BlackBerry Enterprise Service < 12.4 (BES12) Self-Service - Multiple Vulnerabilities

• Exploit Database
• 93 阅读

• 作者： Security-Assessment.com
  日期： 2016-02-22
• 类别：

  • webapps
  平台：

  • java
• 来源：https://www.exploit-db.com/exploits/39481/

• (, ) (,
  . '.' ) ('.',
   ). , ('. ( ) (
  (_,) .'), ) _ _,
   /_____// _\________ _____
   \____\==/ /_\\ _/ ___\/_ \ / \
   / \/ |\\\__(<_> )Y Y\
  /______/\___|__/ \___>____/|__|_|/
  \/ \/.-.\/ \/:wq
  (x.0)
  '=.|w|.='
  _=''"''=.
  
  presents..
  
  BlackBerry Enterprise Service 12 (BES12) Self-Service
  Affected versions: BES12 < 12.4
  
  CVE: CVE-2016-1914 and CVE-2016-1915
  
  PDF:
  http://security-assessment.com/files/documents/advisory/Blackberry%20BES12%20Self-Service%20Multiple%20Vulnerabilities.pdf
  
  
  +-----------+
  |Description|
  +-----------+
  
  Blackberry BES12 is an enterprise mobile management solution and
  contains a self-service web application available to mobile users. This
  web application contains multiple vulnerabilities including
  unauthenticated SQL
  injection and reflected cross site scripting.
  
  Limited access to an on-premise BES12 environment was provided during
  the discovery of these vulnerabilities. The full impact of the
  vulnerabilities in relation to compromising other portions of the BES12
  solution, such as mobile devices, is unclear.
  
  
  +------------+
  |Exploitation|
  +------------+
  
  *SQL Injection*
  
  The Java servlet com.rim.mdm.ui.server.ImageServlet is vulnerable to SQL
  injection via the imageName parameter. This servlet is exposed at
  multiple paths and is used to fetch an image from the database:
  
  /mydevice/client/image
  /admin/client/image
  /myapps/client/image
  /ssam/client/image
  /all/client/image
  
  
  This was discovered on a production BES12 on-premise deployment and the
  injection vector allowed both UNION and stacked queries to be executed
  on the Microsoft SQL server used by BES12. This allows full read/write
  access to the database, and can potentially result in command execution
  via xp_cmdshell depending on the database user configuration.
  
  The following proof of concept demonstrates an injection payload which
  will select the entire obj_keystore_entry table. The query will
  serialise the entire table into an XML document which is returned in the
  HTTP response as UTF-16 without the leading BOM (byte order mark)
  causing most text editors to fail to display the response correctly.
  
  https://<server>/mydevice/client/image?imageName=ui.cobranded.login.logo'+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,(SELECT+*+FROM+obj_keystore_entry+FOR+XML+PATH(''))+--
  
  The technique above can be used to download any database table available
  to the BES12 database user.
  
  Notable database tables are:
  * obj_user which contains BES12 user details.
  * obj_user_authentication which contains authentication tokens.
  * obj_user_device which based on column names, contains enrolment
  tokens, enrolment secrets and device encryption keys.
  
  It is unclear if this information is sufficient to decrypt a lost/stolen
  BES12 mobile device.
  
  
  *Reflected Cross Site Scripting*
  
  Two areas of the self-service web application exist where user-supplied
  input is reflected directly in web pages, allowing a malicious user to
  conduct Cross Site Scripting (XSS) attacks against users of the
  application. While the application uses the HttpOnly cookie flag for
  session tokens, successful exploitation allows malicious JavaScript to
  perform any action within the application that the targeted user is able
  to. The administrative web application is typically hosted on the same
  domain and may be attacked using these XSS vectors, although this is
  BES12 deployment specific.
  
  The table below details where Cross Site Scripting was detected and
  which parameters are vulnerable:
  
  https://<server>/mydevice/index.jsp?locale="><script>alert(1)</script>
  https://<server>/mydevice/loggedOut.jsp?locale="><script>alert(1)</script>
  
  
  +----------+
  | Solution |
  +----------+
  
  
  Upgrade to BES12.4.
  
  
  +-------------------+
  |Disclosure Timeline|
  +-------------------+
  
  
  Initial disclosure to Blackberry – 19 Nov 2015
  Disclosure receipt confirmed by Blackberry – 19 Nov 2015
  Request for update from Blackberry – 7 Dec 2015
  Vulnerabilities confirmed by Blackberry – 8 Dec 2015
  Blackberry confirms fixes will be released as part of BES12.4 – 28 Jan 2016
  BES12.4 released – 29 Jan 2016
  Advisory released – 15 Feb 2016
  
  
  +-----------------------------+
  |About Security-Assessment.com|
  +-----------------------------+
  
  
  Security-Assessment.com is a leading team of Information Security
  consultants specialising in providing high quality Information Security
  services to clients throughout the Asia Pacific region. Our clients
  include some of the largest globally recognised companies in areas such
  as finance, telecommunications, broadcasting, legal and government. Our
  aim is to provide the very best independent advice and a high level of
  technical expertise while creating long and lasting professional
  relationships with our clients.
  Security-Assessment.com is committed to security research and
  development, and its team continues to identify and responsibly publish
  vulnerabilities in public and private software vendor's products.
  Members of the Security-Assessment.com R&D team are globally recognised
  through their release of whitepapers and presentations related to new
  security research.
  
  For further information on this issue or any of our service offerings,
  contact us:
  Web www.security-assessment.com
  Email info@security-assessment.com
  

  Java

  Copy