STG Security Advisory: JEUS Web Application Server Cross Site Scripting Vulnerability

Revision: 1.1
Date Published: 2003-06-17 (KST)
Last Update: 2003-06-17

Product Description
=========
JEUS (Java Enterprise User Solution) is a J2EE compatible web application server, developed by Tmax Soft, providing a clustering system especially designed for large enterprise business applications. 

Vulnerability Class
================
Implementation Error: Inappropriate Input Validation

Afftected Products
================
This vulnerability was found at JEUS 3.1.4p1. The vendor confirmed all versions below 3.2.2 have this vulnerability.

Details
======
JEUS Web Application Server Error Page has a cross site scripting vulnerability issue when Invoking non-exists URL like below.

Proof of Concept
http://vulnerable.com/url.jsp?foo=<script>alert('XSS vulerability exists!')</script>

An attacker could hijack the session of an administrator or spread viruses or worms using vulnerabilities of Web browsers.

Impact
======
At August 2002, Eye on Security released an article entitled "Bypassing JavaScript Filters - the Flash! Attack" on the attacking method utilizing cross site scripting vulnerabilities.  A highly effective automated tool using this method for session hijacking in the wild enables an attacker to aquire the privilege of administrators and to alter or erase the web page of an victim site.

Solutions
========
STG Security has notified this vulnerability to the vendor, which fixed this problem and released JEUS 3.2.2 on October 2002.
More detail information is found at http://www.tmax.co.kr

Vendor Status: FIXED
===================
2002-10-12 Tmax Soft notified.
2002-10-17 Second attempt at vendor contact.
2002-10-17 Fixed version released.
2003-05-21 Last attempt at vendor contact.
2003-05-23 Public disclosure.

 

Credits
======
Jeremy Bae at STG Security SSR Team

About STG Security
=================
STG Security Inc. is a affiliated company of STG Group which has its head office in the States founded in march 2000. Its core business area is Information Security Consulting Service based on 30 years of various Information Security Consulting experiences in the States including more than 100 projects of Risk Assessment and Penetration testing implemented for the American government organizations. Also STG Group is a member company to undertake Safeguard project which is government Information Security project initiated by the Clinton cabinet. Those experiences and methodologies are applied to the Korean Information Security market by STG Security Inc.

http://www.stgsecurity.com/

Phone +82-2-6333-4500
FAX +82-2-6333-4545