Reporter Quentin Berdugo
The following security report has been sent to RSA/EMC on the 2/10/2007 and confirmed by them. RSA took action to alert their customers.
The WebID authentication framework suffers from a flow allowing to steal an authenticated users's session if he is enticed into clicking a malicous link.
TEST URL :
The problem resides in the main library IISWebAgentIF.dll which can usually be found a the address "http://www.server.com/WebID/IISWebAgentIF.dll" this entry point accepts many parameters but only the "postdata" parameter has been found vulnerable.
This parameter is normally sent over a POST method but it is equally accepted through a GET.
This bug has already been reported and confirmed in April 2005 as CVE-2005-118 and a security fix has been issued. Nevertheless, it appears that the fix is poorly implemented as basic circumvention techniques allows to bypass those security checks.
These examples illustrates how to execute code on the page without triggering the security mechanisms (could be many more) :
[inserting a newline between the tags]
[insterting a space between the quotation marks and the closing bracket.]
The exploitation of the vulnerability requires an action from the victim (clicking on a malicious link).
As the bug is accessible prior to the authentication phase, it can be discovered and exploited without any access to the underlying application. As the URL denotes the presence of the product, many vulnerable targets can be found easily (ex google "inurl:IISWebAgentIF.dll" ). Finally, it is possible to insert comments at the end of the malicious code to make the victim's page unchanged.
We have confirmed the existence of this vulnerability in RSA WebID 5.3 + Security Fix XSS ID 45559. It is suspected that any earlier version is also vulnerable.
It's safer to filter out dangerous characters instead of dangerous keywords.