Endeca Latitude 2.2.2 Cross Site Request Forgery

`Advisory: Endeca Latitude Cross-Site Request Forgery  
  
RedTeam Pentesting discovered a Cross-Site Request Forgery (CSRF)  
vulnerability in Endeca Latitude. Using this vulnerability, an attacker  
might be able to change several different settings of the Endeca  
Latitude instance or disable it entirely.  
  
  
Details  
=======  
  
Product: Endeca Latitude  
Affected Versions: 2.2.2, potentially others  
Fixed Versions: N/A  
Vulnerability Type: Cross-Site Request Forgery  
Security Risk: low  
Vendor URL: N/A  
Vendor Status: decided not to fix  
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2013-002  
Advisory Status: published  
CVE: CVE-2014-2399  
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2399  
  
  
Introduction  
============  
  
Endeca Latitude is an enterprise data discovery platform for advanced,  
yet intuitive, exploration and analysis of complex and varied data.  
Information is loaded from disparate source systems and stored in a  
faceted data model that dynamically supports changing data. This  
integrated and enriched data is made available for search, discovery,  
and analysis via interactive and configurable applications.  
  
(from the vendor's homepage)  
  
  
More Details  
============  
  
Endeca Latitude offers administrators the ability to perform different  
administrative and configuration operations by accessing URLs.  
These URLs are not secured by a randomly generated token and therefore  
are prone to Cross-Site Request Forgery attacks.  
  
For example by accessing the URL http://example.com/admin?op=exit an  
administrator can shut down the Endeca Latitude instance. Several other  
URLs exist (as documented at [1] and [2]) which can be used to trigger  
operations such as flushing cashes or changing the logging settings.  
  
  
Proof of Concept  
================  
  
An attacker might prepare a website, which can trigger arbitrary  
functionality (see [1] and [2]) of an Endeca Latitude instance if  
someone opens the attacker's website in a browser that can reach Endeca  
Latitude. An easy way to implement this is to embed a hidden image into  
an arbitrary website which uses the corresponding URL as its source:  
  
<img src="http://example.com/admin?op=exit" style="display:hidden" />  
<img src="http://example.com/config?op=log-disable" style="display:hidden" />  
[...]  
  
  
Workaround  
==========  
  
The vendor did not update the vulnerable software, but recommends to  
configure all installations to require mutual authentication using TLS  
certificates for both servers and clients, while discouraging users from  
installing said client certificates in browsers.  
  
  
Fix  
===  
  
Not available. The vendor did not update the vulnerable software to  
remedy this issue.  
  
  
Security Risk  
=============  
  
The vulnerability can enable attackers to be able to interact with an  
Endeca Latitude instance in different ways. Possible attacks include the  
changing of settings as well as denying service by shutting down a  
running instance. Attackers mainly benefit from this vulnerability if  
the instance is not already available to them, but for example only to  
restricted IP addresses or after authentication. Since this makes it  
harder to identify potential target systems and the attack mainly allows  
to disturb the service until it is re-started, the risk of this  
vulnerability is considered to be low.  
  
  
Timeline  
========  
  
2013-10-06 Vulnerability identified  
2013-10-08 Customer approved disclosure to vendor  
2013-10-15 Vendor notified  
2013-10-17 Vendor responded that investigation/fixing is in progress  
2014-02-24 Vendor responded that bug is fixed and scheduled for a future  
CPU  
2014-03-13 Vendor responded with additional information about a  
potential workaround  
2014-04-15 Vendor releases Critical Patch Update Advisory with little  
information on the proposed fix  
2014-04-16 More information requested from vendor  
2014-05-02 Vendor responds with updated information  
2014-06-25 Advisory released  
  
  
References  
==========  
  
[1] http://docs.oracle.com/cd/E29220_01/mdex.222/admin/toc.htm#List%20of%20administrative%20operations  
[2] http://docs.oracle.com/cd/E29220_01/mdex.222/admin/toc.htm#List%20of%20supported%20logging%20variables  
  
  
RedTeam Pentesting GmbH  
=======================  
  
RedTeam Pentesting offers individual penetration tests, short pentests,  
performed by a team of specialised IT-security experts. Hereby, security  
weaknesses in company networks or products are uncovered and can be  
fixed immediately.  
  
As there are only few experts in this field, RedTeam Pentesting wants to  
share its knowledge and enhance the public knowledge with research in  
security related areas. The results are made available as public  
security advisories.  
  
More information about RedTeam Pentesting can be found at  
https://www.redteam-pentesting.de.  
  
  
--   
RedTeam Pentesting GmbH Tel.: +49 241 510081-0  
Dennewartstr. 25-27 Fax : +49 241 510081-99  
52068 Aachen https://www.redteam-pentesting.de  
Germany Registergericht: Aachen HRB 14004  
Geschäftsführer: Patrick Hof, Jens Liebchen  
`