Resin Application Server 4.0.36 Cross-Site Scripting Vulnerabilities

2013-06-07T00:00:00
ID ZSL-2013-5143
Type zeroscience
Reporter Gjoko Krstic
Modified 2013-06-07T00:00:00

Description

Title: Resin Application Server 4.0.36 Cross-Site Scripting Vulnerabilities
Advisory ID: ZSL-2013-5143
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 07.06.2013

Summary

Resin is the Java Application Server for high traffic sites that require speed and scalability. It is one of the earliest Java Application Servers, and has stood the test of time due to engineering prowess.

Description

Resin Application and Web Server suffers from a XSS issue due to a failure to properly sanitize user-supplied input to the 'logout' GET parameter in the 'index.php' script. URI-based XSS issue is also present and both of the vulnerabilities can be triggered once the user/admin is logged in (post-auth). Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session.

Vendor

Caucho Technology, Inc. - <http://www.caucho.com>

Affected Version

Resin Professional Web And Application Server 4.0.36

Tested On

Resin Professional 4.0.36 (built Fri, 26 Apr 2013 03:33:09 PDT)
Java HotSpot(TM) 64-Bit Server VM 23.3-b01
4 cpu, Windows 7 amd64 6.1

Vendor Status

[01.06.2013] Vulnerability discovered.
[01.06.2013] Contact with the vendor.
[06.06.2013] No response from the vendor.
[07.06.2013] Public security advisory released.

PoC

resin_xss.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] <http://cxsecurity.com/issue/WLB-2013060065>
[2] <http://packetstormsecurity.com/files/121932>
[3] <http://secunia.com/advisories/53749/>
[4] <http://www.securityfocus.com/bid/60426>
[5] <http://osvdb.org/show/osvdb/94066>
[6] <http://osvdb.org/show/osvdb/94067>
[7] <http://xforce.iss.net/xforce/xfdb/84875>
[8] <http://www.eeye.com/resources/security-center/research/zero-day-tracker/2013/20130607>
[9] <http://securitytracker.com/id/1028647>

Changelog

[07.06.2013] - Initial release
[08.06.2013] - Added reference [1]
[09.06.2013] - Added reference [2]
[10.06.2013] - Added reference [3] and [4]
[11.06.2013] - Added reference [5] and [6]
[13.06.2013] - Added reference [7]
[14.06.2013] - Added reference [8]
[17.06.2013] - Added reference [9]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: lab@zeroscience.mk

                                        
                                            &lt;html&gt;&lt;head&gt;&lt;title&gt;403 Nothing to see.&lt;/title&gt;
&lt;link rel="Shortcut Icon" href="favicon.ico" type="image/x-icon"&gt;
&lt;style type="text/css"&gt;
&lt;!--
body {
	background-color: #000;
}
body,td,th {
	font-family: Verdana, Geneva, sans-serif;
}
a:link {
	color: #008FEF;
	text-decoration: none;
}
a:visited {
	color: #008FEF;
	text-decoration: none;
}
a:hover {
	text-decoration: underline;
	color: #666;
}
a:active {
	text-decoration: none;
}
--&gt;
&lt;/style&gt;
&lt;/head&gt;
&lt;body bgcolor=black&gt;
&lt;center&gt;
&lt;font color="#7E88A3" size="2"&gt;
&lt;br /&gt;&lt;br /&gt;
&lt;h1&gt;403 Nothing to see.&lt;/h1&gt;

You do not have the powah for this request /403.shtml&lt;br /&gt;&lt;br /&gt;
&lt;font size="2"&gt;&lt;a href="https://www.zeroscience.mk"&gt;https://www.zeroscience.mk&lt;/a&gt;&lt;/font&gt;
&lt;/font&gt;&lt;/center&gt;
&lt;/body&gt;&lt;/html&gt;