Sun Glassfish Woodstock Project 4.2 XSS

`Digital Security Research Group [DSecRG] Advisory #DSECRG-09-038  
  
Original advisory: http://dsecrg.com/pages/vul/show.php?id=138  
  
Application: Sun Glassfish Woodstock Project (part of Glassfish Enterprise Server)  
Versions Affected: 4.2  
Vendor URL: https://woodstock.dev.java.net/  
Bug: Linked XSS Vulnerability  
Exploits: YES  
Reported: 19.03.2009  
Vendor response: 20.03.2009  
Solution: YES   
Date of Public Advisory: 05.05.2009  
Author: Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)  
  
  
  
Description  
***********  
  
Woodstock components are User Interface Components for the web, based on Java Server Faces and AJAX.  
  
Woodstock also is part Glassfish Enterprise Server.  
  
Woodstock has linked XSS vulnerability in 404 Error page.  
  
  
  
Details  
*******  
  
Using this vulnerability attacker can steal admin's cookie and then   
authentificate as administrator or perform certain administrative   
actions.  
  
Attacker can inject XSS in URL string using UTF-7 encoding.  
  
Exploiting this issue required Auto-Select encoding in browser   
configuration.  
  
Example:  
  
http://[server]/theme/META-INF/>+ACJ-+AD4APB-SCRIPT+AD7-alert(+ACI-DSecRG_XSS+ACI-)+ADz-/SCRIPT+AD7-  
  
  
  
Solution  
********  
  
This security vulnerabilities fixed in CVS.  
  
The following link to the commit email message for the changes to fix these issue:  
  
https://woodstock.dev.java.net/servlets/ReadMsg?list=cvs&msgNo=4041  
  
  
  
Credits  
*******  
  
http://www.nabble.com/Re:--DSECRG--Sun-Glassfish-Multiple-Security-Vulnerabilities-p23002524.html  
  
About  
*****  
  
Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.  
  
  
Contact: research [at] dsecrg [dot] com  
http://www.dsecrg.com   
http://www.dsec.ru  
  
`