exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ACROS Security Problem Report 2005-05-24.1

ACROS Security Problem Report 2005-05-24.1
Posted Aug 14, 2005
Authored by Mitja Kolsek, ACROS Security | Site acrossecurity.com

WebLogic Server and WebLogic Express, Service Pack 4, are susceptible to cross site scripting flaws.

tags | advisory, xss
SHA-256 | 2619b3310f3c47e89eec1626a229bb5d830f5decc8011308daf41b04d6db1c6a

ACROS Security Problem Report 2005-05-24.1

Change Mirror Download


ACROS Security Problem Report #2005-05-24-1
ASPR #2005-05-24-1: HTML Injection in BEA WebLogic Server Console (1)

Document ID: ASPR #2005-05-24-1-PUB
Vendor: BEA Systems (http://www.bea.com)
Target: WebLogic Server and WebLogic Express, Service Pack 4
Impact: An HTML injection vulnerability exists in WebLogic
Server Console, enabling attackers to hijack
administrative sessions using cross site scripting
Severity: High
Status: Official patch available, workarounds available
Discovered by: Mitja Kolsek of ACROS Security

Current version


There is an HTML Injection vulnerability in WebLogic Server and WebLogic
Express Server Console that allows the attacker to assume administrator's
identity and thus gain administrative access to Server Console. It is
possible to craft such URL that will, when requested from WebLogic server,
return a document with arbitrarily chosen HTML injected. An obvious
(mis)use for this type of vulnerability is cross-site scripting that can
be used, among other things, for obtaining administrative session cookies
from WebLogic administrators. These cookies, when stolen, provide the
attacker with administrative access to WebLogic Server Console,
compromising the security of entire web server.

Product Coverage

- WebLogic Server 8.1, Service Pack 4 - affected
- WebLogic Express 7.0, Service Pack 6 - affected

Older versions are likely to be affected as well.


Cross site scripting is a very common problem with web-based applications.
Basically it is present whenever the server is willing to include user's
input data, which contains some client-side script (e.g. JavaScript), back
to the browser unsanitized, somewhere within the generated web page. This
script, when executed, has access to all information within and about the
received web page, including the cookies.

WebLogic Server Console employs an ADMINCONSOLESESSION session cookie for
administrative session maintenance. After administrator's initial
connection to the Server Console, WebLogic server generates a unique
session identifier (session ID) and sends it to administrator's browser as
a cookie named ADMINCONSOLESESSION. This session ID effectively becomes a
static password for the session, meaning that until the session times out
or is closed by the logged in administrator (by logging off), any browser
with access to port 7001/7002 of WebLogic server and knowledge of the
session ID will have access to this session, and thereby access to
administration of WebLogic application server.

Mitigating Factors

1) Attacker must lure the WebLogic administrator into visiting a hostile
web site while he (admin) has an authenticated session with the
WebLogic Server Console.


BEA Systems has issued a security bulletin [1] and published a patch
which fixes this issue.


- Don't browse around or read HTML e-mail while administering WebLogic
- Always close all browser instances/windows before logging in to
WebLogic Server Console.


[1] BEA Systems Security Advisory BEA05-80.00


We would like to acknowledge Gordon Engel of BEA Systems for extremely
diligent and professional handling of the identified vulnerability.


ACROS d.o.o.
Makedonska ulica 113
SI - 2000 Maribor

e-mail: security@acrossecurity.com
web: http://www.acrossecurity.com
phone: +386 2 3000 280
fax: +386 2 3000 282

ACROS Security PGP Key
[Fingerprint: FE9E 0CFB CE41 36B0 4720 C4F1 38A3 F7DD]

ACROS Security Advisories

ACROS Security Papers

ASPR Notification and Publishing Policy


The content of this report is purely informational and meant only for the
purpose of education and protection. ACROS d.o.o. shall in no event be
liable for any damage whatsoever, direct or implied, arising from use or
spread of this information. All identifiers (hostnames, IP addresses,
company names, individual names etc.) used in examples and demonstrations
are used only for explanatory purposes and have no connection with any
real host, company or individual. In no event should it be assumed that
use of these names means specific hosts, companies or individuals are
vulnerable to any attacks nor does it mean that they consent to being used
in any vulnerability tests. The use of information in this report is
entirely at user's risk.

Revision History

May 24, 2005: Initial release


(c) 2005 ACROS d.o.o. Forwarding and publishing of this document is
permitted providing the content between "[BEGIN-ACROS-REPORT]" and
"[END-ACROS-REPORT]" marks remains unchanged.


Login or Register to add favorites

File Archive:

December 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    2 Files
  • 2
    Dec 2nd
    12 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    14 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By