be freely accessed. Furthermore, you can click on the link "End Sessions Logging and Display Sessions Info ." This will bring you to the messenger session log file. From here, search for the statement "Default Service = 'service' ". Hit the browsers BACK button and enter the 'service' string into one of the configuration boxes (depending on how the administrator has configured the Messenger Administration Utility) in order to view other web server statistics and possibly disconnect running services.
In order to access the WebSpeed WSISA Messenger Administration Utility, append "WService=anything?WSMadmin" (case sensitive) after wsisa.dll/ in the URL.
eg.:
http://www.domain.com/scripts/wsisa.dll/WService=anything?WSMadmin
Once the Messenger Administration Utility is accessed, configuration utilities will be displayed and can be freely accessed. Furthermore, you can click on the link "End Sessions Logging and Display Sessions Info ." This will bring you to the messenger session log file. From here, search for the statement "Default Service = 'service' ". Hit the browsers BACK button and enter the 'service' string into one of the configuration boxes (depending on how the administrator has configured the Messenger Administration Utility) in order to view other web server statistics and possibly disconnect running services.
Solution / Fix
Progress WebSpeed Administration Utility Configuration Vulnerability
Solution:
Progress has released patches which correct this issue and may be downloaded at the location below:
http://www.progress.com/patches/patchlst/availpatche.html
Progress also recommends disabling the WSISA Messenger Administration Utility after the Webspeed applications have gone into production. The following instructions have been taken from the Progress knowledge base:
For security reasons, many web administrators do not allow users to use the WSMAdmin command to access webspeed configuration information. In order to disable this, you have to uncheck the box next to 'Internal Administration Command - WSMAdmin' for each Webspeed Messenger.
If after doing the above, you find that you can still access the WSMAdmin utility from a web browser, you need to take the following steps:
1. Stop the webspeed brokers
2. Close the Progress Explorer
3. Open the ubroker.properties file in notepad (or any other editor)
Find the following entry under[Webspeed.Messengers]
AllowMsngrCmds=1
Modify this line to: AllowMsngrCmds=0
4. Stop the Progress Admin Service - (Control Panel->Services)
5. Re-start the Progress Admin Service - (Control Panel->Services)
6. Connect to the Progress Admin Service from the Progress Explorer
7. Restart your web brokers
Messenger Internal Commands should now be disabled and you should not be able to access WSMAdmin from a web browser.
Solution:
Progress has released patches which correct this issue and may be downloaded at the location below:
http://www.progress.com/patches/patchlst/availpatche.html
Progress also recommends disabling the WSISA Messenger Administration Utility after the Webspeed applications have gone into production. The following instructions have been taken from the Progress knowledge base:
For security reasons, many web administrators do not allow users to use the WSMAdmin command to access webspeed configuration information. In order to disable this, you have to uncheck the box next to 'Internal Administration Command - WSMAdmin' for each Webspeed Messenger.
If after doing the above, you find that you can still access the WSMAdmin utility from a web browser, you need to take the following steps:
1. Stop the webspeed brokers
2. Close the Progress Explorer
3. Open the ubroker.properties file in notepad (or any other editor)
Find the following entry under[Webspeed.Messengers]
AllowMsngrCmds=1
Modify this line to: AllowMsngrCmds=0
4. Stop the Progress Admin Service - (Control Panel->Services)
5. Re-start the Progress Admin Service - (Control Panel->Services)
6. Connect to the Progress Admin Service from the Progress Explorer
7. Restart your web brokers
Messenger Internal Commands should now be disabled and you should not be able to access WSMAdmin from a web browser.
References
Progress WebSpeed Administration Utility Configuration Vulnerability
References:
References:
- Progress WebSpeed Product Webpage (Progress)