Novell GroupWise WebAccess error modules loading

[Marc Ruef]

=20
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear ladies and gentlemen

We have found a potential security vulnerability in the Novell GroupWise =
WebAccess error module handling. First of all it is possible to =
circumvent the login procedure. If a user connects to =
https://www.scip.com:1444/servlet/webacc (this is just an example with =
our domain) he is able to authenticate with his user name and password. =
If a wrong input is made, the webacc application is loading the error =
page. It is possible to specify another error document with the =
$QUERY_STRING variant error. If this reference is done for the webacc =
itself - the url https://www.scip.com:1444/servlet/webacc?error=3Dwebacc =
would be required -, the login is circumvented. You are always logged in =
with a "ghost user" without a profile. It seems not to be possible to =
load and store data or to use other services (e.g. address book or =
sending email). It is also possible to reach specific template files =
with specification of their names (e.g. =
https://www.scip.com:1444/servlet/webacc?error=3Dsend for sending =
emails). Reaching other files than with the extension .htt or files =
outside the webserver root directory seems not possible. An attacker may =
use this vulnerability to exploit a bug that is only exploitable by =
authenticated users. More details on how this htt framework should be =
used can be found at =
http://developer.novell.com/ndk/doc/...3D/ndk/doc/gw=
wbacc/gwwebacc/data/a6l4t54.html - You find the original advisory, =
written in german, on =
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3D1020 (Novell GroupWise =
WebAccess error Authentisierung umgehen).

The second flaw depends on the first one. You are able to specify a =
(wrong) user name in the login screen. Afterwards you circumvent the =
authentication as described before. If you are opening the about screen =
(e.g. https://www.scip.com:1444/servlet/webacc?error=3Dabout or by =
clicking on the WebAccess logo on the top) in the Program Release line =
you see the version data of the GroupWise installation. The user name =
that has been specified in your last login procedure is printed on the =
Userid line. It may be possible to do html injection in this case. For =
example if the user name "<a href=3Dhttp://www.scip.ch>www.scip.ch</a>" =
has been used, this html link will be printed. The injection of scripts =
seems not to be possible because the required tags <script> and =
</script> are filtered/replaced. This vulnerability may be useful to =
gain the version data of the installation and it may be possible to =
realize a social engineering or html injection attack (e.g. loading a =
corrupt JPEG file to exploit the Windows buffer overflow). You find the =
original advisory, written in german, on =
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=3D1021 (Novell GroupWise =
WebAccess error about erweiterte Rechte).

We have not found any information on that issue. So I sent this =
information (nearly the same posting) on 14/12/04 to info@novell.com and =
asked for a solution. As I haven't heard _anything_ until 23/12/04 I =
sent a reminder email to the same address. So no reply came back we made =
this vulnerability public finally to force Novell to react on this case. =
An Attack Tool Kit (ATK) plugin that addresses this vulnerability will =
be published in the next days[1].

Regards,

Marc Ruef

[1] http://www.computec.ch/projekte/atk/

- --=20
) scip AG (
Technoparkstr. 1
8005 Z=FCrich
T +41 1 445 18 18=20
F +41 1 445 18 19

maru@scip.ch
www.scip.ch

- - Aktuellste IT-Sicherheitsluecken -

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
Comment: http://www.scip.ch

iQA/AwUBQevrDBe5hzJzqVMhEQJrtQCg041eH6NVBOQ+GPS5QudSw2 ARKAAAni/P
tTao1cSGtOUvnKKsqqH5/0Gs
=3DA+fy
-----END PGP SIGNATURE-----

[Jonathan Rockway]

> The injection of scripts seems not to be possible because the required
> tags <script> and </script> are filtered/replaced.

I found a similar hole in a piece of proprietary software that we use
at work (advisory pending, the vendor is trying to push patches to
other users).

Basically, the software filtered all input that had both a < and a >
(but not just a <). So I injected:

<body onload="alert('Security hole.')"

This resulted in a dialog box that said "Security hole." WITHOUT any
script tags (or indeed, without any well-formed HTML at all!).

I would be interested to hear whether or not Novell GroupWise filters
things like the above example.

Here's a full HTML file that, if loaded in Safari or Firefox, will
produce a dialog box:

--start--

<html><body>
Here is some text.

<!-- injected characters -->
<body onload="alert('Security hole!')"
<!-- end injected characters -->

<i>Blah blah blah</i>
</body>
</html>

--end--

Regards,
--
Jonathan Rockway <jrockway@computer.org>
Student - University of Illinois at Chicago