66 lines
No EOL
1.8 KiB
Text
66 lines
No EOL
1.8 KiB
Text
An advisory by EnableSecurity.
|
|
|
|
ID: ES-20100601
|
|
|
|
Advisory URL:
|
|
http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt
|
|
|
|
Affected Versions: version 4.0
|
|
|
|
Fixed versions: 4.01-3 (and later)
|
|
|
|
Description:
|
|
|
|
Applicure dotDefender is a Web Application Firewall that can be installed on
|
|
Windows and Linux servers.
|
|
|
|
|
|
From their website (applicure.com):
|
|
|
|
"dotDefender is the market-leading software Web Application Firewall (WAF).
|
|
dotDefender boasts enterprise-class security, advanced integration capabilities,
|
|
easy maintenance and low total cost of ownership (TCO). dotDefender is the
|
|
perfect choice for protecting your website and web applications today. "
|
|
|
|
Credits:
|
|
|
|
These vulnerabilities were discovered during WAF testing by Sandro Gauci of
|
|
EnableSecurity. We contacted AppliCure on May 17, 2010 about this vulnerability.
|
|
They were already working on a fix.
|
|
|
|
____________________________________________________________________________
|
|
|
|
Technical details:
|
|
|
|
The log viewer facility in dotDefender does not properly htmlencode user
|
|
supplied input. This leads to a cross site scripting vulnerability when the log
|
|
viewer displays HTTP headers.
|
|
|
|
____________________________________________________________________________
|
|
|
|
Demo:
|
|
|
|
One may use curl and insert headers containing html tags using the --header
|
|
switch.
|
|
Example:
|
|
|
|
curl "http://website.org/c?a=<script>" \
|
|
--header "<script>alert(1)</script>: aa"
|
|
|
|
When the administrator views the log viewer page, his/her web browser will
|
|
execute the attacker's javascript.
|
|
|
|
The following demo shows how an attacker can switch off dotDefender in order to
|
|
bypass any "protection" offered by the WAF:
|
|
|
|
http://vimeo.com/12132622
|
|
|
|
Timeline:
|
|
|
|
May 17, 2010: Initial contact
|
|
Jun 01, 2010: Release of this advisory
|
|
|
|
Solution:
|
|
|
|
Upgrade to the latest version of dotDefender:
|
|
http://www.applicure.com/ |