Onderwerp: S21SEC-024 - Vignette TCL Injection

################################################## #############
ID: S21SEC-024-en
Title: Vignette TCL Injection
Date: 03/04/2003
Status: Vendor contacted and solution available
Scope: TCL code Execution, Remote command execution
Platforms: All
Author: rpinuaga
Location: http://www.s21sec.com/es/avisos/s21sec-024-en.txt
Release: External
################################################## #############

S 2 1 S E C

http://www.s21sec.com

Vignette TCL Injection


About Vignette
--------------

Vignette develops Content Management and Application Portal Software.


Description of vulnerability
----------------------------

Vignette Software presents a vulnerability in some propietary commands that permits the injection of TCL code under some circunstances.

The affected Vignette commands are:
- NEEDS
- VALID_PATHS


All the TCL templates or scripts, that use this commands, are vulnerable to remote code injection.

The source code of both commands is located in a file called "stdlib.tcl" at the Vignette library directory. The offending code is the following:

========== stdlib.tcl (Extracted from Vignette 5.6.3) ==========

-- Lines 1049/1053 (NEEDS command) --

SET cookieName "vgn_creds"
SET formPath [CURL /vgn/login]


SET queryString [SHOW HTTP_QUERY_STRING] <--- (!)


} elseif {[llength $args] < 2} {
error "Usage: NEEDS LOGIN cookieName URL\n"

--

-- Lines 1141/1146 (NEEDS command) --

} elseif {![string compare $arg "COOKIE"]} {
global _Cookie HTTP_COOKIE


regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString <--- (!)


set cookies [split $cookieString { }]
foreach c $cookies {

--

-- Lines 1272/1277 (VALID_PATHS command) --

global _Path
if {[info exists _Path] == 1 && [lsearch $paths $_Path] == -1} {


system_error "Invalid path \"$_Path\" for template (referer='[SHOW HTTP_REFERER]')" <--- (!)


}
return ""

--

=================================================


As seen, the value of some unfiltered variables is used and evaluated with the SHOW command. If the external variable contains Vignette code, then arbitrary TCL execution is posible. The affected input variables are:
- HTTP_QUERY_STRING, converted to queryString in NEEDS command.
- HTTP_COOKIE, converted to cookieString in NEEDS command.
- HTTP_REFERER, showed in VALID_PATHS command.


This three variables are received directly form the web client, and aren't sanitized in any way. If the Vignette/TCL escape characters are included "[" and "]" the code between them is evaluated as valid TCL code.

The VALID_PATHS command is very few used in Vignette Applications, but the NEEDS command is extensively used, even in the default Vignette templates. The following default installed templates are vulnerables and remotely exploitables:

/vgn/ac/edit - [NEEDS LOGIN]
/vgn/ac/index - [NEEDS LOGIN]
/vgn/vr/Editing - [NEEDS LOGIN]
/vgn/vr/Select - [NEEDS LOGIN]
/vgn/legacy/edit - [NEEDS LOGIN]
/vgn/ppstats - [NEEDS LOGIN]


It's important to note that the bug not only affect the default Vignette Applications, nor it affects all the applications developed over a Vignette Server Software, that use the affected commands.


Affected Versions and platforms
-------------------------------

This vulnerability has been tested in Vignette StoryServer 5, and Vignette V/6. But it seems that all currently avaliable versions are vulnerable.


Solution
--------

Replace the offending SHOW evaluations in stdlib.tcl with directly passed variables. For example:

instead: SET queryString [SHOW HTTP_QUERY_STRING]
use ==> SET queryString $HTTP_QUERY_STRING

instead: regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString
use ==> regsub -all {; } $HTTP_COOKIE { } cookieString

instead: system_error "Invalid path \"$_Path\" for template (referer='[SHOW HTTP_REFERER]')"
use ==> system_error "Invalid path \"$_Path\" for template (referer='$HTTP_REFERER')"

Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution.


Additional information
----------------------

These vulnerabilities have been found and researched by:

Ramon Pinuaga Cascales rpinuaga@s21sec.com

You can find the last version of this warning in:

http://www.s21sec.com/es/avisos/s21sec-024-en.txt

And other S21SEC warnings in http://www.s21sec.com/es/avisos/

Am Montag, 26.05.03, um 16:14 Uhr (Europe/Berlin) schrieb S21SEC:

> The affected Vignette commands are:
> - NEEDS
> - VALID_PATHS
>
> All the TCL templates or scripts, that use this commands, are=20
> vulnerable to remote code injection.

This is overly broad. The actual vulnerability depends on the code path=20=

taken in the NEEDS Tcl procedure.

> SET queryString [SHOW HTTP_QUERY_STRING] <---=20=

> (!)

This problematic line was already identified by Bas Scheffers (IIRC).
http://bas.scheffers.net/vgn-needs-login-exploit.html

> regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString =20=

> <--- (!)
>

> -- Lines 1272/1277 (VALID_PATHS command) --

> system_error "Invalid path \"$_Path\" for template (referer=3D'[SHOW=
=20
> HTTP_REFERER]')" <--- (!)

> As seen, the value of some unfiltered variables is used and evaluated=20=

> with the SHOW command. If the external variable contains Vignette=20
> code, then arbitrary TCL execution is posible. The affected input=20
> variables are:
> - HTTP_QUERY_STRING, converted to queryString in NEEDS command.
> - HTTP_COOKIE, converted to cookieString in NEEDS command.
> - HTTP_REFERER, showed in VALID_PATHS command.

This is incorrect. While this might enable XSS attacks, it does not=20
allow for Tcl code injection. The problematic command here is not SHOW,=20=

but SET.

A (simplified) version of the Vignette SET command would look like this:

proc SET {var val {noeval {}} {
if {$noeval !=3D "NOEVAL"} {
set val [EVAL $val]
}
namespace eval ::VgnDefaultNamespace [list set $var $val]
}

That is, unless a third argument of "NOEVAL" is passed to the SET=20
command, the value will be interpreted as a Vignette Tcl template=20
piece, and any Tcl command embedded in it in the form of "[code]" will=20=

be executed.


> Solution
> --------
>
> Replace the offending SHOW evaluations in stdlib.tcl with directly=20
> passed variables. For example:
>
> instead: SET queryString [SHOW HTTP_QUERY_STRING]
> use =3D=3D> SET queryString $HTTP_QUERY_STRING

This is incorrect, and will likely break your application.


--=20
Stefan Bethke <s.bethke@tallence.com>
Tallence GmbH, Steinh=F6ft 11, D-20459 Hamburg, Germany
Mobile +49 170 3460140, Office +49 40 36099860, Fax +49 40 36099869