Exploit-DB #10013
Description: Hyperic HQ 3.2 < 4.2-beta1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2009-10-02
Author: CoreLabs

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Core Security Technologies - CoreLabs Advisory
http://www.coresecurity.com/corelabs/
Hyperic HQ Multiple XSS

1. *Advisory Information*

Title: Hyperic HQ Multiple XSS
Advisory Id: CORE-2009-0812
Advisory URL:
http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=
advisory&name=Hyperic_HQ_Multiple_XSS
Date published: 2009-10-02
Date of last update: 2009-10-02
Vendors contacted: SpringSource
Release mode: Coordinated release

2. *Vulnerability Information*

Class: Cross site scripting [CWE-79]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
Bugtraq ID: N/A
CVE Name: CVE-2009-2897, CVE-2009-2898

3. *Vulnerability Description*

Hyperic HQ [1] is an open source monitoring software designed to
manage web applications and infrastructure. It auto-discovers system
resources (including hardware, operating systems and databases), and
is able to monitor hosts and services.

Multiple cross-site scripting vulnerabilities (both stored and
reflected) have been found in the web interface of Hyperic HQ, which
can be exploited by an attacker to execute arbitrary JavaScript code
in the context of the browser of a legitimate logged in user.

4. *Vulnerable packages*

. Hyperic HQ 3.2
. Hyperic HQ 4.0
. Hyperic HQ 4.1
. Hyperic HQ 4.2-beta1
. Earlier (unsupported) versions may also be affected.

5. *Non-vulnerable packages*

. Hyperic HQ 4.2-beta2 or later

6. *Vendor Information, Solutions and Workarounds*

6.1. *Mitigation*

. Users of Hyperic HQ 3.2.6 should apply the 3.2.6.1 patch.
. Users of Hyperic HQ 4.0 should upgrade to 4.0.3 and then apply
the 4.0.3.1 patch.
. Users of Hyperic HQ 4.1 should upgrade to 4.1.2 and then apply
the 4.1.2.1 patch.
. Users of Hyperic HQ 4.2-beta1 users should upgrade to 4.2-beta2
or later.

6.2. *Obtaining the security patches*

The security patches may be obtained from:

. http://download.hyperic.com/dl/patch/hq.jar.3.2.6.1.zip
. http://download.hyperic.com/dl/patch/hq.jar.4.0.3.1.zip
. http://download.hyperic.com/dl/patch/hq.jar.4.1.2.1.zip

6.3. *Applying the security patches*

The security patches may be applied by following these steps:

1. If you are not already running version 3.2.6, 4.0.3 or 4.1.2,
you must upgrade to one of these versions.
2. Download the zip file containing the appropriate patch for your
version.
3. Stop the Hypric HQ server.
4. Copy the original
'hq-engine/server/default/deploy/hq.ear/hq.jar' to a safe location
outside of the Hyperic HQ installation.
5. Copy the original
'hq-engine/server/default/deploy/hq.ear/hq.war/WEB-INF/lib/hq_jsp.jar'
to a safe location outside of the Hyperic HQ installation.
6. Extract the 'hq.jar' and 'hq_jsp.jar' files from the zip file.
7. Replace 'hq-engine/server/default/deploy/hq.ear/hq.jar' with the
'hq.jar' file you extracted in step 6.
8. Replace
'hq-engine/server/default/deploy/hq.ear/hq.war/WEB-INF/lib/hq_jsp.jar'
with the 'hq_jsp.jar' file you extracted in step 6.
9. Start the Hyperic HQ server.

Note: applying this patch will correct CVE-2009-2897 and CVE-2009-2898.

7. *Credits*

These vulnerabilities were discovered and researched by Gaston Rey and
Pablo Carballo from Core Security Technologies during Bugweek 2009 [2].

8. *Technical Description / Proof of Concept Code*

8.1. *Introduction*

Multiple cross-site scripting vulnerabilities (both stored and
reflected) have been found in the web interface of Hyperic HQ, which
can be exploited by an attacker to execute arbitrary JavaScript code
in the context of the browser of a legitimate logged in user.

8.2. *Reflected XSS Vulnerability (CVE-2009-2897)*

A reflected cross-site scripting vulnerability was found in the
generic exception handler of Hyperic, located in
'hq/web/common/GenericError.jsp'. When there is an uncatched exception
in Hyperic, this generic exception handler is invoked. It shows a
stack trace, including the data that caused the error without
sanitizing it, leading to a reflected XSS. This is the vulnerable code:

/-----
hq/web/common/GenericError.jsp:

...
<c:if test="${not empty exception}">
<div id="exception" style="visibility:hidden">
<%=StringUtil.getStackTrace(exception)%>
</div>
<c:if test="${not empty root}">
<div id="root" style="visibility:hidden">
<%=StringUtil.getStackTrace(root)%>
</div>
</c:if>
</c:if>
...
- -----/

This XSS can be triggered by sending invalid data for numeric
parameters in several '.do' pages, causing the webapp to raise a
'java.lang.NumberFormatException' exception; this way,
'GenericError.jsp' will be called and it will print the data that
caused the exception without escaping HTML characters, leading to the
XSS vulnerability.

The following '.do' pages are affected, among others:

/-----
http://<hyperic-server>:7080/mastheadAttach.do?typeId=<script>alert(docu
ment.cookie)</script>
http://<hyperic-server>:7080/Resource.do?eid=<script>alert(document.cook
ie)</script>
http://<hyperic-server>:7080/admin/user/UserAdmin.do?mode=view&u=<script
>alert(document.cookie)</script>

- -----/

8.3. *Stored XSS Vulnerability (CVE-2009-2898)*

A stored cross-site scripting vulnerability was found in the 'Alerts'
list of Hyperic HQ. An authenticated Hyperic user can create an alert
with JavaScript code in the 'Description' field. When a user visits
the 'Alerts' list, the 'Description' field of every alert is displayed
without properly escaping especial HTML characters, thus leading to a
persistent XSS.

As a proof of concept, create a new alert and insert the following
JavaScript code in the 'Description' field:

/-----
<script>alert(document.cookie)</script>
- -----/
Afterwards, when a Hyperic user visits the 'Alerts' list, the
JavaScript code embedded into the 'Description' of the malicious alert
will be executed:

/-----
http://<hyperic-server>:7080/alerts/Co