Endeca Latitude 2.2.2 – Cross-Site Request Forgery
Advisory: Endeca Latitude Cross-Site Request Forgery RedTeam Pentesting discovered a Cross-Site Request Forgery (CSRF) vulnerability in Endeca Latitude. Using this vulnerability, an attacker might be able to change several different settings of the Endeca Latitude instance or disable it entirely. Details ======= Product: Endeca Latitude Affected Versions: 2.2.2, potentially others Fixed Versions: N/A Vulnerability Type: Cross-Site Request Forgery Security Risk: low Vendor URL: N/A Vendor Status: decided not to fix Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2013-002 Advisory Status: published CVE: CVE-2014-2399 CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2399 Introduction ============ Endeca Latitude is an enterprise data discovery platform for advanced, yet intuitive, exploration and analysis of complex and varied data. Information is loaded from disparate source systems and stored in a faceted data model that dynamically supports changing data. This integrated and enriched data is made available for search, discovery, and analysis via interactive and configurable applications. (from the vendor's homepage) More Details ============ Endeca Latitude offers administrators the ability to perform different administrative and configuration operations by accessing URLs. These URLs are not secured by a randomly generated token and therefore are prone to Cross-Site Request Forgery attacks. For example by accessing the URL http://example.com/admin?op=exit an administrator can shut down the Endeca Latitude instance. Several other URLs exist (as documented at [1] and [2]) which can be used to trigger operations such as flushing cashes or changing the logging settings. Proof of Concept ================ An attacker might prepare a website, which can trigger arbitrary functionality (see [1] and [2]) of an Endeca Latitude instance if someone opens the attacker's website in a browser that can reach Endeca Latitude. An easy way to implement this is to embed a hidden image into an arbitrary website which uses the corresponding URL as its source: <img src="http://example.com/admin?op=exit" style="display:hidden" /> <img src="http://example.com/config?op=log-disable" style="display:hidden" /> [...] Workaround ========== The vendor did not update the vulnerable software, but recommends to configure all installations to require mutual authentication using TLS certificates for both servers and clients, while discouraging users from installing said client certificates in browsers. Fix === Not available. The vendor did not update the vulnerable software to remedy this issue. Security Risk ============= The vulnerability can enable attackers to be able to interact with an Endeca Latitude instance in different ways. Possible attacks include the changing of settings as well as denying service by shutting down a running instance. Attackers mainly benefit from this vulnerability if the instance is not already available to them, but for example only to restricted IP addresses or after authentication. Since this makes it harder to identify potential target systems and the attack mainly allows to disturb the service until it is re-started, the risk of this vulnerability is considered to be low. Timeline ======== 2013-10-06 Vulnerability identified 2013-10-08 Customer approved disclosure to vendor 2013-10-15 Vendor notified 2013-10-17 Vendor responded that investigation/fixing is in progress 2014-02-24 Vendor responded that bug is fixed and scheduled for a future CPU 2014-03-13 Vendor responded with additional information about a potential workaround 2014-04-15 Vendor releases Critical Patch Update Advisory with little information on the proposed fix 2014-04-16 More information requested from vendor 2014-05-02 Vendor responds with updated information 2014-06-25 Advisory released References ========== [1] http://docs.oracle.com/cd/E29220_01/mdex.222/admin/toc.htm#List%20of%20administrative%20operations [2] http://docs.oracle.com/cd/E29220_01/mdex.222/admin/toc.htm#List%20of%20supported%20logging%20variables RedTeam Pentesting GmbH ======================= RedTeam Pentesting offers individual penetration tests, short pentests, performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately. As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security related areas. The results are made available as public security advisories. More information about RedTeam Pentesting can be found at https://www.redteam-pentesting.de. -- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Geschäftsführer: Patrick Hof, Jens Liebchen |