Oracle WebCenter Sites Satellite Server – HTTP Header Injection

• Exploit Database
• 12 阅读

• 作者： SEC Consult
  日期： 2013-04-18
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/24964/

• SEC Consult Vulnerability Lab Security Advisory < 20130417-2 >
  =======================================================================
  title: HTTP header injection/Cache poisoning in Oracle WebCenter
   Sites Satellite Server
  product: Oracle WebCenter Sites Satellite Server (former FatWire
   Satellite Server)
   vulnerable version: 7.6.0 Patch1, 7.6.2, 11.1.1.6.0, 11.1.1.6.1
  fixed version: Patch information see sections below
  CVE: CVE-2013-1509
   impact: medium
   homepage: http://www.oracle.com/us/corporate/acquisitions/fatwire/index.html
  found: 2012-09-17
   by: K. Gudinavicius
   SEC Consult Vulnerability Lab
   https://www.sec-consult.com
  =======================================================================
  
  Vendor description:
  -------------------
  FatWire Satellite Server is a predecessor product of Oracle WebCenter Sites
  Satellite Server.
  
  "Oracle WebCenter Sites Satellite Server enables organizations to deliver
  segmented, targeted, and dynamically assembled content across global Web
  properties with rapid response times and intelligent edge caching to optimize
  and speed the delivery of dynamic Web experiences."
  
  Source: http://www.oracle.com/us/products/middleware/webcenter/satellite-server/overview/index.html
  
  
  Vulnerability overview/description:
  -----------------------------------
  Due to unsanitized user input it is possible to inject arbitrary HTTP header
  values in certain HTTP responses of the Satellite Server. This can be
  exploited, for example, to perform session fixation and malicious redirection
  attacks via the Set-Cookie and the Refresh headers. Moreover, the Satellite
  Server caches these HTTP responses with the injected HTTP header resulting in
  all further requests to the same resource being served with the poisoned HTTP
  response, while these objects remain in cache.
  
  
  Proof of concept:
  -----------------
  An arbitrary header can be injected in the HTTP responses of the
  downloadable resources. The values of the blobheadername2 and the
  blobheadervalue2 URL parameters are user controllable. In the following
  example the Refresh header is injected:
  
  http://fatwire/cs/Satellite?blobcol=urldata&blobheadername1=content-type&blobheadername2=Refresh&
  blobheadervalue1=application/pdf&blobheadervalue2=0;url=http://www.sec-consult.com&blobkey=id&
  blobnocache=false&blobtable=MungoBlobs&blobwhere=1342534304149&ssbinary=true&site=S08
  
  The returned HTTP response will contain the injected Refresh header and its
  value. Furthermore, the HTTP response will be cached, so the next time users
  will be accessing the same downloadable resource using the standard URL, they
  will be affected and redirected using the injected Refresh header value.
  
  HTTP/1.1 200 OK
  Date: Thu, 06 Sep 2012 15:59:04 GMT
  Refresh: 0;url=http://www.sec-consult.com
  Last-Modified: Thu, 06 Sep 2012 15:54:20 GMT
  Content-Type: application/pdf
  Connection: close
  Content-Length: 772193
  
  
  Vulnerable / tested versions:
  -----------------------------
  The following installation has been tested:
  * FatWire Satellite Server 7.6.0 Patch1.
  
  
  Vendor contact timeline:
  ------------------------
  2012-11-26: Contacting vendor through secalert_us@oracle.com
  2012-11-26: Vendor response, will investigate issues
  2012-11-27: Investigation ongoing, the following ID assigned:
  S0321206 - ARBITRARY HTTP HEADER INJECTION/CACHE POISONING IN FATWIRE
  2013-01-25: S0321206 Issue fixed in main codeline, scheduled for a future CPU
  2013-04-12: S0321206 is fixed in upcoming CPU on 2013-04-16
  2013-04-16: Oracle releases April 2013 CPU
  2013-04-17: Public release of SEC Consult advisory
  
  
  Solution:
  ---------
  Apply latest patches, see:
  http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html
  
  
  Workaround:
  -----------
  
  
  Advisory URL:
  -------------
  https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm
  
  
  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  SEC Consult Unternehmensberatung GmbH
  
  Office Vienna
  Mooslackengasse 17
  A-1190 Vienna
  Austria
  
  Tel.: +43 / 1 / 890 30 43 - 0
  Fax.: +43 / 1 / 890 30 43 - 25
  Mail: research at sec-consult dot com
  https://www.sec-consult.com
  
  EOF K. Gudinavicius / @2013