S21SEC-024 - Vignette TCL Injection

2003-05-28T00:00:00
ID SECURITYVULNS:DOC:4594
Type securityvulns
Reporter Securityvulns
Modified 2003-05-28T00:00:00

Description

ID: S21SEC-024-en Title: Vignette TCL Injection Date: 03/04/2003 Status: Vendor contacted and solution available Scope: TCL code Execution, Remote command execution Platforms: All Author: rpinuaga Location: http://www.s21sec.com/es/avisos/s21sec-024-en.txt Release: External

                            S 2 1 S E C

                       http://www.s21sec.com

                       Vignette TCL Injection

About Vignette

Vignette develops Content Management and Application Portal Software.

Description of vulnerability

Vignette Software presents a vulnerability in some propietary commands that permits the injection of TCL code under some circunstances.

The affected Vignette commands are: - NEEDS - VALID_PATHS

All the TCL templates or scripts, that use this commands, are vulnerable to remote code injection.

The source code of both commands is located in a file called "stdlib.tcl" at the Vignette library directory. The offending code is the following:

========== stdlib.tcl (Extracted from Vignette 5.6.3) ==========

-- Lines 1049/1053 (NEEDS command) --

    SET cookieName "vgn_creds"
    SET formPath [CURL /vgn/login]


            SET queryString [SHOW HTTP_QUERY_STRING]        <--- (!)


    } elseif {[llength $args] < 2} {
    error "Usage: NEEDS LOGIN cookieName URL\n"

--

-- Lines 1141/1146 (NEEDS command) --

} elseif {![string compare $arg "COOKIE"]} {
    global _Cookie HTTP_COOKIE


    regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString            <--- (!)


    set cookies [split $cookieString { }]
    foreach c $cookies {

--

-- Lines 1272/1277 (VALID_PATHS command) --

global _Path
if {[info exists _Path] == 1 && [lsearch $paths $_Path] == -1} {


system_error "Invalid path \"$_Path\" for template (referer='[SHOW HTTP_REFERER]')"         <--- (!)


}
return ""

--

=================================================

As seen, the value of some unfiltered variables is used and evaluated with the SHOW command. If the external variable contains Vignette code, then arbitrary TCL execution is posible. The affected input variables are: - HTTP_QUERY_STRING, converted to queryString in NEEDS command. - HTTP_COOKIE, converted to cookieString in NEEDS command. - HTTP_REFERER, showed in VALID_PATHS command.

This three variables are received directly form the web client, and aren't sanitized in any way. If the Vignette/TCL escape characters are included "[" and "]" the code between them is evaluated as valid TCL code.

The VALID_PATHS command is very few used in Vignette Applications, but the NEEDS command is extensively used, even in the default Vignette templates. The following default installed templates are vulnerables and remotely exploitables:

/vgn/ac/edit - [NEEDS LOGIN] /vgn/ac/index - [NEEDS LOGIN] /vgn/vr/Editing - [NEEDS LOGIN] /vgn/vr/Select - [NEEDS LOGIN] /vgn/legacy/edit - [NEEDS LOGIN] /vgn/ppstats - [NEEDS LOGIN]

It's important to note that the bug not only affect the default Vignette Applications, nor it affects all the applications developed over a Vignette Server Software, that use the affected commands.

Affected Versions and platforms

This vulnerability has been tested in Vignette StoryServer 5, and Vignette V/6. But it seems that all currently avaliable versions are vulnerable.

Solution

Replace the offending SHOW evaluations in stdlib.tcl with directly passed variables. For example:

instead: SET queryString [SHOW HTTP_QUERY_STRING] use ==> SET queryString $HTTP_QUERY_STRING

instead: regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString use ==> regsub -all {; } $HTTP_COOKIE { } cookieString

instead: system_error "Invalid path \"$_Path\" for template (referer='[SHOW HTTP_REFERER]')" use ==> system_error "Invalid path \"$_Path\" for template (referer='$HTTP_REFERER')"

Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution.

Additional information

These vulnerabilities have been found and researched by:

Ramon Pinuaga Cascales rpinuaga@s21sec.com

You can find the last version of this warning in:

    http://www.s21sec.com/es/avisos/s21sec-024-en.txt

And other S21SEC warnings in http://www.s21sec.com/es/avisos/