231 lines
No EOL
12 KiB
Text
231 lines
No EOL
12 KiB
Text
Title:
|
||
======
|
||
Microsoft SharePoint 2013 (Cloud) - Persistent Exception Handling Web Vulnerability
|
||
|
||
|
||
|
||
Date:
|
||
=====
|
||
2013-09-11
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=812
|
||
|
||
Security Bulletin: MS13-067
|
||
http://technet.microsoft.com/de-de/security/bulletin/MS13-067
|
||
|
||
Microsoft Security Response Center (MSRC) ID: 14096
|
||
|
||
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
812
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
5.7
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Microsoft SharePoint is a Web application platform developed by Microsoft. First launched in 2001, SharePoint has historically been
|
||
associated with intranet content management and document management, but recent versions have significantly broader capabilities.
|
||
Microsoft has two versions of SharePoint available at no cost, but it sells premium editions with additional functionality, and
|
||
provides a cloud service edition as part of their Office 365 platform (previously BPOS). The product is also sold through a cloud
|
||
model by many third-party vendors.
|
||
|
||
SharePoint comprises a multipurpose set of Web technologies backed by a common technical infrastructure. By default, SharePoint has a
|
||
Microsoft Office-like interface, and it is closely integrated with the Office suite. The web tools are designed to be usable by non-
|
||
technical users. SharePoint can be used to provide intranet portals, document & file management, collaboration, social networks, extranets,
|
||
websites, enterprise search, and business intelligence. It also has system integration, process integration, and workflow automation capabilities.
|
||
|
||
Enterprise application software (e.g. ERP or CRM packages) often provide some SharePoint integration capability, and SharePoint also
|
||
incorporates a complete development stack based on web technologies and standards-based APIs. As an application platform, SharePoint provides
|
||
central management, governance, and security controls for implementation of these requirements. The SharePoint platform integrates directly
|
||
into IIS - enabling bulk management, scaling, and provisioning of servers, as is often required by large organizations or cloud hosting providers.
|
||
In 2008, the Gartner Group put SharePoint in the`leaders` quadrant in three of its Magic Quadrants (for search, portals, and enterprise content
|
||
management). SharePoint is used by 78% of Fortune 500 companies[citation needed]. Between 2006 to 2011, Microsoft sold over 36.5 million user
|
||
licenses[citation needed].
|
||
|
||
(Copy of the Homepage: http://en.wikipedia.org/wiki/Microsoft_SharePoint )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered a persistent web vulnerability in the official Microsoft Sharepoint Online (cloud-based) application.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2013-02-01: Researcher Notification & Coordination (Benjamin Kunz Mejri)
|
||
2013-02-06: Vendor Notification (Microsoft Security Response Center - MSRC)
|
||
2013-02-07: Vendor Response/Feedback (Microsoft Security Response Center - MSRC)
|
||
2013-09-11: Vendor Fix/Patch (Microsoft Security Bulletin)
|
||
2013-09-11: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
Microsoft Corp.
|
||
Product: Sharepoint Online (Cloud-Based)
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
High
|
||
|
||
|
||
Details:
|
||
========
|
||
A persistent input validation vulnerability is detected in the official Microsoft Sharepoint 2013 Online (cloud-based) web-application.
|
||
The vulnerability allows remote attackers to inject own malicious script code to a vulnerable module on application-side (persistent).
|
||
|
||
The vulnerability is located in the `Sharepoint Online Cloud 2013 Service` section when processing to request the `Berechtigungen für
|
||
den Metadatenspeicher festlegen` module with manipulated ms-descriptionText > ctl00_PlaceHolderDialogBodySection_
|
||
PlaceHolderDialogBodyMainSection_ValSummary parameters. The persistent injected script code execution occurs in the main
|
||
`invalid BDC Übereinstimmung` web application exception-handling.
|
||
|
||
The vulnerability can be exploited with a low (restricted) privileged application user account and low or medium required user interaction.
|
||
Successful exploitation of the vulnerability result in persistent session hijacking, persistent phishing, stable external redirect, stable
|
||
external malware loads and persistent vulnerable module context manipulation.
|
||
|
||
Vulnerable Service(s):
|
||
[+] Microsoft - Sharepoint Online (cloud-based)
|
||
|
||
Vulnerable Module(s):
|
||
[+] Berechtigungen für den Metadatenspeicher festlegen - BDC Metadatenspeicher zuweisen
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] ms-descriptionText > ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_ValSummary
|
||
[+] TA_ManageBDCPermissions_data
|
||
|
||
Affected Module(s):
|
||
[+] BDC Übereinstimmung > Exception Handling
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The persistent input validation web vulnerability can be exploited by remote attackers with low required user interaction and low privileged
|
||
sharepoint cloud application user account. For demonstration or reproduce ...
|
||
|
||
Review: Berechtigungen für den Metadatenspeicher festlegen - Summery > BDC Übereinstimmung > Exception (TA_ManageBDCPermissions_data)
|
||
|
||
<table class="propertysheet" border="0" cellpadding="0" cellspacing="0" width="100%"> <tbody><tr> <td class="ms-descriptionText">
|
||
<span id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_LabelMessage" class="ms-descriptionText"></span> </td>
|
||
</tr> <tr> <td class="ms-error"><span id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_LabelErrorMessage">
|
||
Fehler beim Versuch, 'IMetadataCatalog' eine Zugriffssteuerungsliste mit dem
|
||
Namen 'ApplicationRegistry' zuzuweisen. Mindestens ein Benutzer oder
|
||
eine Gruppe in der Zugriffssteuerungsliste muss über das Recht
|
||
'SetPermissions' verfügen, um das Erstellen eines nicht verwaltbaren
|
||
Objekts zu verhindern.</span></td> </tr> <tr> <td class="ms-descriptionText">
|
||
<div id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_ValSummary" style="color:Red;">Mindestens ein Fehler auf der Seite.
|
||
Beheben Sie Folgendes, bevor Sie fortfahren:<ul><li>Es wurde keine exakte Übereinstimmung
|
||
für <iframe src="TA_ManageBDCPermissions_data/vlab.js">%20%20%20
|
||
%20"><[PERSISTENT INJECTED SCRIPT CODE!]") <%20%20%20%20"><[PERSISTENT INJECTED SCRIPT CODE!]") <
|
||
gefunden.</li></ul>
|
||
</div> </td> </tr> </table>
|
||
<table border="0" cellspacing="0" cellpadding="0" width="100%"
|
||
class="ms-authoringcontrols">
|
||
<tr>
|
||
<td>
|
||
----------
|
||
<table class="propertysheet" border="0" cellpadding="0" cellspacing="0" width="100%"> <tbody><tr> <td class="ms-descriptionText">
|
||
<span id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_LabelMessage" class="ms-descriptionText"></span> </td>
|
||
</tr> <tr> <td class="ms-error"><span id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_LabelErrorMessage">
|
||
Fehler beim Versuch, 'IMetadataCatalog' eine Zugriffssteuerungsliste mit dem
|
||
Namen 'ApplicationRegistry' zuzuweisen. Mindestens ein Benutzer oder
|
||
eine Gruppe in der Zugriffssteuerungsliste muss über das Recht
|
||
'SetPermissions' verfügen, um das Erstellen eines nicht verwaltbaren
|
||
Objekts zu verhindern.</span></td> </tr> <tr> <td class="ms-descriptionText">
|
||
<div id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_ValSummary" style="color:Red;">Mindestens ein Fehler auf der Seite.
|
||
Beheben Sie Folgendes, bevor Sie fortfahren:<ul><li>Es wurde keine exakte Übereinstimmung
|
||
für <iframe src="TA_ManageBDCPermissions_data/a.txt">%20%20%20%20"><[PERSISTENT INJECTED SCRIPT CODE!]) <<%20[PERSISTENT INJECTED SCRIPT CODE!]) <
|
||
gefunden.</li></ul>
|
||
</div> </td> </tr> </table>
|
||
<table border="0" cellspacing="0" cellpadding="0" width="100%"
|
||
class="ms-authoringcontrols">
|
||
<tr>
|
||
<td>
|
||
|
||
--- Exception Handling (DE) ---
|
||
Sie können Administratoren des BDC-Metadatenspeichers zuweisen, indem Sie unten Berechtigungen festlegen.
|
||
Fehler beim Versuch, 'IMetadataCatalog' eine Zugriffssteuerungsliste mit dem Namen 'ApplicationRegistry' zuzuweisen.
|
||
Mindestens ein Benutzer oder eine Gruppe in der Zugriffssteuerungsliste muss über das Recht 'SetPermissions' verfügen,
|
||
um das Erstellen eines nicht verwaltbaren Objekts zu verhindern. Mindestens ein Fehler auf der Seite. Beheben Sie Folgendes,
|
||
bevor Sie fortfahren: Es wurde keine exakte Übereinstimmung für ... [Injected Context] ... gefunden/festgestellt.
|
||
Sie können Administratoren des BDC-Metadatenspeichers zuweisen, indem Sie unten Berechtigungen festlegen
|
||
---
|
||
|
||
Note: (US)
|
||
After you’ve added your domain name to Office 365 to use with SharePoint Online and Lync Online, you can create email addresses,
|
||
Lync Online accounts, and distribution groups that use your custom domain name. You can also use your domain name for a public
|
||
website hosted on SharePoint Online but there are Use SharePoint Online on a custom domain together with other services.
|
||
|
||
|
||
Reference(s):
|
||
https://benjamin23-admin.sharepoint.com/default.aspx
|
||
https://benjamin23-admin.sharepoint.com/_layouts/bdc/TA_ViewBDCApplication.aspx
|
||
|
||
|
||
Solution:
|
||
=========
|
||
2013-09-11: Vendor Fix/Patch (Microsoft Security Bulletin)
|
||
|
||
URL: http://technet.microsoft.com/de-de/security/bulletin/MS13-067 > Updates
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the of the persistent input validation vulnerability is estimated as high(-).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2013 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |