CIA RESEARCH

Alerts

[CIA-1040-Alert] IBM Websphere Insecure Sample Scripts allow Cross-Site Scripting and reveal valid user accounts.

Summary:

An input validation vulnerability in certain sample scripts that ship with IBM Websphere allow a remote attacker to conduct Cross-Site Scripting attacks against the server.

Technical Details:

The IBM Websphere server versions 6.0 ships with a number of sample scripts that contain security vulnerabilities. Sample scripts are usually placed on a server for demonstration purposes, but should be removed from production systems. Several Websphere scripts contain input validation flaws that allow an attacker to conduct Cross-Site Scripting (XSS) attacks against the server, possibly compromising the security of the server itself or any web applications that are installed. The following scripts are known to contain input validation flaws that enable script injection:

• PlantsByWebSphere/login.jsp
• /TechnologySample/BulletinBoard
• /TechnologySamples/Subscription/SubscriptionJSP.jsp
• /TechnologySamples/MovieReview2_1/

Cross-Site Scripting allows an attacker to perpetrate a large number of actions, including cookie-credential theft, as well as exploiting browser-based security holes when the injected script involves redirection.

Additionally, the PlantsByWebSphere/login.jsp page returns information during failed authentication attempts that permits an attacker to determine if the account for which credentials were supplied is a valid account on the system. This allows an attacker to mine the server for valid usernames, so that brute-force attacks against user accounts can be conducted.

Solution:

Contact the vendor for a security fix.
IBM WebSphere

CVE Reference:

GENERIC-MAP-NOMATCH

SecurityTracker Number(s):

1015360

Vendor URL:

IBM

About the Cenzic CIA Team:

Cenzic Intelligent Analysis (CIA) is Cenzic's research arm that focuses on continuous research for application vulnerabilities. Industry Research, Vulnerability assessment, penetration testing, and security testing - that's what Cenzic Intelligent Analysis Research is all about. Cenzic has dedicated experts whose sole job is to perform ongoing research to find not only common vulnerabilities but also vulnerabilities found in customer applications and make them available to our customers and to the community at large.

About Cenzic:

Cenzic provides Hailstorm® the revolutionary enterprise software suite for automated application security assessment and compliance that allows corporations and government organizations to dramatically improve the security of commercial and custom applications. Hailstorm enables security experts, QA professionals, and developers to work together to assess, analyze, and remediate applications for security vulnerabilities, and verify compliance with security policies. Benefits include reduced security risk and liability, lower development and testing costs, and faster time-to-market. Cenzic's customers are currently in the financial services and e-marketplaces sectors. For more information visit www.cenzic.com or call 1-866-4-CENZIC