Home >> Vulnerabilities >> WebLogic SSRF And XSS (CVE-2014-4241, CVE-2014-4210, CVE-2014-4242)

Universal Description Discovery and Integration (UDDI) functionality often lurks unlinked but externally accessible on WebLogic servers. It’s trivially discoverable using fuzz lists such as Weblogic.fuzz.txt and was, until recently, vulnerable to Cross Site Scripting (XSS) and Server Side Request Forgery (SSRF). I reported these vulnerabilities to Oracle and they were patched in the July 2014 Critical Patch Update (CPU).

CVE-2014-4210 Server Side Request Forgery in SearchPublicRegistries.jsp

Affected Software: Oracle Fusion Middleware 10.0.2, 10.3.6

Oracle WebLogic web server is often both (a) externally accessible; and (b) permitted to invoke connections to internal hosts. The SearchPublicRegistries.jsp page can be abused by unauthenticated attackers to cause the WebLogic web server to connect to an arbitrary TCP port of an arbitrary host. Responses returned are fairly verbose and can be used to infer whether a service is listening on the port specified.

Example 1: Below is an example request to an internal host which is not listening on TCP port 23:

Response snippet:

Example 2: Below is an example request to a host which is listening on TCP port 22:

Response snippet:

As you can see it is possible to abuse this functionality to discover and port scan any host that the WebLogic server can access. In the event that a discovered service returns a valid SOAP response, it may be possible to view the contents of the response.

SSRF vulnerabilities offer a world of possibilities – for example, this could be used to scan for services and resources present on the WebLogic server’s loopback interface, to port scan hosts adjacent to the WebLogic server, or to profile outgoing firewall rules (e.g. port scan an external attacker-controlled server to see which outgoing connections are permitted).

CVE-2014-4241 – Reflected Cross Site Scripting in SetupUDDIExplorer.jsp

Affected software: Oracle Fusion Middleware 10.0.2, 10.3.6

User input is reflected into a cookie value (which is set for a year!). This value  is then written into subsequent responses in an unsafe manner, exposing users to Cross Site scripting attacks.

This unusual vector circumvents current in-browser anti-XSS controls present in Internet Explorer and Chrome browsers. The vulnerability was present in registration.paypal.com, payflowlink.paypal.com and partnermanager.paypal.com; all were swiftly fixed after I reported this to the PayPal security team.

Reflected XSS in registration.paypal.com

Example 3: Malicious URL:

The response sets the privateregistry parameter value previously supplied as a cookie, and redirects the browser back to the SetupUDDIExplorer.jsp page:

Redirected Request:

Response Snippet (showing the privateinquiryurls cookie value reflected in an unsafe manner in the response):

Example 4: Proof of Concept URLs:

CVE-2014-4242 – Reflected Cross Site Scripting in consolejndi.portal

Affected Software: Oracle Fusion Middleware 10.0.2, 10.3.6, 12.1.1, 12.1.2.0.0

I’ve also identified two reflected XSS vulnerabilities in WebLogic’s consoleapplication. The console application is intended to manage the WebLogic application server and is not normally externally exposed; as a result, exploitation of this vulnerability would be targeted at admin users.

Example 5: Proof of Concept URL #1 (victim must be authenticated to the administrative console):

Response Snippet:

Example 6: Proof of Concept URL #2 (victim must be authenticated to the administrative console):

Response Snippet:

Remediation

Remove access to UDDI functionality, unless there is business case to support exposing it. Failing that, ensure that the July 2014 CPU has been applied.

Disclosure Timeline
01/12/2013 – Vulnerability Reported
07/16/2014 – Vulnerability Patch Released in Oracle Critical Patch Update (CPU)

 

the author

Leave a Reply

Your email address will not be published. Required fields are marked *

Top