Applicure dotDefender 4.0 Cross Site Scripting

`____________________________________________________________________________  
  
Applicure dotDefender 4.0 administrative interface cross site scripting  
  
____________________________________________________________________________  
  
An advisory by EnableSecurity.  
  
ID: ES-20100601  
  
Advisory URL:  
http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt  
  
Affected Versions: version 4.0  
  
Fixed versions: 4.01-3 (and later)  
  
Description:  
  
Applicure dotDefender is a Web Application Firewall that can be installed on  
Windows and Linux servers.  
  
>From their website (applicure.com):  
"dotDefender is the market-leading software Web Application Firewall (WAF).  
dotDefender boasts enterprise-class security, advanced integration capabilities,  
easy maintenance and low total cost of ownership (TCO). dotDefender is the  
perfect choice for protecting your website and web applications today. "  
  
Credits:  
  
These vulnerabilities were discovered during WAF testing by Sandro Gauci of  
EnableSecurity. We contacted AppliCure on May 17, 2010 about this vulnerability.  
They were already working on a fix.  
  
____________________________________________________________________________  
  
Technical details:  
  
The log viewer facility in dotDefender does not properly htmlencode user  
supplied input. This leads to a cross site scripting vulnerability when the log  
viewer displays HTTP headers.  
  
____________________________________________________________________________  
  
Demo:  
  
One may use curl and insert headers containing html tags using the --header  
switch.  
Example:  
  
curl "http://website.org/c?a=<script>" \  
--header "<script>alert(1)</script>: aa"  
  
When the administrator views the log viewer page, his/her web browser will  
execute the attacker's javascript.  
  
The following demo shows how an attacker can switch off dotDefender in order to  
bypass any "protection" offered by the WAF:  
  
http://vimeo.com/12132622  
  
Timeline:  
  
May 17, 2010: Initial contact  
Jun 01, 2010: Release of this advisory  
  
Solution:  
  
Upgrade to the latest version of dotDefender:  
http://www.applicure.com/  
  
____________________________________________________________________________  
  
Contact: "Sandro Gauci" <[email protected]>  
  
About EnableSecurity:  
  
EnableSecurity is dedicated to providing high quality Information Security  
Consultancy, Research and Development. EnableSecurity develops security tools  
such as VOIPPACK (for Immunity CANVAS) and SIPVicious. EnableSecurity is  
focused on analysis of security challenges and providing solutions to such  
threats. EnableSecurity works on developing custom targeted security solutions,  
as well as working with existing off the shelf security tools to provide the  
best results for their customers. More info at enablesecurity.com  
  
Disclaimer: The information in the advisory is believed to be accurate at the  
time of publishing based on currently available information. Use of the  
information constitutes acceptance for use in an AS IS condition. There are no  
warranties with regard to this information. Neither the author nor the publisher  
accepts any liability for any direct, indirect, or consequential loss or damage  
arising from use of, or reliance on, this information.  
  
`