Applicure dotDefender 4.01-3 – Persistent Cross-Site Scripting
An advisory by EnableSecurity. ID: ES-20100601 Advisory URL: http://resources.enablesecurity.com/advisories/ES-20100601-dotdefender4.txt Affected Versions: version 4.0 Fixed versions: 4.01-3 (and later) Description: Applicure dotDefender is a Web Application Firewall that can be installed on Windows and Linux servers. From their website (applicure.com): "dotDefender is the market-leading software Web Application Firewall (WAF). dotDefender boasts enterprise-class security, advanced integration capabilities, easy maintenance and low total cost of ownership (TCO). dotDefender is the perfect choice for protecting your website and web applications today. " Credits: These vulnerabilities were discovered during WAF testing by Sandro Gauci of EnableSecurity. We contacted AppliCure on May 17, 2010 about this vulnerability. They were already working on a fix. ____________________________________________________________________________ Technical details: The log viewer facility in dotDefender does not properly htmlencode user supplied input. This leads to a cross site scripting vulnerability when the log viewer displays HTTP headers. ____________________________________________________________________________ Demo: One may use curl and insert headers containing html tags using the --header switch. Example: curl "http://website.org/c?a=<script>" \ --header "<script>alert(1)</script>: aa" When the administrator views the log viewer page, his/her web browser will execute the attacker's javascript. The following demo shows how an attacker can switch off dotDefender in order to bypass any "protection" offered by the WAF: http://vimeo.com/12132622 Timeline: May 17, 2010: Initial contact Jun 01, 2010: Release of this advisory Solution: Upgrade to the latest version of dotDefender: http://www.applicure.com/ |