Exploit-DB #33942
Description: IBM Algorithmics RICOS 4.5.0 < 4.7.0 - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2014-07-01
Author: SEC Consult

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SEC Consult Vulnerability Lab Security Advisory < 20140630-0 >
=======================================================================
              title: Multiple severe vulnerabilities
            product: IBM Algorithmics RICOS
 vulnerable version: 4.5.0 - 4.7.0
      fixed version: 4.7.0.03
         CVE number: CVE-2014-0894
                     CVE-2014-0871
                     CVE-2014-0870
                     CVE-2014-0869
                     CVE-2014-0868
                     CVE-2014-0867
                     CVE-2014-0866
                     CVE-2014-0865
                     CVE-2014-0864
             impact: critical
           homepage: http://www-01.ibm.com/software/analytics/algorithmics/
              found: 2013-12-19
                 by: A. Kolmann, V. Habsburg-Lothringen, F. Lukavsky
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com
=======================================================================

Vendor description:
- -------------------
IBM Algorithmics software enables financial institutions and corporate
treasuries to make risk-aware business decisions. Supported by a global
team of risk experts based in all major financial centers, IBM
Algorithmics solution offerings include market, credit and liquidity risk,
as well as collateral and capital management.

Source: http://www-01.ibm.com/software/analytics/algorithmics/

RICOS is a pre-deal limit management solution part of the Algo Suite.


Business recommendation:
- ------------------------
The identified vulnerabilities affect integrity and confidentiality of the
risk management system. SEC Consult does not recommend to rely on RICOS as
part of risk management until a thorough security review has been performed
by security professionals. As a workaround, access should be limited only to
trusted users internally and sample checks regarding the plausibility of limits
should be performed manually.


Vulnerability overview/description:
- -----------------------------------
1) Information Disclosure (PSIRT#1440 / CVE-2014-0871 / CVSS 4.3)
The Tomcat configuration discloses technical details within error messages to
the user, which allows an attacker to collect valuable data about the
environment of the solution.

2) Password Disclosure (PSIRT#1441 / CVE-2014-0894 / CVSS 3.5)
The password and the username of the backend database are disclosed in
clear-text to the user of the web application. This allows attackers to
directly connect to the backend database and manipulate arbitrary data stored
in the database (e.g. limits).

3) Non-permanent Cross-Site Scripting (PSIRT#1442 / CVE-2014-0870 / CVSS 4.3)
Several parameters in the RICOS web front end and the Blotter are not properly
sanitized and cause Cross-Site Scripting vulnerabilities. Attackers can steal
user sessions and impersonate other users while performing arbitrary actions
on behalf of the victim user.

4) Broken Encryption (PSIRT#1443 / CVE-2014-0869 / CVSS 4.3)
Weak cryptographic algorithms, being used to store and transfer
user's passwords, allow an attacker to retrieve the plain-text passwords
without further knowledge of cryptographic keys.

5) Manipulation of read-only data / dual control mechanism bypass (PSIRT#1444 / CVE-2014-0868 /
CVSS 3.5)
Several fields of stored data within RICOS are marked as read-only in the web
application, disallowing modification of certain fields. These checks are only
performed client-side, allowing an attacker to alter arbitrary data. An
attacker can create a limit, alter the username of the created limit and
confirm the limit himself, circumventing dual control mechanisms advertised by
RICOS.

6) Cross-Site Cookie Setting (PSIRT#1445 / CVE-2014-0867 / CVSS 4.3)
A vulnerable page in RICOS allows an attacker to set and overwrite arbitrary
cookies for a user that clicks on a manipulated link.

7) Plain-text submission of passwords (PSIRT#1446 / CVE-2014-0866 / CVSS 4.3)
The RICOS fat client submits user credentials in plain-text. An attacker with
access to the network communication can perform man-in-the-middle attacks and
steal user credentials.
This vulnerability also applies to the Blotter, where authentication is
performed unencrypted.

8) Client-side Input Validation (PSIRT#1447 / CVE-2014-0865 / CVSS 3.5)
The RICOS fat client performs input validation only client-side. This allows
an attacker to alter arbitrary data. An attacker can create a limit, alter
the username of the created limit and confirm the limit himself, circumventing
dual control mechanisms advertised by RICOS.

9) Cross-Site Request Forgery (PSIRT#1448 / CVE-2014-0864 / CVSS 4.3)
The web application does not verify that requests are made only from within
the web application, allowing an attacker to trick users into performing
requests to the web application. This allows an attacker to perform tasks on
behalf of the victim user like modifying limits.


Proof of concept:
- -----------------
1) Information Disclosure
The following URL causes a status 404, disclosing the Tomcat version:
https://ricos/ricos470/classes/

If control characters (i.e. \x00) are sent as part of the cookie, a stack trace
is triggered

2) Password Disclosure
The following request sent by the client during regular communication shows the
database connection settings including the username and the password in
clear-text.

POST /ricos470/Executer HTTP/1.1
Host: ricos

...SNIP...
<i n="URN" v=""/><i n="SecServiceURN" v="obsv2:ricos:20100"/><i n="SecSource" v="LM web"/><i
n="SecTimeout" v="7200"/><i n="AcsAutoReconnect" v="Y"/><i n="AcsFunctionLimits" v=""/></t><t
n="ObServer"><i n="UserId" v=""/><i n="Password" v=""/><i n="Host" v="ricos"/><i n="Port"
v="20100"/><i n="CollectionId" v=""/><i n="DbName" v="RICA"/><i n="Location" v="RICA"/><i
n="DbType" v="OR