CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS
Percentile
78.6%
The Pattern Insight web interface contains multiple vulnerabilities.
CWE-352: Cross-Site Request Forgery (CSRF) CVE-2012-4935: Pattern Insight: CSRF protections do not exist
When an already authorized victim navigates to a malicious site containing a hidden form request, it is possible for the malicious site to make authenticated requests to Pattern Insight on behalf of the victim.
CWE-16: Configuration: CVE-2012-4936: Pattern Insight: clickjacking/framing vulnerability
It is possible to frame the application and thus is vulnerable to clickjacking. This can be mitigated by adding “X-Frame-Options” => “DENY” to the response headers. Furthermore, frame busting code can be added to the application for further protection and in the case that the victim’s browser does not support X-Frame-Options. See <https://www.owasp.org/index.php/Clickjacking>
CWE-384: Session Fixation CVE-2012-4937: Pattern Insight: Insecure session management leading to privilege escalation
Pattern Insight session management is insecure, making privilege escalation and authentication bypass possible. When a user logs into Pattern Insight, the user’s browser either has or does not have a jsession_id session cookie associated with the Pattern Insight domain. If the user does not have a session cookie associated with the Pattern Insight domain, the server provides the user a jsession_id and associates that session id with the user’s current session. If the user already has a session cookie associated with the Pattern Insight domain, the server checks the “validity” of the session cookie. If the cookie is of “valid” form, the server associates the provided jsession_id session cookie with user’s new session.
Attack scenario:
1. Attacker obtains a “valid” session key.
2. Attacker sets victim’s jsession_id session cookie with the “valid” session key in step 1
3. The attacker now knows the session id of a valid session
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) CVE-2012-4938: Pattern Insight: HTML Injection In Banner Message
An admin can edit the banner message seen by all users. HTML is allowed in this message. A possible solution is anti-samy for whitelisting where HTML is still needed (<https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project>).
CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) CVE-2012-4950 Pattern Insight: HTML Injection In Keyword Search page
The error messages on the Keyword Search page do not properly escape characters after encountering a character that the backend cannot parse. This results in a reflective XSS if an attacker sends a victim a properly crafted URL and the victim visits the application using that link.
An attacker with access to the Pattern Insight web interface can conduct a cross-site scripting, cross-site request forgery, or privilege escalation attack, which could be used to result in information leakage, privilege escalation, and/or denial of service. Also, with the ability to frame the application, an attacker can perform clickjacking attacks.
We are currently unaware of a practical solution to this problem.
Restrict access
As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS, CSRF, or SQLi attacks since the attack comes as an HTTP request from a legitimate user’s host. Restricting access would prevent an attacker from accessing the Pattern Insight web interface using stolen credentials from a blocked network location.
802596
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: September 07, 2012 Updated: October 24, 2012
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | 6 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Temporal | 4.6 | E:POC/RL:W/RC:UC |
Environmental | 1.2 | CDP:ND/TD:L/CR:ND/IR:ND/AR:ND |
Thanks to the reporter who wishes to remain anonymous.
This document was written by Michael Orlando.
CVE IDs: | CVE-2012-4935, CVE-2012-4936, CVE-2012-4937, CVE-2012-4938, CVE-2012-4950 |
---|---|
Date Public: | 2012-11-02 Date First Published: |
cwe.mitre.org/data/definitions/16.html
cwe.mitre.org/data/definitions/352.html
cwe.mitre.org/data/definitions/384.html
cwe.mitre.org/data/definitions/79.html
owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet
www.owasp.org/index.php/Category:OWASP_AntiSamy_Project
www.owasp.org/index.php/Clickjacking
www.owasp.org/index.php/Clickjacking#Defending_against_Clickjacking
www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet