The Pattern Insight web interface contains multiple vulnerabilities.
CWE-352: Cross-Site Request Forgery (CSRF) CVE-2012-4935: Pattern Insight: CSRF protections do not exist
When an already authorized victim navigates to a malicious site containing a hidden form request, it is possible for the malicious site to make authenticated requests to Pattern Insight on behalf of the victim.
CWE-16: Configuration: CVE-2012-4936: Pattern Insight: clickjacking/framing vulnerability
It is possible to frame the application and thus is vulnerable to clickjacking. This can be mitigated by adding "X-Frame-Options" => "DENY" to the response headers. Furthermore, frame busting code can be added to the application for further protection and in the case that the victim's browser does not support X-Frame-Options. See <https://www.owasp.org/index.php/Clickjacking>
CWE-384: Session Fixation CVE-2012-4937: Pattern Insight: Insecure session management leading to privilege escalation
Pattern Insight session management is insecure, making privilege escalation and authentication bypass possible. When a user logs into Pattern Insight, the user's browser either has or does not have a jsession_id session cookie associated with the Pattern Insight domain. If the user does not have a session cookie associated with the Pattern Insight domain, the server provides the user a jsession_id and associates that session id with the user's current session. If the user already has a session cookie associated with the Pattern Insight domain, the server checks the "validity" of the session cookie. If the cookie is of "valid" form, the server associates the provided jsession_id session cookie with user's new session.
1. Attacker obtains a "valid" session key.
2. Attacker sets victim's jsession_id session cookie with the "valid" session key in step 1
3. The attacker now knows the session id of a valid session
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2012-4938: Pattern Insight: HTML Injection In Banner Message
An admin can edit the banner message seen by all users. HTML is allowed in this message. A possible solution is anti-samy for whitelisting where HTML is still needed (<https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project>).
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2012-4950 Pattern Insight: HTML Injection In Keyword Search page
The error messages on the Keyword Search page do not properly escape characters after encountering a character that the backend cannot parse. This results in a reflective XSS if an attacker sends a victim a properly crafted URL and the victim visits the application using that link.
An attacker with access to the Pattern Insight web interface can conduct a cross-site scripting, cross-site request forgery, or privilege escalation attack, which could be used to result in information leakage, privilege escalation, and/or denial of service. Also, with the ability to frame the application, an attacker can perform clickjacking attacks.
We are currently unaware of a practical solution to this problem.
As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the Pattern Insight web interface using stolen credentials from a blocked network location.
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Notified: September 07, 2012 Updated: October 24, 2012
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector
Base | 6 | AV:N/AC:M/Au:S/C:P/I:P/A:P
Temporal | 4.6 | E:POC/RL:W/RC:UC
Environmental | 1.2 | CDP:ND/TD:L/CR:ND/IR:ND/AR:ND
Thanks to the reporter who wishes to remain anonymous.
This document was written by Michael Orlando.
CVE IDs: | CVE-2012-4935, CVE-2012-4936, CVE-2012-4937, CVE-2012-4938, CVE-2012-4950
Date Public: | 2012-11-02
Date First Published: | 2012-11-02
Date Last Updated: | 2012-11-08 13:32 UTC
Document Revision: | 17