BlackBerry Enterprise Service 12 (BES12) Self-Service XSS / SQL Injection

`( , ) (,  
. '.' ) ('. ',  
). , ('. ( ) (  
(_,) .'), ) _ _,  
/ _____/ / _ \ ____ ____ _____  
\____ \==/ /_\ \ _/ ___\/ _ \ / \  
/ \/ | \\ \__( <_> ) Y Y \  
/______ /\___|__ / \___ >____/|__|_| /  
\/ \/.-. \/ \/:wq  
(x.0)  
'=.|w|.='  
_=''"''=.  
  
presents..  
  
BlackBerry Enterprise Service 12 (BES12) Self-Service  
Affected versions: BES12 < 12.4  
  
CVE: CVE-2016-1914 and CVE-2016-1915  
  
PDF:  
http://security-assessment.com/files/documents/advisory/Blackberry%20BES12%20Self-Service%20Multiple%20Vulnerabilities.pdf  
  
  
+-----------+  
|Description|  
+-----------+  
  
Blackberry BES12 is an enterprise mobile management solution and  
contains a self-service web application available to mobile users. This  
web application contains multiple vulnerabilities including  
unauthenticated SQL  
injection and reflected cross site scripting.  
  
Limited access to an on-premise BES12 environment was provided during  
the discovery of these vulnerabilities. The full impact of the  
vulnerabilities in relation to compromising other portions of the BES12  
solution, such as mobile devices, is unclear.  
  
  
+------------+  
|Exploitation|  
+------------+  
  
*SQL Injection*  
  
The Java servlet com.rim.mdm.ui.server.ImageServlet is vulnerable to SQL  
injection via the imageName parameter. This servlet is exposed at  
multiple paths and is used to fetch an image from the database:  
  
/mydevice/client/image  
/admin/client/image  
/myapps/client/image  
/ssam/client/image  
/all/client/image  
  
  
This was discovered on a production BES12 on-premise deployment and the  
injection vector allowed both UNION and stacked queries to be executed  
on the Microsoft SQL server used by BES12. This allows full read/write  
access to the database, and can potentially result in command execution  
via xp_cmdshell depending on the database user configuration.  
  
The following proof of concept demonstrates an injection payload which  
will select the entire obj_keystore_entry table. The query will  
serialise the entire table into an XML document which is returned in the  
HTTP response as UTF-16 without the leading BOM (byte order mark)  
causing most text editors to fail to display the response correctly.  
  
https://<server>/mydevice/client/image?imageName=ui.cobranded.login.logo'+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,(SELECT+*+FROM+obj_keystore_entry+FOR+XML+PATH(''))+--  
  
The technique above can be used to download any database table available  
to the BES12 database user.  
  
Notable database tables are:  
* obj_user which contains BES12 user details.  
* obj_user_authentication which contains authentication tokens.  
* obj_user_device which based on column names, contains enrolment  
tokens, enrolment secrets and device encryption keys.  
  
It is unclear if this information is sufficient to decrypt a lost/stolen  
BES12 mobile device.  
  
  
*Reflected Cross Site Scripting*  
  
Two areas of the self-service web application exist where user-supplied  
input is reflected directly in web pages, allowing a malicious user to  
conduct Cross Site Scripting (XSS) attacks against users of the  
application. While the application uses the HttpOnly cookie flag for  
session tokens, successful exploitation allows malicious JavaScript to  
perform any action within the application that the targeted user is able  
to. The administrative web application is typically hosted on the same  
domain and may be attacked using these XSS vectors, although this is  
BES12 deployment specific.  
  
The table below details where Cross Site Scripting was detected and  
which parameters are vulnerable:  
  
https://<server>/mydevice/index.jsp?locale="><script>alert(1)</script>  
https://<server>/mydevice/loggedOut.jsp?locale="><script>alert(1)</script>  
  
  
+----------+  
| Solution |  
+----------+  
  
  
Upgrade to BES12.4.  
  
  
+-------------------+  
|Disclosure Timeline|  
+-------------------+  
  
  
Initial disclosure to Blackberry – 19 Nov 2015  
Disclosure receipt confirmed by Blackberry – 19 Nov 2015  
Request for update from Blackberry – 7 Dec 2015  
Vulnerabilities confirmed by Blackberry – 8 Dec 2015  
Blackberry confirms fixes will be released as part of BES12.4 – 28 Jan 2016  
BES12.4 released – 29 Jan 2016  
Advisory released – 15 Feb 2016  
  
  
+-----------------------------+  
|About Security-Assessment.com|  
+-----------------------------+  
  
  
Security-Assessment.com is a leading team of Information Security  
consultants specialising in providing high quality Information Security  
services to clients throughout the Asia Pacific region. Our clients  
include some of the largest globally recognised companies in areas such  
as finance, telecommunications, broadcasting, legal and government. Our  
aim is to provide the very best independent advice and a high level of  
technical expertise while creating long and lasting professional  
relationships with our clients.  
Security-Assessment.com is committed to security research and  
development, and its team continues to identify and responsibly publish  
vulnerabilities in public and private software vendor's products.  
Members of the Security-Assessment.com R&D team are globally recognised  
through their release of whitepapers and presentations related to new  
security research.  
  
For further information on this issue or any of our service offerings,  
contact us:  
Web www.security-assessment.com  
Email [email protected]  
  
  
  
`