mailing list archives
paros proxy v3.2.5 and below blank "sa" password
From: Andrew Christensen <anc () fortconsult net>
Date: Wed, 19 Oct 2005 16:14:03 +0200
Title: Paros proxy 3.2.5 and below blank "sa" database password
Paros is an intercepting HTTP/HTTPS proxy for use in security
testing web applications.
Paros version 3.2.5 and below may contain a flaw where a remote
attacker can connect to a
database port opened on the machine running Paros, without
supplying any credentials.
The problem stems from use of a blank "sa" password on the
open-source database ("HSQLDB")
which is integrated with Paros.
The database server (which is written in Java) contains
functionality for executing arbitrary Java
statements. This is how HSQLDB provides Stored Procedure
Impact of successful exploitation:
The issue may result in disclosure of confidential data, and
possible execution of commands on
the victim machine.
A remote attacker may find credentials for web applications, valid
session IDs, and confidential
data downloaded from the website being tested with Paros. This
information is is present in the
Additionally, the possibility of executing Java statements on the
database server may mean that
an attacker can gain access to files or execute command at the OS
level (by performing the
Java equivalent of a "system()" call). This has not been
investigated fully, but appears possible.
The overall time-to-correction was EXCEEDINGLY fast:
October 3rd 2005: Problem discovered / reported
October 7th 2005: Issue re-reported via sourceforge, as mail
appeared lost in transit
October 7th 2005: Paros developer releases updated version
where DB listes on localhost only
Upgrade to version 3.2.6.
Firewall the host running Paros.
To demonstrate this, first start Paros on the victim host (here,
On the attacking host, ensure HSQLDB is installed, and add the following
lines to the file
$HOME/sqltool.rc on the attacking host:
# connect to victimhost as sa, victimhost has IP 192.168.0.1
To connect using the "victimhost-sa" block above run:
java -jar $HSQLDB_HOME/jsqldb.jar victimhost-sa
At this point, it is possible to pull data from the tables in the database
(browsing state, history, credentials).
The page at http://hsqldb.org/doc/guide/ch09.html#call-section also states
it is possible to execute Java statements
by writing them in the format "java.lang.Math.sqrt"(2.0).
2400 København NV
tlf. (+45) 7020 7525
FortConsult er som de første i Skandinavien blevet certificeret af VISA og
MasterCard til at udføre sikkerhedsgennemgange af virksomheders kritiske
FortConsult is the only Scandinavian firm certified by VISA to perform
security audits on critical card-payment systems.
Description: S/MIME Cryptographic Signature
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- paros proxy v3.2.5 and below blank "sa" password Andrew Christensen (Oct 19)