STG-Verity-K2.txt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
STG Security Advisory: [SSA-20030701-02] Verity K2 Toolkit Query Builder XSS  
Vulnerability  
  
Revision 1.0  
Date Published: 2003-07-01 (KST)  
Last Update: 2003-07-01  
Disclosed by SSR Team ([email protected])  
  
  
Summary  
===================  
Verity's K2 Toolkit provides e-commerce developers with text retrieval  
capabilities and application integration features necessary for  
customization including catalog navigation and content search functions.  
  
Verity's K2 Toolkit has a XSS vulnerability in Query Builder.  
  
Vulnerability Class  
===================  
Implementation Error: Inappropriate Input Validation  
  
Details  
=======  
Query Builder in Verity K2 Toolkit executes a malicious JavaScript command  
injected in query string when displaying error messages.  
  
Proof of Concept:  
http://[victim site]/[search].jsp?[query]=><img  
src=javascript:alert(document.cookie)>  
  
Result:  
Internal Servlet Error: Error E1-0111 (Query Builder): Syntax error in query  
string near character [foo]  
Error E1-0111 (Query Builder): Syntax error in query string near character  
[bar]  
Error E1-0114 (Query Builder): Error parsing query: [JAVASCRIPT RUNS HERE!]  
...  
  
Using this cross site scripting vulnerability, an attacker can hijack the  
session of an administrator and deploy viruses or worms via vulnerable web  
browsers.  
  
Impact  
======  
At August 2002, Eye on Security released an article entitled "Bypassing  
JavaScript Filters - the Flash! Attack" on the attacking method utilizing  
cross site scripting vulnerabilities. A highly effective automated tool  
using this method for session hijacking in the wild enables a hacker to  
acquire the privilege of administrators and to alter or erase the web pages  
of an victim site.  
  
Workaround  
==========  
To workaround this problem, programmers must implement below exception  
process mechanisms.  
  
1. Catch exceptions and redirect users to a static error page predefined.  
2. Log all errors to a log file for your debugging purpose.  
  
  
Affected Products  
==================  
Verity K2 Toolkit v2.20 for RS/6000 is vulnerable.  
We don't know whether another product has this vulnerability.  
  
  
Vendor Status: UNKNOWN  
===================  
2003-06-17 Verity notified.  
2003-06-18 Verity replied.  
2003-06-18 Second attempt at vendor contact.  
2003-06-23 Third attempt at vendor contact.  
2003-06-24 Verity resisted to follow up the problem.  
2003-07-01 Public disclosure  
  
Credits  
=======  
Jeremy Bae at STG Security SSR Team  
  
About STG Security  
==================  
STG Security Inc. is a affiliated company of STG Group which has its head  
office in the States founded in march 2000. Its core business area is  
professional penetration testing, security code review and BS7799 consulting  
services.  
  
http://www.stgsecurity.com/  
  
Phone +82-2-6333-4500  
FAX +82-2-6333-4545  
  
  
-----BEGIN PGP SIGNATURE-----  
Version: PGP 8.0  
  
iQA/AwUBPwKpsT9dVHd/hpsuEQIDxQCgnog8KPORRT0YRdPef3+qNJOm6hMAnRwK  
aDmPJ3W2f0GKIMQGPeS3tZgV  
=7uD3  
-----END PGP SIGNATURE-----  
  
  
`