STG Security Advisory: JEUS Web Application Server Cross Site Scripting Vulnerability

["SSR Team" <advisory () stgsecurity com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

STG Security Advisory: JEUS Web Application Server Cross Site Scripting
Vulnerability

Revision: 1.0
Date Published: 2003-06-17 (KST)
Last Update: 2003-06-17

Product Description
=========
JEUS (Java Enterprise User Solution) is a J2EE compatible web application
server, developed by Tmax Soft, providing a  clustering system especially
designed for large enterprise business applications.

Vulnerability Class
================
Implementation Error: Inappropriate Input Validation

Affected Products
================
This vulnerability was found at JEUS 3.1.4p1. The vendor confirmed all
versions below 3.2.2 have this vulnerability.

Details
======
JEUS Web Application Server has a cross site scripting vulnerability
invoking a JavaScript as following:

Proof of Concept
http://vulnerable.com/url.jsp?foo=<script>alert('XSS vulnerability
exists!')</script>

An attacker could hijack the session of an administrator or spread viruses
or worms using vulnerabilities of Web browsers.

Impact
======
At August 2002, Eye on Security released an article entitled "Bypassing
JavaScript Filters - the Flash! Attack" on the  attacking method utilizing
cross site scripting vulnerabilities.  An attacker could use a highly
effective automated tool  using this method for session hijacking in the
wild to acquire the privilege of administrators and to alter or erase the
web  pages of an victim site.

Solutions
========
STG Security has notified this vulnerability to the vendor, which fixed this
problem and released JEUS 3.2.2 on October 2002.
Much detailed information is found at http://www.tmax.co.kr

Vendor Status: FIXED
===================
2002-10-12 Tmax Soft notified.
2002-10-17 Second attempt at vendor contact.
2002-10-17 Fixed version released.
2003-05-21 Last attempt at vendor contact.
2003-06-17 Public disclosure.

Credits
======
Jeremy Bae at STG Security SSR Team

About STG Security
=================
STG Security Inc. is a affiliated company of STG Group which has its head
office in the States founded in march 2000. Its  core business area is
Information Security Consulting Service based on 30 years of various
Information Security Consulting  experiences in the States including more
than 100 projects of Risk Assessment and Penetration testing implemented for
the  American government organizations. Also STG Group is a member company
to undertake Safeguard project which is government  Information Security
project initiated by the Clinton cabinet. Those experiences and
methodologies are applied to the Korean  Information Security market by STG
Security Inc.

http://www.stgsecurity.com/

Phone +82-2-6333-4500
FAX +82-2-6333-4545

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBPu5saT9dVHd/hpsuEQJ/IQCgocpu50rK+tqmlhQ9cS7vawtu1XMAn1uh
exTHNRRklHJVZ3XaYQzlIeCH
=8SZ9
-----END PGP SIGNATURE-----


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html