Applicure dotDefender 4.0 administrative interface cross site scripting
An advisory by EnableSecurity.
Advisory URL: http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt
Affected Versions: version 4.0
Fixed versions: 4.01-3 (and later)
Applicure dotDefender is a Web Application Firewall that can be installed on Windows and Linux servers.
From their website (applicure.com): "dotDefender is the market-leading software Web Application Firewall (WAF). dotDefender boasts enterprise-class security, advanced integration capabilities, easy maintenance and low total cost of ownership (TCO). dotDefender is the perfect choice for protecting your website and web applications today. "
These vulnerabilities were discovered during WAF testing by Sandro Gauci of EnableSecurity. We contacted AppliCure on May 17, 2010 about this vulnerability. They were already working on a fix.
The log viewer facility in dotDefender does not properly htmlencode user supplied input. This leads to a cross site scripting vulnerability when the log viewer displays HTTP headers.
One may use curl and insert headers containing html tags using the --header switch. Example:
curl "http://<victim>/c?a=<script>" \ --header "<script>alert(1)</script>: aa"
The following demo shows how an attacker can switch off dotDefender in order to bypass any "protection" offered by the WAF:
May 17, 2010: Initial contact Jun 01, 2010: Release of this advisory
Upgrade to the latest version of dotDefender: http://www.applicure.com/
Contact: "Sandro Gauci" <firstname.lastname@example.org>
EnableSecurity is dedicated to providing high quality Information Security Consultancy, Research and Development. EnableSecurity develops security tools such as VOIPPACK (for Immunity CANVAS) and SIPVicious. EnableSecurity is focused on analysis of security challenges and providing solutions to such threats. EnableSecurity works on developing custom targeted security solutions, as well as working with existing off the shelf security tools to provide the best results for their customers. More info at enablesecurity.com
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.