Vulnerability in web interface

[RhysBurkitt]

Hi just ran a vulnerability scan over Octopussy and received the following issues, some which I think are similar to the ones I reported about 2 years ago which you promptly resolved.

Regards

Description At least one web application hosted on the remote web server discloses the physical path to its directories when a malformed request is sent to it.

Leaking this kind of information may help an attacker fine-tune attacks against the application and its backend. Solution Filter error messages containing path information.

The request GET /login.asp?redirect=index.asp?login=%0Acat%20/etc/passwd HTTP/1.1 Host: SERVERIP:8888 Accept-Charset: iso-8859-1,utf-8;q=0.9,;q=0.1 Accept-Language: en Connection: Keep-Alive Cookie: session-id=0224f3728c3a27abebe6cfa82d613a7e User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) Pragma: no-cache Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, */

produces the following path information :

Description The remote web server hosts CGI scripts that fail to adequately sanitize request strings with malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML to be executed in a user's browser within the security context of the affected site.

The remote web server may be vulnerable to IFRAME injections or cross-site scripting attacks :

• IFRAME injections allow 'virtual defacement' that might scare or anger gullible users. Such injections are sometimes implemented for 'phishing' attacks.
• XSS are extensively tested by four other scripts.
• Some applications (e.g. web forums) authorize a subset of HTML without any ill effect. In this case, ignore this warning. Solution Either restrict access to the vulnerable application or contact the vendor for an update.

Using the GET HTTP method, Nessus found that :

• The following resources may be vulnerable to HTML injection :
• The 'login' parameter of the /login.asp?redirect=index.asp CGI :

/login.asp?redirect=index.asp?login=<"yehopz%20>

-------- output --------

">

---

• The 'password' parameter of the /login.asp?redirect=index.asp CGI :

/login.asp?redirect=index.asp?password=<"yehopz%20>

-------- output --------

">

---

• The 'submit' parameter of the /login.asp?redirect=index.asp CGI :

/login.asp?redirect=index.asp?submit=<"yehopz%20>

-------- output --------

">

---

• The 'login' parameter of the /login.asp?redirect=index.asp CGI :

/login.asp?redirect=index.asp?login=<"yehopz%20>&password=&submit=Connec t%20to%20Octopussy

-------- output --------

">

---

Description The remote web server hosts CGI scripts that fail to adequately sanitize request strings of malicious JavaScript. By leveraging this issue, an attacker may be able to cause arbitrary HTML and script code to be executed in a user's browser within the security context of the affected site. These XSS are likely to be 'non-persistent' or 'reflected'. Solution Restrict access to the vulnerable application. Contact the vendor for a patch or upgrade.

Using the GET HTTP method, Nessus found that :

• The following resources may be vulnerable to cross-site scripting (comprehensive test) :
• The 'submit' parameter of the /login.asp?redirect=index.asp CGI :

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<&submit=C onnect%20to%20Octopussy

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E

-------- output --------

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&submit=Connect%20to %20Octopussy

-------- output --------

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>&submit=C onnect%20to%20Octopussy

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E

-------- output --------

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E&submit=Connect%20to%20Octopussy

-------- output --------

---

• The 'password' parameter of the /login.asp?redirect=index.asp CGI :

/login.asp?redirect=index.asp?password=>>>>>>>>>>foo"bar'207<<<<<

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?password=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?password=>>>>>>>>>>foo"bar'207<<<<<&passwo rd=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?password=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?password=%FF%FE%3C%73%63%72%69%70%74%3E%61 %6C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E

-------- output --------

---

/login.asp?redirect=index.asp?password=%FF%FE%3C%73%63%72%69%70%74%3E%61 %6C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&password=

-------- output --------

---

/login.asp?redirect=index.asp?password=<<<<<<<<<<foo"bar'204>>>>>

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?password=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?password=<<<<<<<<<<foo"bar'204>>>>>&passwo rd=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?password=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?password=%3Cscript%3Ealert(216)%3B%3C%2Fsc ript%3E

-------- output --------

---

/login.asp?redirect=index.asp?password=%3Cscript%3Ealert(216)%3B%3C%2Fsc ript%3E&password=

-------- output --------

---

• The 'login' parameter of the /login.asp?redirect=index.asp CGI :

/login.asp?redirect=index.asp?login=>>>>>>>>>>foo"bar'207<<<<<

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?login=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?login=>>>>>>>>>>foo"bar'207<<<<<&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?login=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?login=%FF%FE%3C%73%63%72%69%70%74%3E%61%6C %65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E

-------- output --------

---

/login.asp?redirect=index.asp?login=%FF%FE%3C%73%63%72%69%70%74%3E%61%6C %65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&login=

-------- output --------

---

/login.asp?redirect=index.asp?login=<<<<<<<<<<foo"bar'204>>>>>

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?login=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?login=<<<<<<<<<<foo"bar'204>>>>>&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?login=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?login=%3Cscript%3Ealert(216)%3B%3C%2Fscrip t%3E

-------- output --------

---

/login.asp?redirect=index.asp?login=%3Cscript%3Ealert(216)%3B%3C%2Fscrip t%3E&login=

-------- output --------

---

• The 'submit' parameter of the /login.asp?redirect=index.asp CGI :

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<&password =&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<&password =&login=g9PKAwJo

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<&password =g9PKAwJo&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<&password =g9PKAwJo&login=g9PKAwJo

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<&submit=C onnect%20to%20Octopussy&password=&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<&submit=C onnect%20to%20Octopussy&password=&login=g9PKAwJo

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<&submit=C onnect%20to%20Octopussy&password=g9PKAwJo&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=>>>>>>>>>>foo"bar'207<<<<<&submit=C onnect%20to%20Octopussy&password=g9PKAwJo&login=g9PKAwJo

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=>>>>>>>>>>foo"bar'207<<<<<">

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&password=&login=

-------- output --------

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&password=&login=g9P KAwJo

-------- output --------

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&password=g9PKAwJo&l ogin=

-------- output --------

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&password=g9PKAwJo&l ogin=g9PKAwJo

-------- output --------

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&submit=Connect%20to %20Octopussy&password=&login=

-------- output --------

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&submit=Connect%20to %20Octopussy&password=&login=g9PKAwJo

-------- output --------

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&submit=Connect%20to %20Octopussy&password=g9PKAwJo&login=

-------- output --------

---

/login.asp?redirect=index.asp?submit=%FF%FE%3C%73%63%72%69%70%74%3E%61%6 C%65%72%74%28%32%30%33%29%3C%2F%73%63%72%69%70%74%3E&submit=Connect%20to %20Octopussy&password=g9PKAwJo&login=g9PKAwJo

-------- output --------

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>&password =&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>&password =&login=g9PKAwJo

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>&password =g9PKAwJo&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>&password =g9PKAwJo&login=g9PKAwJo

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>&submit=C onnect%20to%20Octopussy&password=&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>&submit=C onnect%20to%20Octopussy&password=&login=g9PKAwJo

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>&submit=C onnect%20to%20Octopussy&password=g9PKAwJo&login=

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=<<<<<<<<<<foo"bar'204>>>>>&submit=C onnect%20to%20Octopussy&password=g9PKAwJo&login=g9PKAwJo

-------- output --------

<form name="unknown" method="POST" action="./login.asp?redirect=index.as p?submit=<<<<<<<<<<foo"bar'204>>>>>">

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E&password=&login=

-------- output --------

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E&password=&login=g9PKAwJo

-------- output --------

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E&password=g9PKAwJo&login=

-------- output --------

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E&password=g9PKAwJo&login=g9PKAwJo

-------- output --------

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E&submit=Connect%20to%20Octopussy&password=&login=

-------- output --------

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E&submit=Connect%20to%20Octopussy&password=&login=g9PKAwJo

-------- output --------

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E&submit=Connect%20to%20Octopussy&password=g9PKAwJo&login=

-------- output --------

---

/login.asp?redirect=index.asp?submit=%3Cscript%3Ealert(216)%3B%3C%2Fscri pt%3E&submit=Connect%20to%20Octopussy&password=g9PKAwJo&login=g9PKAwJo

-------- output --------

---

[sebthebert]

Hi,

I will take a look at this security issue tonight or tomorrow and provide a fix quickly.

Which vulnerability scanner did you use ? Nexus ?

[RhysBurkitt]

Hi that was fast!

Yes I used the latest version of Nessus Last time I posted when you was source forge I had the option to make the bug post private so no one could see the content but I could not find an option to do on Github, so apologies for posting it in the open before you have had a chance to look at it.

Regards

Rhys Burkitt IT Systems Administrator

Polestar Applied Solutions

t: +44 (0)1623 727500 f: +44 (0)1623 727501 m: +44 (0)7949 006432 e: rhys.burkitt@polestarappliedsolutions.com

mailto:rhys.burkitt@polestarappliedsolutions.comwww.polestar-group.comhttp://www.polestar-group.com/

Think of the environment - Do you need to print this email?

Registered company: Polestar UK Print Limited, 1 Apex Business Park, Boscombe Road, Dunstable, Bedfordshire, LU5 4SB Tel: +44 (0)1582 678900. Registered in England and Wales. Company Number: 5674948 Security & Confidentiality: This email may contain confidential information and/or copyright material.This email is intended for the use of the addressee only.Any unauthorised use may be unlawful. If you receive this email by mistake, please advise the sender immediately by using the reply facility in your email software.

From: Sebastien Thebert [mailto:notifications@github.com] Sent: 19 February 2014 15:58 To: sebthebert/Octopussy Cc: Rhys Burkitt Subject: Re: [Octopussy] Vulnerability in web interface (#579)

Hi,

I will take a look at this security issue tonight or tomorrow and provide a fix quickly.

Which vulnerability scanner did you use ? Nexus ?

— Reply to this email directly or view it on GitHubhttps://github.com/sebthebert/Octopussy/issues/579#issuecomment-35513669.

This email is UNCLASSIFIED unless stated otherwise.

[sebthebert]

Hi,

sorry for the delay, I worked on performance issues before that one.

Can you confirm that the fix that I just pushed fixed this issue ?

[sebthebert]

It's supposed to be fixed in Octopussy 1.0.12.

Reopen a ticket if not !