Hyperic HQ Enterprise|E 4.5.1 Cross Site Request Forgery / Cross Site Scripting

2011-10-31T00:00:00
ID PACKETSTORM:106457
Type packetstorm
Reporter Benjamin Kunz Mejri
Modified 2011-10-31T00:00:00

Description

                                        
                                            `Title:  
======  
Hyperic HQ Enterprise|E v4.5.1 - Multiple Vulnerabilities  
  
  
Date:  
=====  
2011-08-08  
  
  
  
VL-ID:  
=====  
240  
  
  
Introduction:  
=============  
Designed for companies who run large scale business-critical web applications and systems and want world-class support.  
Prepare to be amazed. Award-winning Hyperic HQ Enterprise sets the standard for web application monitoring and management.   
Out-of-the box, HQ Enterprise can manage every major operating system, and over 75 of the products and technologies most   
commonly found in web infrastructures. How much configuration is required between installation and a live monitoring environment?   
None. Believe it - HQ will be up, running, and reporting within minutes of installation. Hard to believe? Try it. Think you ve got a   
challenging deployment environment? Try us. HQ Enterprise goes wherever applications run. In your data center, in virtualized   
environments, and in the cloud: it s all the same to HQ Enterprise. When we say management and monitoring we mean automatic discovery   
of software and network resources; automatic reporting of the key indicators of application health and well-being; a rich database of   
your software inventory and its operating history; remote control and administration of software resources; alerting, notification,   
escalation, and corrective action; and powerful facilities for analysis, visualization, and reporting.  
HQ Enterprise has one mission: managing web apps and the stuff that makes web apps run. It was designed for that. The biggest   
web operations in the world use it for that.  
  
(Copy of the Vendor Homepage: http://www.hyperic.com/products/enterprise-systems-monitoring)  
  
  
Abstract:  
=========  
Vulnerability-Lab Team discovered multiple Web Vulnerabilities on Hyperic HQ Enterprise & the open source edition.  
  
  
Report-Timeline:  
================  
2011-08-08: Public or Non-Public Disclosure  
  
  
Status:  
========  
Published  
  
  
Affected Products:  
==================  
  
Exploitation-Technique:  
=======================  
Remote  
  
  
Severity:  
=========  
High  
  
  
Details:  
========  
1.1  
Multiple Input Validation Vulnerabilities are detected (persistent) on Hyper HQ. Remote attackers or local low privileged user accounts   
can implement own malicious persistent script codes on application-side to manipulate specific requested content/sections. Local low   
privileged accounts can also include persistent frame requests to access with the same rights the log-health or not allowed static-files.  
  
Vulnerable Module(s): (Persistent)  
[+] HQ - Roles  
[+] java.security.krb5.kdc Q Health / HQ Process Information & Diagnostics  
[+] Browse - Monitor - Indikators  
  
Hyper HQ had created a new & own exception-handling on the software/application.The exception handling displays the upcoming input errors   
without parsed format in the device config box. Attackers can also execute malicious script codes out of the exception-handling.  
  
Vulnerable Module(s): (Persistent)  
  
[+] Exception-Handling > Applications > All Applications  
  
  
  
Pictures:  
../ive1.png  
../ive2.png  
  
  
  
1.2  
A client-side cross site scripting vulnerability is detected on the schemes configuration module of the service.  
The vulnerability allows to hijack cookies(session-data) of users/administrators via manipulated client-side xss request link.  
High user interaktion required for sucessfull exploitation.  
  
Vulnerable Module(s):  
[+] Escalation Schemes Configuration  
  
  
Pictures:  
../xss.png  
  
  
  
1.3  
A cross site request forgery vulnerability is detected on the password change module of the application.  
The cross site request forgery attack allows to add a new admin password (u=1 id=1 =admin).   
High user interaktion required for sucessfull exploitation.  
  
Vulnerable Modules:  
[+] Section UserAdmin Password Change  
  
Pictures:  
../csrf.png  
  
  
Proof of Concept:  
=================  
The vulnerabilities can be exploited by remote attackers or local & low privileged user accounts.  
For demonstration or reproduce ...  
  
1.1  
Code Review: HQ Roles [IVE - Persistent]  
  
<td width="30%" class="BlockContent">  
<!-- END VIEW MODE -->   
</td></tr><tr valign="top">  
<td width="20%" class="BlockLabel">Dashboard Name:</td>  
<td width="30%" class="BlockContent">  
<span id="dashboardString">New Role Dashboard</span></td>  
<td width="20%" class="BlockLabel"></td>  
<td width="30%" class="BlockContent"></td></tr></table>  
<!-- / -->  
  
  
Code Review: java.security.krb5.kdc Module: HQ Health / HQ Process Information & Diagnostics [IVE - Persistent]  
  
- java.rmi.server.codebase = http://h1461735:9093/   
- java.rmi.server.hostname = h1461735   
- java.runtime.name = Java(TM) SE Runtime Environment   
- java.runtime.version = 1.6.0_13-b03   
- java.security.krb5.kdc = >"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>   
- java.security.krb5.realm = >"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>   
- java.specification.name = Java Platform API Specification   
- java.specification.vendor = Sun Microsystems Inc.   
- java.specification.version = 1.6   
- java.vendor = Sun Microsystems Inc.   
  
.../PoC/printReport(poc).hqu  
  
  
  
Code Review: Browse - Monitor - Indikators [IVE - Persistent]  
  
  
hyperic.data.escalation.pauseSelect.options[12] = new Option("72 hours", "259200000");  
hyperic.data.escalation.pauseSelect.options[13] = new Option("Until Fixed", "9223372036854775807");  
</script>  
<title>  
HQ View Application Monitor Current Health - >"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>  
</title>  
<script type="text/javascript">  
var onloads = [];  
function initOnloads() {  
if (arguments.callee.done) return;  
  
... or  
  
hyperic.data.escalation.pauseSelect.options[12] = new Option("72 hours", "259200000");  
hyperic.data.escalation.pauseSelect.options[13] = new Option("Until Fixed", "9223372036854775807");  
</script>  
<title>  
>"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>  
</title>  
<script type="text/javascript">  
var onloads = [];  
function initOnloads() {  
  
if (arguments.callee.done) return;  
arguments.callee.done = true;  
if(typeof(_timer)!="undefined") clearInterval(_timer);  
for ( var i = 0 ; i < onloads.length ; i++ )  
onloads[i]();  
  
  
  
Code Review: Applications › All Applications - Topic [IVE - Persistent]  
  
<li class="hasSubmenu"><a href="">Recently Viewed</a><div><ul>  
<li><a href="/Resource.do?eid=4:10001">"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>;  
</a></li></ul></div></li></ul></div></li><li id="analyzeTab"><a href="#">Analyze</a><div><ul>  
  
  
  
Code Review: General Properties - Inventory over Exception-Handling [IVE - Persistent]  
  
<div id="exception27" style="visibility:hidden">javax.servlet.jsp.JspTagException: javax.servlet.jsp.JspException:   
An error occurred while evaluating custom action attribute "sort" with value "${param.scs}": An exception occured trying to convert   
String ">"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>" to type "java.lang.Integer"  
at org.hyperic.hq.ui.taglib.display.TableTag.evalAttr(TableTag.java:1456)  
at org.hyperic.hq.ui.taglib.display.TableTag.evalAttr(TableTag.java:1438)  
at org.hyperic.hq.ui.taglib.display.TableTag.evaluateAttributes(TableTag.java:1517)  
at org.hyperic.hq.ui.taglib.display.TableTag.doStartTag(TableTag.java:226)  
at org.apache.jsp.resource.application.inventory.ListServices_jsp._jspx_meth_display_005ftable_005f0(Unknown Source)  
at org.apache.jsp.resource.application.inventory.ListServices_jsp._jspx_meth_html_005fform_005f0(Unknown Source)  
at org.apache.jsp.resource.application.inventory.ListServices_jsp._jspService(Unknown Source)  
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:654)  
at org.apache.catalina.core.ApplicationDispatcher.doInclude(ApplicationDispatcher.java:557)  
at org.apache.catalina.core.ApplicationDispatcher.include(ApplicationDispatcher.java:481)  
at org.apache.jasper.runtime.JspRuntimeLibrary.include(JspRuntimeLibrary.java:968)  
at org.apache.jasper.runtime.PageContextImpl.include(PageContextImpl.java:609)  
at org.apache.struts.tiles.TilesUtilImpl.doInclude(TilesUtilImpl.java:99)  
at org.apache.struts.tiles.TilesUtil.doInclude(TilesUtil.java:135)  
at org.apache.struts.taglib.tiles.InsertTag.doInclude(InsertTag.java:760)  
at org.apache.struts.taglib.tiles.InsertTag$InsertHandler.doEndTag(InsertTag.java:892)  
at org.apache.struts.taglib.tiles.InsertTag.doEndTag(InsertTag.java:462)  
at org.apache.jsp.resource.application.inventory.ViewApplication_jsp._jspx_meth_tiles_005finsert_005f8(Unknown Source)  
at org.apache.jsp.resource.application.inventory.ViewApplication_jsp._jspService(Unknown Source)  
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:654)  
at org.apache.catalina.core.ApplicationDispatcher.doInclude(ApplicationDispatcher.java:557)  
at org.apache.catalina.core.ApplicationDispatcher.include(ApplicationDispatcher.java:481)  
at org.apache.jasper.runtime.JspRuntimeLibrary.include(JspRuntimeLibrary.java:968)  
at org.apache.jasper.runtime.PageContextImpl.include(PageContextImpl.java:609)  
at org.apache.struts.tiles.TilesUtilImpl.doInclude(TilesUtilImpl.java:99)  
at org.apache.struts.tiles.TilesUtil.doInclude(TilesUtil.java:135)  
at org.apache.struts.taglib.tiles.InsertTag.doInclude(InsertTag.java:760)  
at org.apache.struts.taglib.tiles.InsertTag$InsertHandler.doEndTag(InsertTag.java:892)  
at org.apache.struts.taglib.tiles.InsertTag.doEndTag(InsertTag.java:462)  
at org.apache.jsp.portal.ColumnsLayout_jsp._jspx_meth_tiles_005finsert_005f0(Unknown Source)  
at org.apache.jsp.portal.ColumnsLayout_jsp._jspx_meth_c_005fforEach_005f1(Unknown Source)  
at org.apache.jsp.portal.ColumnsLayout_jsp._jspx_meth_c_005fforEach_005f0(Unknown Source)  
at org.apache.jsp.portal.ColumnsLayout_jsp._jspService(Unknown Source)  
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:654)  
at org.apache.catalina.core.ApplicationDispatcher.doInclude(ApplicationDispatcher.java:557)  
at org.apache.catalina.core.ApplicationDispatcher.include(ApplicationDispatcher.java:481)  
at org.apache.jasper.runtime.JspRuntimeLibrary.include(JspRuntimeLibrary.java:968)  
at org.apache.jasper.runtime.PageContextImpl.include(PageContextImpl.java:609)  
at org.apache.struts.tiles.TilesUtilImpl.doInclude(TilesUtilImpl.java:99)  
at org.apache.struts.tiles.TilesUtil.doInclude(TilesUtil.java:135)  
at org.apache.struts.taglib.tiles.InsertTag.doInclude(InsertTag.java:760)  
at org.apache.struts.taglib.tiles.InsertTag$InsertHandler.doEndTag(InsertTag.java:892)  
at org.apache.struts.taglib.tiles.InsertTag.doEndTag(InsertTag.java:462)  
at org.apache.jsp.portal.MainLayout_jsp._jspx_meth_tiles_005finsert_005f2(Unknown Source)  
at org.apache.jsp.portal.MainLayout_jsp._jspService(Unknown Source)  
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:654)  
at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:445)  
at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:379)  
at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:292)  
at org.apache.struts.action.RequestProcessor.doForward(RequestProcessor.java:1085)  
at org.apache.struts.tiles.TilesRequestProcessor.doForward(TilesRequestProcessor.java:263)  
at org.apache.struts.tiles.TilesRequestProcessor.processTilesDefinition(TilesRequestProcessor.java:239)  
at org.apache.struts.tiles.TilesRequestProcessor.internalModuleRelativeForward(TilesRequestProcessor.java:341)  
at org.apache.struts.action.RequestProcessor.processForward(RequestProcessor.java:572)  
at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:221)  
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1196)  
at org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:414)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:690)  
at javax.servlet.http.HttpServlet.service(HttpServlet.java:803)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.hyperic.hq.ui.AuthenticationFilter.doFilter(AuthenticationFilter.java:167)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.hyperic.hibernate.filter.SessionFilter$1.run(SessionFilter.java:59)  
at org.hyperic.hq.hibernate.SessionManager.runInSessionInternal(SessionManager.java:79)  
at org.hyperic.hq.hibernate.SessionManager.runInSession(SessionManager.java:68)  
at org.hyperic.hibernate.filter.SessionFilter.doFilter(SessionFilter.java:57)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.java:164)  
at org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:141)  
at org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewriter.java:90)  
at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:417)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.hyperic.hq.product.servlet.filter.JMXFilter.doFilter(JMXFilter.java:322)  
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)  
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)  
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)  
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)  
at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:182)  
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)  
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)  
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)  
at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)  
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)  
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)  
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)  
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)  
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)  
at java.lang.Thread.run(Unknown Source) </div>  
  
  
1.2  
References:  
http://xx.x14.147.xx:7080/admin/role/RoleAdmin.do?mode=new  
http://xx.x14.147.xx:7080/hqu/health/health/printReport.hqu  
http://xx.x14.147.xx:7080/Resource.do?eid=4:10001  
http://xx.x14.147.xx:7080/ResourceHub.do  
http://xx.x14.147.xx:7080/resource/application/Inventory.do?mode=view&accord=3&eid=4:10001&sos=dec&scs=  
  
  
  
  
Code Review: Escalation Schemes Configuration [XSS]  
  
http://81.218.143.61:7080/admin/config/Config.do?mode=escalate&escId=[INCLUDE CLIENT_SIDE SCRIPTCODE HERE!!!]  
  
References:  
http://81.218.143.61:7080/admin/config/Config.do?mode=escalate&escId=  
  
  
  
  
1.3  
Code Review: UserAdmin Password Change [CSRF]  
  
<input type="hidden" name="id" value="1"><input type="hidden" name="u" value="1"><input type="hidden" name="currentPassword" value="1">Enter New Password:<br>  
<input type="password" size="31" maxlength="40" name="newPassword" tabindex="4"><br>  
<div class="ErrorField"><span class="ErrorFieldContent">-new password can not be less than 6 characters.<br></div><span class="CaptionText">  
At least 6 case-sensitive characters and numbers, no spaces, or quotation marks.<br> <br>  
</span>Confirm New Password:<br><input type="password" size="31" maxlength="40" name="confirmPassword" tabindex="5"><br>  
<div class="ErrorField"><span class="ErrorFieldContent"></div></td></tr>  
  
References:  
http://81.218.143.61:7080/admin/user/UserAdmin.do?mode=editPass&u=1  
  
  
Risk:  
=====  
The security risk of the vulnerabilities are estimated as high.  
  
  
Credits:  
========  
Vulnerability Research Laboratory - Benjamin Kunz Mejri (Rem0ve)  
  
  
Disclaimer:  
===========  
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,   
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business   
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some   
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation   
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-  
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of   
other media, are reserved by Vulnerability-Lab or its suppliers.  
  
Copyright © 2011|Vulnerability-Lab  
  
  
  
  
--   
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com  
Contact: admin@vulnerability-lab.com or support@vulnerability-lab.com  
  
`