diff --git a/exploits/java/webapps/43848.txt b/exploits/java/webapps/43848.txt new file mode 100644 index 000000000..fd3a78211 --- /dev/null +++ b/exploits/java/webapps/43848.txt @@ -0,0 +1,87 @@ +[+] Credits: John Page (aka hyp3rlinx) +[+] Website: hyp3rlinx.altervista.org +[+] Source: http://hyp3rlinx.altervista.org/advisories/ORACLE-JDEVELOPER-DIRECTORY-TRAVERSAL.txt +[+] ISR: apparition security + + +Vendor: +============= +www.oracle.com + + +Product: +=========== +JDeveloper IDE + +Oracle JDeveloper is a free integrated development environment that simplifies the development of Java-based +applications addressing every step of the application lifecycle. + + + +Vulnerability Type: +=================== +Directory Traversal + + + +CVE Reference: +============== +CVE-2017-10273 + + + +Security Issue: +================ +Attackers can place malicious files outside intended target directories if tricked into importing corrupt .WAR or .EAR archives. +Later, attackers can potentially request these scripts/files to execute system commands on affected target. + + +Affected versions: +11.1.1.7.0, 11.1.1.7.1, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, 12.2.1.2.0 + + +References: +============ +http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html + + + +Exploit/POC: +============= +1) create evil .WAR or .EAR archive containing ../ in path name to initiate directory traversal and inside a script to execute system commands. +2) import into JDeveloper +3) files get moved outside target directories to one of the attackers choosing. +4) attacker requests the malicious file contained in target directory. + +BAM! + + +Network Access: +=============== +Local + + + +Severity: +========= +Low + + + +Disclosure Timeline: +============================= +Vendor Notification: October 14, 2016 +Vendor fixes as part of CPU January 16, 2018 +January 17, 2018 : Public Disclosure + + + +[+] Disclaimer +The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. +Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and +that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit +is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility +for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information +or exploits by the author or elsewhere. All content (c). + +hyp3rlinx \ No newline at end of file diff --git a/exploits/json/webapps/43849.txt b/exploits/json/webapps/43849.txt new file mode 100644 index 000000000..6e113bb4c --- /dev/null +++ b/exploits/json/webapps/43849.txt @@ -0,0 +1,335 @@ +Document Title: +=============== +Shopware 5.2.5 & v5.3 - Multiple Cross Site Scripting Web Vulnerabilities + + +References (Source): +==================== +http://www.vulnerability-lab.com/get_content.php?id=1922 + +Shopware Security Tracking ID: SW-19834 + +Security Update: +http://community.shopware.com/Downloads_cat_448.html#5.3.4 +http://community.shopware.com/_detail_2035.html + +http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-15374 + +CVE-ID: +======= +CVE-2017-15374 + + +Release Date: +============= +2017-09-05 + + +Vulnerability Laboratory ID (VL-ID): +==================================== +1922 + + +Common Vulnerability Scoring System: +==================================== +4.4 + + +Vulnerability Class: +==================== +Cross Site Scripting - Persistent + + +Current Estimated Price: +======================== +1.000€ - 2.000€ + + +Product & Service Introduction: +=============================== +Shopware is a modular online shop system that is since 2004 developed in germany. It is available both as +an open source software as well as in commercial editions. The program can be extended in its functions by +installing additional plugins. An open API allows third-party systems, such as payment services or ERP +systems, to be connected. The system is multi shop capable it can thus be generated within an installation +several shops in different domains. A multi-client capability (complete separation of multishops in the +administration area) is by default, but can be achieved in the cluster. + +(Copy of the Vendor Homepage: https://en.shopware.com/ ) + + +Abstract Advisory Information: +============================== +The vulnerability laboratory core research team discovered multiple stored cross site scripting vulnerability in the official Shopware v5.2.5 & 5.3 CMS. + + +Vulnerability Disclosure Timeline: +================================== +2016-10-07: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH) +2016-10-08: Vendor Notification (Shopware Security Team) +2016-**-**: Vendor Response/Feedback (Shopware Security Team) +2017-**-**: Vendor Fix/Patch (Shopware Service Developer Team) +2017-09-05: Public Disclosure (Vulnerability Laboratory) +2017-10-25: Security Acknowledgements (Shopware Developer Team) +2017-10-25: Security Acknowledgements (Shopware Security Team) + + +Discovery Status: +================= +Published + + +Affected Product(s): +==================== +Shopware AG +Product: Shopware - Content Management System (Web-Application) 5.2.5 + +Shopware AG +Product: Shopware - Content Management System (Web-Application) 5.3 + + +Exploitation Technique: +======================= +Remote + + +Severity Level: +=============== +Medium + + +Technical Details & Description: +================================ +The shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management +system backend modules. Remote attackers are able to inject malicious script code to the firstname, lastname or order +input fields to provoke a persistent execution in the customer and orders section of the backend. The execution occurs +in the shopware administrator backend listing when processing to preview the customers (kunden) or orders (bestellungen). +The injection can be processed by interaction via user registration or by manipulation of the order information inputs. +The web issue can be exploited by low privileged user accounts against higher privileged admin- oder moderator-accounts. + +The security risk of the bugs are estimated as medium with a cvss (common vulnerability scoring system) count of 4.4. +Exploitation of the issue requires a low privileged web-application user account and low or medium user interaction. +Successful exploitation of the vulnerabilities results in persistent phishing mails, session hijacking, persistent +external redirect to malicious sources and application-side manipulation of affected or connected module context. + +Request Method(s): +[+] POST (Registration) +[+] POST (Order Item) +[+] POST (Profile Update) + +Vulnerable Input(s): +[+] Firstname +[+] Lastname +[+] Order Name + +Affected Module(s): +[+] Kunden (Customers) +[+] Bestellungen (Orders) + + +Proof of Concept (PoC): +======================= +The cross site vulnerabilities can be exploited by remote attackers with low privileged shopware user account and low user interaction. +For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. + + +Manual steps to reproduce the vulnerability ... +1. Open the the browser and surf to the target shopware v5.2.5 web-application +2. Move to the registration formular +3. Include a script code payload with a iframe src onload tag to the firstname, lastname and name parameters +4. Submit the request via POST method to register the account +5. Move to the inbox and verify via link the account to activate +Note: Now the payloads are executable saved to the Kunden (Customer) section in the backend +6. The administrator visits in the next step the Kunden (Customer) section to preview +7. The script code payload executes in the customers list +8. As next step the attacker places an order via shop +Note: The order name manipulation via registration is as well able to execute script code the context +9. The administrator visits in the next step the Bestellungen (orders) section to preview +10. The script code payload executes in the orders list +11. Successful reproduce of the both cross site vulnerabilities! + +Note: Attackers are able to inject malicious redirects, frames with payloads or other script code tags. +The basic web validation filter of the shopware content management system does not encode the list context. + + +PoC: Vulnerable Source (Execution in Orders - Bestellungen) +
 
20.08.2016 08:34
20044
+536,80
 
+
Rechnung
Standard Versand
+
+Hauptshop Deutsch
Mar'Da>"
+
+
+ + +--- PoC Session Logs [POST] --- +Status: 200[OK] +POST http://shopware.localhost:8080/backend/customer/save?_dc=1471541475086&customerID=22 +Mime Type[application/json] + Request Header: + Host[shopware.localhost:8080] + User-Agent[Mozilla/5.0 (Windows NT 6.2; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0] + Content-Type[application/json] + X-Requested-With[XMLHttpRequest] + Referer[http://shopware.localhost:8080/backend/] + Cookie[SHOPWAREBACKEND=fv4u2kg63p3ff3ht6kd6var803; test; x-ua-device=desktop; session-1=e7f8815a87d6cfa5552abf58325ca4fa184f7b69f9d45ff7b101c17f7ee0a255;] +Connection[keep-alive] +POST-Daten: +{"id":22,"groupKey":"EK","email":"TEST@TEST.de","active":true,"accountMode":0,"confirmationKey": +"","paymentId":5,"firstLogin":"2016-08-18T00:00:00","lastLogin":"2016-08-18T17:22:23","newsletter":0,"validation":0," +languageId":1,"shopId":1,"priceGroupId":0, +"internalComment":"TEST-comment","failedLogins":0,"referer":"","default_billing_address_id":22," +default_shipping_address_id":22, +"newPassword":"","amount":402.9,"orderCount":1,"canceledOrderAmount": 0,"shopName":"Hauptshop Deutsch","language":"Deutsch","birthday":"16.05.1985","title":""," +salutation":"mr","firstname":"TEST[INJECTED SCRIPT CODE]>"