From: 3APA3A <3APA3A () SECURITY NNOV RU>
Reply-To: 3APA3A <3APA3A () SECURITY NNOV RU>
To: bugTraq <bugtraq () securityfocus com>, full-disclosure () lists grok org uk
Subject: [Full-disclosure] SPIDynamics WebInspect
Date: Tue, 26 Jul 2005 13:45:29 +0400
Cross application scripting attacks (data obtained from untrusted
source is sent unfiltered from trusted application to browser) in
different applications are reported by anonymous author.
In Russian version of article "XSS - WEB = Cross-Applications
Scripting" (signed (c)oded by QQLan () yandex ru)
there are remote cross-application scripting attack in SPIDynamics
WebInspect and domain level cross-application attack with potential
privilege escalation for user with limited delegated control under OU
to domain administrator account is also described for Windows domain
group policy editor (gpedit.msc) under Windows XP and Windows Server
Below is original anonymous report for cross application scripting in
SPIDynamics WebInspect Cross-Application Scripting (XAS)
SPIDynamics WebInspect is powerful security assessment tool for Web
application vulnerable to XAS which
could lead to remote code execution.
As many applications WebInspect uses external programs and Windows
components for different purposes.
It is very common to use COM object of Internet Explorer for render reports
and displays data. WebInspect
in not an exception.
When reports is generated, some parts of scanned site (for example URLs)
are included into HTML file
which opens in IE.
Because WebInspect doesn't properly normalize displayed data, part of URL
or other data can be parsed by IE
computer where scanner is installed.
Successful exploitation allows remote attackers to execute arbitrary script
code on the host, where
scanner is installed with privileges of user who launch the scanner. Victim
should scan site and open
Typically scanner runs on administrator's or security auditor's box with a
lot of interesting data.
It possibly runs under high-privileged account.
Attacker should create specially crafted site with vulnerability to be
displayed in report.
"Vulnerable" URL should include script code. Example of such report is a
"Hidden Form Value Vulnerability
By default script is executed in Internet Security Zone of IE (not sure).
But with little effort attacker
can use predictable resource location to bypass restrictions of Internet
Zone and execute script in "My
Computer" security zone.
Attacker can use social engineering to install full featured application,
for example new version of
"SPIDynamics Reported ActiveX".
Following asp file can be used to reproduce vulnerability:
if request.querystring<>"" then
method=get> Please login:<br>
<input type=submit value="Login"><br> <input type=hidden name='hidden'
You should change default error page to iisstart.asp (see screenshot in
attach). Scan results can be found
in attached files.
V. VENDOR RESPONSE
Initial vendor response received
VII. DISCLOSURE TIMELINE
04/15/2005 Initial vendor notification
04/15/2005 Initial vendor response
Disable Active Scripting in My Computer Zone
IX. LEGAL NOTICES
This advisory is being provided to you under the RFPolicy documented at
http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this
policy; however, in the interim,
you have approximately 5 days to respond to this initial email.
Thanks: 3APA3A for spellcheck & malware.com for some ideas.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/