Oracle WebCenter / Fatwire Header Injection

`SEC Consult Vulnerability Lab Security Advisory < 20130417-2 >  
=======================================================================  
title: HTTP header injection/Cache poisoning in Oracle WebCenter  
Sites Satellite Server  
product: Oracle WebCenter Sites Satellite Server (former FatWire  
Satellite Server)  
vulnerable version: 7.6.0 Patch1, 7.6.2, 11.1.1.6.0, 11.1.1.6.1  
fixed version: Patch information see sections below  
CVE: CVE-2013-1509  
impact: medium  
homepage: http://www.oracle.com/us/corporate/acquisitions/fatwire/index.html  
found: 2012-09-17  
by: K. Gudinavicius  
SEC Consult Vulnerability Lab  
https://www.sec-consult.com  
=======================================================================  
  
Vendor description:  
-------------------  
FatWire Satellite Server is a predecessor product of Oracle WebCenter Sites  
Satellite Server.  
  
"Oracle WebCenter Sites Satellite Server enables organizations to deliver  
segmented, targeted, and dynamically assembled content across global Web  
properties with rapid response times and intelligent edge caching to optimize  
and speed the delivery of dynamic Web experiences."  
  
Source: http://www.oracle.com/us/products/middleware/webcenter/satellite-server/overview/index.html  
  
  
Vulnerability overview/description:  
-----------------------------------  
Due to unsanitized user input it is possible to inject arbitrary HTTP header  
values in certain HTTP responses of the Satellite Server. This can be  
exploited, for example, to perform session fixation and malicious redirection  
attacks via the Set-Cookie and the Refresh headers. Moreover, the Satellite  
Server caches these HTTP responses with the injected HTTP header resulting in  
all further requests to the same resource being served with the poisoned HTTP  
response, while these objects remain in cache.  
  
  
Proof of concept:  
-----------------  
An arbitrary header can be injected in the HTTP responses of the  
downloadable resources. The values of the blobheadername2 and the  
blobheadervalue2 URL parameters are user controllable. In the following  
example the Refresh header is injected:  
  
http://fatwire/cs/Satellite?blobcol=urldata&blobheadername1=content-type&blobheadername2=Refresh&  
blobheadervalue1=application/pdf&blobheadervalue2=0;url=http://www.sec-consult.com&blobkey=id&  
blobnocache=false&blobtable=MungoBlobs&blobwhere=1342534304149&ssbinary=true&site=S08  
  
The returned HTTP response will contain the injected Refresh header and its  
value. Furthermore, the HTTP response will be cached, so the next time users  
will be accessing the same downloadable resource using the standard URL, they  
will be affected and redirected using the injected Refresh header value.  
  
HTTP/1.1 200 OK  
Date: Thu, 06 Sep 2012 15:59:04 GMT  
Refresh: 0;url=http://www.sec-consult.com  
Last-Modified: Thu, 06 Sep 2012 15:54:20 GMT  
Content-Type: application/pdf  
Connection: close  
Content-Length: 772193  
  
  
Vulnerable / tested versions:  
-----------------------------  
The following installation has been tested:  
* FatWire Satellite Server 7.6.0 Patch1.  
  
  
Vendor contact timeline:  
------------------------  
2012-11-26: Contacting vendor through [email protected]  
2012-11-26: Vendor response, will investigate issues  
2012-11-27: Investigation ongoing, the following ID assigned:  
S0321206 - ARBITRARY HTTP HEADER INJECTION/CACHE POISONING IN FATWIRE  
2013-01-25: S0321206 Issue fixed in main codeline, scheduled for a future CPU  
2013-04-12: S0321206 is fixed in upcoming CPU on 2013-04-16  
2013-04-16: Oracle releases April 2013 CPU  
2013-04-17: Public release of SEC Consult advisory  
  
  
Solution:  
---------  
Apply latest patches, see:  
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html  
  
  
Workaround:  
-----------  
  
  
Advisory URL:  
-------------  
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
SEC Consult Unternehmensberatung GmbH  
  
Office Vienna  
Mooslackengasse 17  
A-1190 Vienna  
Austria  
  
Tel.: +43 / 1 / 890 30 43 - 0  
Fax.: +43 / 1 / 890 30 43 - 25  
Mail: research at sec-consult dot com  
https://www.sec-consult.com  
  
EOF K. Gudinavicius / @2013  
  
  
`