149 lines
No EOL
5.3 KiB
Text
149 lines
No EOL
5.3 KiB
Text
( , ) (,
|
||
. '.' ) ('. ',
|
||
). , ('. ( ) (
|
||
(_,) .'), ) _ _,
|
||
/ _____/ / _ \ ____ ____ _____
|
||
\____ \==/ /_\ \ _/ ___\/ _ \ / \
|
||
/ \/ | \\ \__( <_> ) Y Y \
|
||
/______ /\___|__ / \___ >____/|__|_| /
|
||
\/ \/.-. \/ \/:wq
|
||
(x.0)
|
||
'=.|w|.='
|
||
_=''"''=.
|
||
|
||
presents..
|
||
|
||
BlackBerry Enterprise Service 12 (BES12) Self-Service
|
||
Affected versions: BES12 < 12.4
|
||
|
||
CVE: CVE-2016-1914 and CVE-2016-1915
|
||
|
||
PDF:
|
||
http://security-assessment.com/files/documents/advisory/Blackberry%20BES12%20Self-Service%20Multiple%20Vulnerabilities.pdf
|
||
|
||
|
||
+-----------+
|
||
|Description|
|
||
+-----------+
|
||
|
||
Blackberry BES12 is an enterprise mobile management solution and
|
||
contains a self-service web application available to mobile users. This
|
||
web application contains multiple vulnerabilities including
|
||
unauthenticated SQL
|
||
injection and reflected cross site scripting.
|
||
|
||
Limited access to an on-premise BES12 environment was provided during
|
||
the discovery of these vulnerabilities. The full impact of the
|
||
vulnerabilities in relation to compromising other portions of the BES12
|
||
solution, such as mobile devices, is unclear.
|
||
|
||
|
||
+------------+
|
||
|Exploitation|
|
||
+------------+
|
||
|
||
*SQL Injection*
|
||
|
||
The Java servlet com.rim.mdm.ui.server.ImageServlet is vulnerable to SQL
|
||
injection via the imageName parameter. This servlet is exposed at
|
||
multiple paths and is used to fetch an image from the database:
|
||
|
||
/mydevice/client/image
|
||
/admin/client/image
|
||
/myapps/client/image
|
||
/ssam/client/image
|
||
/all/client/image
|
||
|
||
|
||
This was discovered on a production BES12 on-premise deployment and the
|
||
injection vector allowed both UNION and stacked queries to be executed
|
||
on the Microsoft SQL server used by BES12. This allows full read/write
|
||
access to the database, and can potentially result in command execution
|
||
via xp_cmdshell depending on the database user configuration.
|
||
|
||
The following proof of concept demonstrates an injection payload which
|
||
will select the entire obj_keystore_entry table. The query will
|
||
serialise the entire table into an XML document which is returned in the
|
||
HTTP response as UTF-16 without the leading BOM (byte order mark)
|
||
causing most text editors to fail to display the response correctly.
|
||
|
||
https://<server>/mydevice/client/image?imageName=ui.cobranded.login.logo'+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,(SELECT+*+FROM+obj_keystore_entry+FOR+XML+PATH(''))+--
|
||
|
||
The technique above can be used to download any database table available
|
||
to the BES12 database user.
|
||
|
||
Notable database tables are:
|
||
* obj_user which contains BES12 user details.
|
||
* obj_user_authentication which contains authentication tokens.
|
||
* obj_user_device which based on column names, contains enrolment
|
||
tokens, enrolment secrets and device encryption keys.
|
||
|
||
It is unclear if this information is sufficient to decrypt a lost/stolen
|
||
BES12 mobile device.
|
||
|
||
|
||
*Reflected Cross Site Scripting*
|
||
|
||
Two areas of the self-service web application exist where user-supplied
|
||
input is reflected directly in web pages, allowing a malicious user to
|
||
conduct Cross Site Scripting (XSS) attacks against users of the
|
||
application. While the application uses the HttpOnly cookie flag for
|
||
session tokens, successful exploitation allows malicious JavaScript to
|
||
perform any action within the application that the targeted user is able
|
||
to. The administrative web application is typically hosted on the same
|
||
domain and may be attacked using these XSS vectors, although this is
|
||
BES12 deployment specific.
|
||
|
||
The table below details where Cross Site Scripting was detected and
|
||
which parameters are vulnerable:
|
||
|
||
https://<server>/mydevice/index.jsp?locale="><script>alert(1)</script>
|
||
https://<server>/mydevice/loggedOut.jsp?locale="><script>alert(1)</script>
|
||
|
||
|
||
+----------+
|
||
| Solution |
|
||
+----------+
|
||
|
||
|
||
Upgrade to BES12.4.
|
||
|
||
|
||
+-------------------+
|
||
|Disclosure Timeline|
|
||
+-------------------+
|
||
|
||
|
||
Initial disclosure to Blackberry – 19 Nov 2015
|
||
Disclosure receipt confirmed by Blackberry – 19 Nov 2015
|
||
Request for update from Blackberry – 7 Dec 2015
|
||
Vulnerabilities confirmed by Blackberry – 8 Dec 2015
|
||
Blackberry confirms fixes will be released as part of BES12.4 – 28 Jan 2016
|
||
BES12.4 released – 29 Jan 2016
|
||
Advisory released – 15 Feb 2016
|
||
|
||
|
||
+-----------------------------+
|
||
|About Security-Assessment.com|
|
||
+-----------------------------+
|
||
|
||
|
||
Security-Assessment.com is a leading team of Information Security
|
||
consultants specialising in providing high quality Information Security
|
||
services to clients throughout the Asia Pacific region. Our clients
|
||
include some of the largest globally recognised companies in areas such
|
||
as finance, telecommunications, broadcasting, legal and government. Our
|
||
aim is to provide the very best independent advice and a high level of
|
||
technical expertise while creating long and lasting professional
|
||
relationships with our clients.
|
||
Security-Assessment.com is committed to security research and
|
||
development, and its team continues to identify and responsibly publish
|
||
vulnerabilities in public and private software vendor's products.
|
||
Members of the Security-Assessment.com R&D team are globally recognised
|
||
through their release of whitepapers and presentations related to new
|
||
security research.
|
||
|
||
For further information on this issue or any of our service offerings,
|
||
contact us:
|
||
Web www.security-assessment.com
|
||
Email info@security-assessment.com |