Exploit-DB #17404
Description: IBM Websphere Application Server 7.0.0.13 - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2011-06-15
Author: Core Security

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

  Core Security Technologies - CoreLabs Advisory
       http://corelabs.coresecurity.com/

  IBM WebSphere Application Server Cross-Site Request Forgery


1. *Advisory Information*

Title: IBM WebSphere Application Server Cross-Site Request Forgery
Advisory ID: CORE-2010-1021
Advisory URL: http://www.coresecurity.com/content/IBM-WebSphere-CSRF
Date published: 2011-06-15
Date of last update: 2011-06-15
Vendors contacted: IBM
Release mode: User release


2. *Vulnerability Information*

Class: Cross-Site Request Forgery (CSRF) [CWE-352]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2010-3271


3. *Vulnerability Description*

WebSphere is IBM's integration software platform. It includes the entire
middleware infrastructure --such as servers, services, and tools--
needed to write, run, and monitor 24x7 industrial-strength, on demand
Web applications and cross-platform, cross-product solutions. WebSphere
Application Server is the base for the infrastructure; everything else
runs on top of it [1].

The administrative console of IBM WebSphere Application Server is
vulnerable to Cross-Site Request Forgery (CSRF) attacks, which can be
exploited by remote attackers to force a logged-in administrator to
perform unwanted actions on the IBM WebSphere administrative console, by
enticing him to visit a malicious web page.


4. *Vulnerable packages*

   . IBM WebSphere Application Server 7.0.0.11
   . IBM WebSphere Application Server 7.0.0.13
   . Older versions are probably affected too, but they were not checked.


5. *Non-vulnerable packages*

Contact the vendor for a fix.


6. *Vendor Information, Solutions and Workarounds*

Contact the vendor for a fix. The following are workarounds for this issue.

6.1. *Server side*

According to OWASP [2], CSRF vulnerabilities can be avoided by checking
the referrer of the HTTP request and verifying that the request comes
from the original site. A potential workaround is thus to set a rule on
a Web Application Firewall that checks the referrer of the requests, and
verifies that all the requests to the WebSphere administrative console
are originated from the same site.

6.2. *Client side*

An administrator of WebSphere administrative console could mitigate the
bug by using Firefox and the NoScript add-on; more precisely by making
use of the ABE [3] (Application Boundaries Enforcer) feature of
NoScript. With ABE it is possible to define rules such as the following:

/-----
Site *.example.com
Accept from SELF
Deny
- -----/

This rule applies to *.example.com; it will allow all the requests made
from the same site, and block all the requests directed to *.example.com
but generated from any other site, avoiding that Firefox sends the
request to the server. The syntax of the ABE rules is defined here:
http://noscript.net/abe/abe_rules.pdf


7. *Credits*

This vulnerability was discovered and researched by Francisco Falcon
from Core Security Technologies during Bugweek 2010 [4]. Additional
research was performed by Alejandro Rodriguez. Publication was
coordinated by Carlos Sarraute.


8. *Technical Description / Proof of Concept Code*

The administrative console (also known as Integrated Solutions Console)
of IBM WebSphere Application Server is vulnerable to Cross-Site Request
Forgery (CSRF) [2] attacks, which can be exploited by remote attackers
to force a logged-in administrator to perform unwanted actions on the
IBM WebSphere administrative console, by enticing him to visit a
malicious web page.

The administrative console of IBM WebSphere Application Server includes
a standard protection mechanism against Cross-Site Request Forgery,
which consists of a token that is included as a hidden field on every
'FORM', named 'csrfid', that is sent to the web server in each 'POST'
request performed by the web browser. When the web server receives a
'POST' request, it checks that the 'csrfid' token included in the
parameters of the 'POST' request matches the anti-CSRF token associated
with the current session. If they do not match, then IBM WebSphere
responds with an "'Unauthorized Request'" message, thus effectively
preventing CSRF.

However, in certain areas of the administrative console, WebSphere
forgets to check the value of the 'csrfid' token when processing 'POST'
requests, even though the 'csrfid' hidden field is included in every
'FORM', making the application vulnerable to Cross-Site Request Forgery.

The vulnerable areas of the WebSphere administrative console include the
'Security > Global Security' panel [6], and the 'Save changes to the
master configuration' feature. This makes possible for a remote attacker
to disable the 'Administrative Security', 'Application Security' and
'Java 2 Security' options, and then to save the changes to the
configuration, by tricking an IBM WebSphere administrator which is
currently logged in to the administrative console to visit a malicious
web page. Also note that IBM WebSphere 7.0 with Fix Pack 11 did not
include a 'csrfid' token for the 'Save changes to the master
configuration' feature; Fix Pack 13 introduced it, but anyways it is
ignored on the server side when processing a request to save the master
configuration.

The following HTML code is a Proof-of-Concept of a specially crafted web
page that will leverage the CSRF vulnerability in order to disable the
'Administrative Security', 'Application Security' and 'Java 2 Security'
options, if a logged-in administrator visits it:

/-----
<html>
<body>
<iframe id="iframe1" style="visibility:hidden"></iframe>
<iframe id="iframe2" style="visibility:hidden"></iframe>
  <script>
    //The first request disables "Administrative security" and
"Application security" options
    document.getElementById("iframe1").src =
"https://<ip>:9043/ibm/console/adminS