Applicure DotDefender Persistent XSS

                                                An advisory by EnableSecurity.

ID: ES-20100601

Advisory URL:
http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt

Affected Versions: version 4.0

Fixed versions: 4.01-3 (and later)

Description:

Applicure dotDefender is a Web Application Firewall that can be installed on
Windows and Linux servers.


    From their website (applicure.com):

"dotDefender is the market-leading software Web Application Firewall (WAF).
dotDefender boasts enterprise-class security, advanced integration capabilities,
easy maintenance and low total cost of ownership (TCO). dotDefender is the
perfect choice for protecting your website and web applications today. "

Credits:

These vulnerabilities were discovered during WAF testing by Sandro Gauci of
EnableSecurity. We contacted AppliCure on May 17, 2010 about this vulnerability.
They were already working on a fix.

____________________________________________________________________________

Technical details:

The log viewer facility in dotDefender does not properly htmlencode user
supplied input. This leads to a cross site scripting vulnerability when the log
viewer displays HTTP headers.

____________________________________________________________________________

Demo:

One may use curl and insert headers containing html tags using the --header
switch.
Example:

    curl "http://website.org/c?a=<script>" \
    --header "<script>alert(1)</script>: aa"

When the administrator views the log viewer page, his/her web browser will
execute the attacker's javascript.

The following demo shows how an attacker can switch off dotDefender in order to
bypass any "protection" offered by the WAF:

    http://vimeo.com/12132622

Timeline:

May 17, 2010: Initial contact
Jun 01, 2010: Release of this advisory

Solution:

Upgrade to the latest version of dotDefender:
http://www.applicure.com/