Exploit-DB #8333
Description: Sun Calendar Express Web Server - Denial of Service / Cross-Site Scripting
Type: dos
Platform: multiple
Date: 2009-03-31
Author: Core Security

Exploit:
      Core Security Technologies - CoreLabs Advisory
           http://www.coresecurity.com/corelabs/


   Multiple vulnerabilities in Sun Calendar Express Web Server


1. *Advisory Information*

Title: Multiple vulnerabilities in Sun Calendar Express Web Server
Advisory ID: CORE-2009-0108
Advisory URL: http://www.coresecurity.com/content/sun-calendar-express
Date published: 2009-03-31
Date of last update: 2009-03-31
Vendors contacted: Sun Microsystems
Release mode: Coordinated release


2. *Vulnerability Information*

Class: Denial of service (DoS), Cross site scripting (XSS)
Remotely Exploitable: Yes
Locally Exploitable: No
Bugtraq ID: 34150, 34152, 34153
CVE Name: N/A


3. *Vulnerability Description*

Several vulnerabilities have been discovered in Sun Java System Calendar
Express web server [1]. First, an attacker can crash the web server
creating a Denial of Service condition by simply requesting certain URL
twice. Second, several Cross-site scripting vulnerabilities [2], [3]
were found in the following files/urls:

   1. 'https://<server>:3443/login.wcap'
   2. 'https://<server>:3443/command.shtml'

 Cross-site scripting (XSS) vulnerabilities allow an attacker to execute
arbitrary scripting code in the context of the user browser (in the
vulnerable application's domain). For example, an attacker could exploit
an XSS vulnerability to steal user cookies (and then impersonate the
legitimate user) or fake a page requesting information to the user (i.e.
credentials). This vulnerability occurs when user-supplied data is
displayed without encoding.


4. *Vulnerable packages*

   . Sun ONE Calendar Server 6.0
   . Sun Java System Calendar Server 6 2004Q2
   . Sun Java System Calendar Server 6 2005Q1
   . Sun Java System Calendar Server 6 2005Q4
   . Sun Java System Calendar Server 6.3
   . Sun Java System Calendar Server 6.3-7.01 (built Feb 20 2008)


5. *Vendor Information, Solutions and Workarounds*

Sun has published patches and a Sun alert for these vulnerabilities. The
Sun alert will be available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256228-1


6. *Credits*

These vulnerabilities were discovered by the SCS team from Core Security
Technologies.


7. *Technical Description / Proof of Concept Code*

Cross-Site Scripting (commonly referred to as XSS) bugs arise from a web
application's improper encoding or filtering of input obtained from
untrusted sources. These bugs allow an attacker to inject malicious tags
and/or script code that is later executed in the context of a web
browser when the user accesses the vulnerable web site. The injected
code then takes advantage of the trust relationship between the web
browser and the vulnerable web application. Attacks that exploit XSS
bugs are targeted at users of a vulnerable web application rather than
at the application itself, although one could say that since the XSS
vulnerability in the web application created the vector that allows the
compromise of several of its user's web browsers, the web application
itself originated the problem. The term 'cross-site scripting' is also
sometimes used in a broader-sense referring to different types of
vulnerabilities that lead to attacks that inject scripting code into
client applications from sources that would not be trusted during script
execution runtime if the corresponding bug did not exist. For additional
information, please look at the references [2], [3], [4], [5] and [6].


7.1. *Vulnerability #1 - XSS (BID 34152)*

Cross-site scripting vulnerabilities were found in the following file/url:

/-----------
https://<server>:3443/login.wcap
- -----------/

 This is the login page of the Sun Java System Calendar Express Web
application; although the affected URL is originally accessed through a
POST request, this vulnerability can be exploited both with a GET and
with a POST request.

Using the following variables:

/-----------
Fmt-out
- -----------/

 the contents of the variables previously mentioned are not being
encoded at the time of using them in HTML output, therefore allowing an
attacker who controls their content to insert javascript code.

The following code is a proof of concept of this flaw:

/-----------
https://<server>:3443/login.wcap?calid=&calname=&date=&fmt-out=<script>alert(document.cookie)</script>&view=&locale=&tzid=&test=[PII_REDACTED]14&user=test&password=test
- -----------/

*Note:* Fields previously listed were verified for this type of issue.
Other fields on this or other pages for this application could be also
vulnerable to the same type of issue.


7.2. *Vulnerability #2 - XSS (BID 34153)*

Cross-site scripting vulnerabilities were found in the following file/url:

/-----------
https://<server>:3443/command.shtml
- -----------/

 Using the following variables:

/-----------
date
- -----------/

 the contents of the 'date' variable are not being encoded at the time
Of using them in HTML output, therefore allowing an attacker who
controls their content to insert javascript code.

The following code is a proof of concept of this flaw:

/-----------
https://<server>:3443//command.shtml?view=overview&id=HK8CjQOkmbY&date=20081217T200734%27;alert('xss');//Z&caliad=someid@test.com&security=1
- -----------/

*Note:* Fields previously listed were verified for this type of issue.
Other fields on this or other pages for this application could be also
vulnerable to the same type of issue.


7.3. *Vulnerability #3 - DoS (BID 34150)*

An attacker can crash the Sun Java System Calendar Express web server
creating a Denial of Service condition by simply requesting certain URL
twice. Go to a browser and enter the following URL:

/-----------
https://<server>:3443/?tzid=crash
- -----------/

 where 'crash' can in fact be any string with alphabetic characters. The
first time you will receive an error. If at