RE: [Full-disclosure] SPIDynamics WebInspect Cross-ApplicationScripting (XAS)

["DAN MORRILL" <dan_20407 () msn com>]

Good Morning,

I got the official notice from SPI Dynamics to day on this issue. I am in no 
way slamming people at all, but the interesting response was inability to 
reproduce the XAS issue.

At what point and how much support should the discoverer give to the 
company? Usually when I have a bug report it is a full set of instructions 
on exactly how to reproduce the issue, from OS, software running in 
background, what I was clicking or typing at the time.

My question is that if we are submitting bug reports and POC code, just how 
much information do we give to the vendor, especially if they say that they 
can not reproduce it? If the vendor can not reproduce it, how much time and 
support should the discoverer give them?

Just a curiosity question based on the idea that we are all out there 
discovering things, that we will or will not give up to folks depending on 
what we discover. Its the inability to reproduce the issue that interests me 
the most, and what as a community should we do when no one else can verify 
our results? Well out side of providing POC code, that may or may not work.

R/Dan




Sometimes MSN E-mail will indicate that the mesasge failed to be delivered. 
Please resend when you get those, it does not mean that the mail box is bad, 
merely that MSN mail is over worked at the time.





> From: 3APA3A <3APA3A () SECURITY NNOV RU>
> Reply-To: 3APA3A <3APA3A () SECURITY NNOV RU>
> To: bugTraq <bugtraq () securityfocus com>, full-disclosure () lists grok org uk
> Subject: [Full-disclosure] SPIDynamics WebInspect 
> Cross-ApplicationScripting (XAS)
> Date: Tue, 26 Jul 2005 13:45:29 +0400
>
> Dear bugTraq,
>
>   Cross  application  scripting  attacks  (data  obtained from untrusted
>   source  is  sent  unfiltered  from  trusted application to browser) in
>   different applications are reported by anonymous author.
>
>   In  Russian  version  of  article  "XSS  -  WEB  =  Cross-Applications
>   Scripting" (signed (c)oded by QQLan () yandex ru)
>   http://www.security.nnov.ru/articles/xas/
>   there  are  remote  cross-application  scripting attack in SPIDynamics
>   WebInspect  and  domain  level cross-application attack with potential
>   privilege  escalation for user with limited delegated control under OU
>   to  domain  administrator account is also described for Windows domain
>   group  policy  editor (gpedit.msc) under Windows XP and Windows Server
>   2003.
>
>   Below  is original anonymous report for cross application scripting in
>   SPIDynamics WebInspect
>   (http://www.security.nnov.ru/Fnews30.html)
>
>
>
> SPIDynamics WebInspect Cross-Application Scripting (XAS)
>
> I. BACKGROUND
>
> SPIDynamics WebInspect is powerful security assessment tool for Web 
> application vulnerable to XAS which
> could lead to remote code execution.
>
> II. DESCRIPTION
>
> As many applications WebInspect uses external programs and Windows 
> components for different purposes.
> It is very common to use COM object of Internet Explorer for render reports 
> and displays data. WebInspect
> in not an exception.
> When reports is generated, some parts of scanned site (for example URLs) 
> are included into HTML file
> (file://C:\Program Files\SPIDynamics\WebInspect\Working\vulnerability.htm), 
> which opens in IE.
> Because WebInspect doesn't properly normalize displayed data, part of URL 
> or other data can be parsed by IE
> as DHTML, for example JavaScript, and leads to code execution on the 
> computer where scanner is installed.
>
> III. ANALYSIS
>
> Successful exploitation allows remote attackers to execute arbitrary script 
> code on the host, where
> scanner is installed with privileges of user who launch the scanner. Victim 
> should scan site and open
> report.
> Typically scanner runs on administrator's or security auditor's box with a 
> lot of interesting data.
> It possibly runs under high-privileged account.
> Attacker should create specially crafted site with vulnerability to be 
> displayed in report.
> "Vulnerable" URL should include script code. Example of such report is a 
> "Hidden Form Value Vulnerability
> ID: 4727".
> By default script is executed in Internet Security Zone of IE (not sure). 
> But with little effort attacker
> can use predictable resource location to bypass restrictions of Internet 
> Zone and execute script in "My
> Computer" security zone.
> Example:
>
>  <script>window.open('file://C:\\Program
> Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm')</script>
>
> Attacker can use social engineering to install full featured application, 
> for example new version of
> "SPIDynamics Reported ActiveX".
>
> IV. DETECTION/POC
>
> Following asp file can be used to reproduce vulnerability:
>
> <*****************iisstart.asp***********************>
>
> <HTML><HEAD><BODY>
> <%
> if request.querystring<>"" then
> response.write request.querystring
> end if
> %>
> <form action="script>/<script>window.open(%27file://C:\\Program
> Files\\SPIDynamics\\WebInspect\\Working\\vulnerability.htm%27)</script>" 
> method=get> Please login:<br>
> <input type=submit value="Login"><br> <input type=hidden name='hidden' 
> value="Login"><br> </form>
> </BODY></HTML>
>
> </*****************iisstart.asp***********************>
>
> You should change default error page to iisstart.asp (see screenshot in 
> attach). Scan results can be found
> in attached files.
>
> V. VENDOR RESPONSE
>
> Initial vendor response received
>
> VII. DISCLOSURE TIMELINE
>
> 04/15/2005 Initial vendor notification
> 04/15/2005 Initial vendor response
>
> VIII. WORKAROUND
>
> Disable Active Scripting in My  Computer Zone
> (http://support.microsoft.com/default.aspx?scid=kb;en;833633)
>
>
> IX. LEGAL NOTICES
>
> This advisory is being provided to you under the RFPolicy documented at
> http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this 
> policy; however, in the interim,
> you have approximately 5 days to respond to this initial email.
>
> Thanks: 3APA3A for spellcheck & malware.com for some ideas.
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/