HTTP header injection/Cache poisoning in Oracle WebCenter Sites Satellite Server

SEC Consult Vulnerability Lab Security Advisory < 20130417-2 >
=======================================================================
              title: HTTP header injection/Cache poisoning in Oracle WebCenter
                     Sites Satellite Server
            product: Oracle WebCenter Sites Satellite Server (former FatWire
                     Satellite Server)
 vulnerable version: 7.6.0 Patch1, 7.6.2, 11.1.1.6.0, 11.1.1.6.1
      fixed version: Patch information see sections below
                CVE: CVE-2013-1509
             impact: medium
           homepage: http://www.oracle.com/us/corporate/acquisitions/fatwire/index.html
              found: 2012-09-17
                 by: K. Gudinavicius
                     SEC Consult Vulnerability Lab
https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
FatWire Satellite Server is a predecessor product of Oracle WebCenter Sites
Satellite Server.

"Oracle WebCenter Sites Satellite Server enables organizations to deliver
segmented, targeted, and dynamically assembled content across global Web
properties with rapid response times and intelligent edge caching to optimize
and speed the delivery of dynamic Web experiences."

Source: http://www.oracle.com/us/products/middleware/webcenter/satellite-server/overview/index.html


Vulnerability overview/description:
-----------------------------------
Due to unsanitized user input it is possible to inject arbitrary HTTP header
values in certain HTTP responses of the Satellite Server. This can be
exploited, for example, to perform session fixation and malicious redirection
attacks via the Set-Cookie and the Refresh headers. Moreover, the Satellite
Server caches these HTTP responses with the injected HTTP header resulting in
all further requests to the same resource being served with the poisoned HTTP
response, while these objects remain in cache.


Proof of concept:
-----------------
An arbitrary header can be injected in the HTTP responses of the
downloadable resources. The values of the blobheadername2 and the
blobheadervalue2 URL parameters are user controllable. In the following
example the Refresh header is injected:

http://fatwire/cs/Satellite?blobcol=urldata&blobheadername1=content-type&blobheadername2=Refresh&;
blobheadervalue1=application/pdf&blobheadervalue2=0;url=http://www.sec-consult.com&blobkey=id&;
blobnocache=false&blobtable=MungoBlobs&blobwhere=1342534304149&ssbinary=true&site=S08

The returned HTTP response will contain the injected Refresh header and its
value. Furthermore, the HTTP response will be cached, so the next time users
will be accessing the same downloadable resource using the standard URL, they
will be affected and redirected using the injected Refresh header value.

HTTP/1.1 200 OK
Date: Thu, 06 Sep 2012 15:59:04 GMT
Refresh: 0;url=http://www.sec-consult.com
Last-Modified: Thu, 06 Sep 2012 15:54:20 GMT
Content-Type: application/pdf
Connection: close
Content-Length: 772193


Vulnerable / tested versions:
-----------------------------
The following installation has been tested:
* FatWire Satellite Server 7.6.0 Patch1.


Vendor contact timeline:
------------------------
2012-11-26: Contacting vendor through secalert_us () oracle com
2012-11-26: Vendor response, will investigate issues
2012-11-27: Investigation ongoing, the following ID assigned:
            S0321206 - ARBITRARY HTTP HEADER INJECTION/CACHE POISONING IN FATWIRE
2013-01-25: S0321206 Issue fixed in main codeline, scheduled for a future CPU
2013-04-12: S0321206 is fixed in upcoming CPU on 2013-04-16
2013-04-16: Oracle releases April 2013 CPU
2013-04-17: Public release of SEC Consult advisory


Solution:
---------
Apply latest patches, see:
http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html


Workaround:
-----------


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
https://www.sec-consult.com

EOF K. Gudinavicius / @2013