0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Oracle WebCenter Sites Satellite Server - HTTP Header Injection
Author
Risk
[
Security Risk High
]0day-ID
Category
Date add
CVE
Platform
Vendor description: ------------------- FatWire Satellite Server is a predecessor product of Oracle WebCenter Sites Satellite Server. "Oracle WebCenter Sites Satellite Server enables organizations to deliver segmented, targeted, and dynamically assembled content across global Web properties with rapid response times and intelligent edge caching to optimize and speed the delivery of dynamic Web experiences." Source: http://www.oracle.com/us/products/middleware/webcenter/satellite-server/overview/index.html Vulnerability overview/description: ----------------------------------- Due to unsanitized user input it is possible to inject arbitrary HTTP header values in certain HTTP responses of the Satellite Server. This can be exploited, for example, to perform session fixation and malicious redirection attacks via the Set-Cookie and the Refresh headers. Moreover, the Satellite Server caches these HTTP responses with the injected HTTP header resulting in all further requests to the same resource being served with the poisoned HTTP response, while these objects remain in cache. Proof of concept: ----------------- An arbitrary header can be injected in the HTTP responses of the downloadable resources. The values of the blobheadername2 and the blobheadervalue2 URL parameters are user controllable. In the following example the Refresh header is injected: http://fatwire/cs/Satellite?blobcol=urldata&blobheadername1=content-type&blobheadername2=Refresh& blobheadervalue1=application/pdf&blobheadervalue2=0;url=http://www.sec-consult.com&blobkey=id& blobnocache=false&blobtable=MungoBlobs&blobwhere=1342534304149&ssbinary=true&site=S08 The returned HTTP response will contain the injected Refresh header and its value. Furthermore, the HTTP response will be cached, so the next time users will be accessing the same downloadable resource using the standard URL, they will be affected and redirected using the injected Refresh header value. HTTP/1.1 200 OK Date: Thu, 06 Sep 2012 15:59:04 GMT Refresh: 0;url=http://www.sec-consult.com Last-Modified: Thu, 06 Sep 2012 15:54:20 GMT Content-Type: application/pdf Connection: close Content-Length: 772193 Vulnerable / tested versions: ----------------------------- The following installation has been tested: * FatWire Satellite Server 7.6.0 Patch1. Vendor contact timeline: ------------------------ 2012-11-26: Contacting vendor through secalert_us@oracle.com 2012-11-26: Vendor response, will investigate issues 2012-11-27: Investigation ongoing, the following ID assigned: S0321206 - ARBITRARY HTTP HEADER INJECTION/CACHE POISONING IN FATWIRE 2013-01-25: S0321206 Issue fixed in main codeline, scheduled for a future CPU 2013-04-12: S0321206 is fixed in upcoming CPU on 2013-04-16 2013-04-16: Oracle releases April 2013 CPU 2013-04-17: Public release of SEC Consult advisory Solution: --------- Apply latest patches, see: http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html # 0day.today [2024-12-25] #