var-200511-0078
Vulnerability from variot

frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter. It is reported that an attacker can exploit this issue by supplying the URI of a malicious site through the 'sap-exiturl' parameter. A successful attack may result in various attacks including theft of cookie-based authentication credentials. An attacker may also be able to exploit this vulnerability to enhance phishing style attacks. This issue only affects the BSP runtime of SAP WAS.

1) Input passed to the "sap-syscmd" parameter in "fameset.htm" and the "BspApplication" field in the "SYSTEM PUBLIC" test application isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Other versions may also be affected.

2) Input passed to the query string in pages generating error messages isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Prior versions may also be affected.

3) The problem is that an absolute URL for an external site can be specified in the "sapexiturl" parameter passed to "fameset.htm". This can be exploited to trick users into visiting a malicious web site by following a specially crafted link with a trusted hostname redirecting to the malicious web site. Other versions may also be affected.

4) Input passed to the "sap-exiturl" parameter isn't properly sanitised before being returned to the user. This can be exploited to inject arbitrary HTTP headers, which will be included in the response sent to the user. Other versions may also be affected.

SOLUTION: The vendor has reportedly provided a solution for the vulnerabilities. Customers should contact the SAP's support for further information.

PROVIDED AND/OR DISCOVERED BY: Leandro Meiners, Cybsec S.A.

ORIGINAL ADVISORY: http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Phishing_Vector_in_SAP_WAS.pdf http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200511-0078",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "web application server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "sap",
        "version": "7.0"
      },
      {
        "model": "web application server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "sap",
        "version": "6.40"
      },
      {
        "model": "web application server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "sap",
        "version": "6.20"
      },
      {
        "model": "web application server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "sap",
        "version": "6.10"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "15362"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3634"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Leandro Meiners",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2005-3634",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2005-3634",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2005-3634",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200511-180",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3634"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter. \nIt is reported that an attacker can exploit this issue by supplying the URI of a malicious site through the \u0027sap-exiturl\u0027 parameter. \nA successful attack may result in various attacks including theft of cookie-based authentication credentials.  An attacker may also be able to exploit this vulnerability to enhance phishing style attacks. \nThis issue only affects the BSP runtime of SAP WAS. \r\n\r\n1) Input passed to the \"sap-syscmd\" parameter in \"fameset.htm\" and\nthe \"BspApplication\" field in the \"SYSTEM PUBLIC\" test application\nisn\u0027t properly sanitised before being returned to the user. This can\nbe exploited to execute arbitrary HTML and script code in a user\u0027s\nbrowser session in context of an affected site. \nOther versions may also be affected. \r\n\r\n2) Input passed to the query string in pages generating error\nmessages isn\u0027t properly sanitised before being returned to the user. \nThis can be exploited to execute arbitrary HTML and script code in a\nuser\u0027s browser session in context of an affected site. Prior versions may also be\naffected. \r\n\r\n3) The problem is that an absolute URL for an external site can be\nspecified in the \"sapexiturl\" parameter passed to \"fameset.htm\". This\ncan be exploited to trick users into visiting a malicious web site by\nfollowing a specially crafted link with a trusted hostname\nredirecting to the malicious web site. \nOther versions may also be affected. \r\n\r\n4) Input passed to the \"sap-exiturl\" parameter isn\u0027t properly\nsanitised before being returned to the user. This can be exploited to\ninject arbitrary HTTP headers, which will be included in the response\nsent to the user. \nOther versions may also be affected. \n\nSOLUTION:\nThe vendor has reportedly provided a solution for the\nvulnerabilities. Customers should contact the SAP\u0027s support for\nfurther information. \n\nPROVIDED AND/OR DISCOVERED BY:\nLeandro Meiners, Cybsec S.A. \n\nORIGINAL ADVISORY:\nhttp://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf\r\nhttp://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Phishing_Vector_in_SAP_WAS.pdf\r\nhttp://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-3634"
      },
      {
        "db": "BID",
        "id": "15362"
      },
      {
        "db": "PACKETSTORM",
        "id": "41457"
      }
    ],
    "trust": 1.26
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "15362",
        "trust": 1.9
      },
      {
        "db": "SECUNIA",
        "id": "17515",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1015174",
        "trust": 1.6
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3634",
        "trust": 1.6
      },
      {
        "db": "SREASON",
        "id": "163",
        "trust": 1.6
      },
      {
        "db": "VUPEN",
        "id": "ADV-2005-2361",
        "trust": 1.6
      },
      {
        "db": "XF",
        "id": "23031",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "20051109 CYBSEC - SECURITY ADVISORY: PHISHING VECTOR IN SAP WAS",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "41457",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "15362"
      },
      {
        "db": "PACKETSTORM",
        "id": "41457"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3634"
      }
    ]
  },
  "id": "VAR-200511-0078",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.50441176
  },
  "last_update_date": "2024-11-23T22:15:24.865000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-3634"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://www.cybsec.com/vuln/cybsec_security_advisory_multiple_xss_in_sap_was.pdf"
      },
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/17515/"
      },
      {
        "trust": 1.6,
        "url": "http://www.securitytracker.com/alerts/2005/nov/1015174.html"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/15362"
      },
      {
        "trust": 1.6,
        "url": "http://securityreason.com/securityalert/163"
      },
      {
        "trust": 1.0,
        "url": "http://www.vupen.com/english/advisories/2005/2361"
      },
      {
        "trust": 1.0,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23031"
      },
      {
        "trust": 1.0,
        "url": "http://marc.info/?l=bugtraq\u0026m=113156525006667\u0026w=2"
      },
      {
        "trust": 0.6,
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=113156525006667\u0026w=2"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/23031"
      },
      {
        "trust": 0.6,
        "url": "http://www.frsirt.com/english/advisories/2005/2361"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/416150"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/6087/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://www.cybsec.com/vuln/cybsec_security_advisory_phishing_vector_in_sap_was.pdf"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/3327/"
      },
      {
        "trust": 0.1,
        "url": "http://www.cybsec.com/vuln/cybsec_security_advisory_http_response_splitting_in_sap_was.pdf"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "15362"
      },
      {
        "db": "PACKETSTORM",
        "id": "41457"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3634"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "15362"
      },
      {
        "db": "PACKETSTORM",
        "id": "41457"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3634"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2005-11-09T00:00:00",
        "db": "BID",
        "id": "15362"
      },
      {
        "date": "2005-11-10T23:56:45",
        "db": "PACKETSTORM",
        "id": "41457"
      },
      {
        "date": "2005-11-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      },
      {
        "date": "2005-11-16T21:22:00",
        "db": "NVD",
        "id": "CVE-2005-3634"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2005-11-09T00:00:00",
        "db": "BID",
        "id": "15362"
      },
      {
        "date": "2005-11-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      },
      {
        "date": "2024-11-21T00:02:18.413000",
        "db": "NVD",
        "id": "CVE-2005-3634"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP Web Application Server URI Redirecting vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "input validation",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-180"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.