Uploaded image for project: 'WORKTERRA'
  1. WORKTERRA
  2. WT-10523

[Security] [ZAP-Active Scan Alert] Buffer Overflow error reported for images load request in Benadmin.

    Details

    • Type: Bug
    • Status: Rejected
    • Priority: Medium
    • Resolution: Cancelled
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Labels:
    • Environment:
      Stage
    • Bug Type:
      Functional
    • Bug Severity:
      Medium
    • Level:
      Employee
    • Module:
      BenAdmin - Security
    • Reported by:
      Harbinger
    • Item State:
      Development - On Hold

      Description

      [Security] [ZAP-Active Scan Alert] Buffer Overflow error reported for images load request in Benadmin.

      URL : https://stage.workterra.net/BenAdmin/Images/benadmin-logo.png

      Method : GET

      Parameter : query

      Attack :

      GET https://stage.workterra.net/BenAdmin/Images/benadmin-logo.png?query=svYCMJYVvnByQVkQrRDtmsCoIAeMPkyQVZafbGLyQeHpQfpxNEAIWbeJFriRNwOLWhOvuxhTkvekLvVQgQWMsBgVGloxCpEyupPexadDBkuodaLxxfjmCEcpAuyCwFMbjPrLXeUYQGiQVJDoXeOpLEscJxyBSYUkSNFPHQPBShsBhJnhimZJXQTDDGCMVXuRlyryXyOHsqgASyDZSDAgRpfCrtUdtnsdKmyfTDNftMdxsyFWBFbrZTUWhmBlKYQeeSKelwXdcaBlylUIMEpeRZJMwQGvgifwUlimSNIXyuARqpMoDtyouvwTHqXVBrHrsfsjubCJolpHEBgSSMmKWUuaWcZxhFjBHKQmJkqbwCdtQYSBjQGkaunZvCkwpCtTwLUoghXdCDaGplexpQWpcruWRfkiFOoqnWEPnAJBjvVbydeQVkCPINRmeJXCvANGNPrsutHhTKWklBCdROnefWaWmfeBaIrkLflOjxWwgnIhvnMvVnTjmjZpHdXHKcSeuNoQWRQZgQjDBVIAhOBOqtpgybZCiYFZsTxJwiEELdOQlPnsMHpFQuMQFUCqPYGWlmETFoZLTiaIQeUeUScAFXFeZvhHgLtMJWWgbYadOjSyFAflKylFZLGbtstAgouHAYyWWkUtONuSBFdWoEPEyVITqSjpPEvSrFnfCZWOwZClJUUxbcrfVTYIwrmOTXbaHANcgGdRHMPNWYJLnjGlFjpmsnBRMnhfuTrwWgSYECJpGboystAInCBkWtfaQqlpEhJaEamGakPOrPDwTIkxOLljnWQnSfaBwnmZVpVgwyRARbFEoZJweIiNoxxuhcTxpDMYHLKZyMyfJdTPqDwMcTJUWoWVGorWlyqIMoDTabmrnhPFwwdirylGhuoXFQTUdLMfMiUQXklTuOSggCWTehEXbDxuCdKVpYyxLfqTUhifgapknxLvKgXJlRFVlnkvChYCZhclsQDUhTXfEuYPiFOOegOMmydiNLVIuwTYleSJKWJTYHvLRtpIyvEBvmdetlAMFytYGyelUJQvEgDbRKeKHLEhSaPQaiSNyELTibdvoGvxNPoDiytjZtwYHtCQctFxZOGtBYBXvUbXueTWoCVIlKjhVtEqEJtaKNGqiTVShcEmoGnQVLGOcQelFrFFtaBeJIDHLWNeqlGyJLfifHeakXMDvrarerKLnMcOERrfsFWnOtvfBjKTJZBexxCdBwebpvalnQIdBpynImlTXmWkIaXsOgrOccjWheOhuvOBLiiUfFpXBceToDhHZYWxGOSAraqnviycMpKgcYFKLsXEjZciAmQiEdjoNRlXxiHvXfosRQIFmgHUnXfpRyydrZFtJCjwdRiRPZQMbGjhHdvaOPcllDmFKtUPlruklZqxqhRNanbQseWQQwShWGBLHjMIrQcLGgPVCqxXKEHLauZCOdeXNDqLcuGSifeQnXYMWEkFdlJYWdKPpyKVCHTCJJUdivAKJpescwCZATMFHFVpKfKtamKwWlUcaebbiLpIwHBLWKBidfInAIYExhfAMGVJqZOTsbIAUWBYjhilCHxplqNouRgaEuuZhSlUskwVgpaySxixUkhuYJqkptXRDTIXaPjkIUuldOhOHSBjflEjjdGBFvfctrDDvhOSaMgVQArAASrKCloEDFxXgvtKkEGPghNktrCsxIToMQSDdnvKNBCnbwArFZdomGYecRorHgApxsRNlmITaSheaJsxGppsZJHmCucXPmFSFaEMwHHJnAmxfqTpmerSMHWEdrtAvRpPBrHKVoPSulxXUXJDDbqfwvrflEaPgOOevYfgMtMYbqyDyyDTUlplmCyKvcOrBTOEHQKkjNmYLVawmxILexeCFZLoshCfGGdChPKFAvfnaIOKRAsocFlvKJAgvFvDuJvnMkfFkygkasRtsdUXtEyrIOdhKMDsakkwjGagPEYqcspCVUGlpyUNXceloaSXMjhUXWeGdULIPAlvHarCgtheTRCFSnrhAAYTtovnQamSRxcviktuvSOJcmpyGhUyQbLWvNZyKKbrhGJpWAOISSJjVnDwcoXqLuheFZPqhIbQmQjZpTwVsXVoDYJtXtDASfnPVAkm HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-US,en;q=0.5 Referer: https://stage.workterra.net/Platform/UserDetails/UserDetails/EmployeeAgreement?InputType=9z0E7HUDFw5SKo3KBuo7SIzEyO6XP6fcXaGmHkabhLo%3d Cookie: __RequestVerificationToken_L1BsYXRmb3Jt0=2SmNWnxiViamQP6s84v4-hFJ7JZ7qmfgd1gg4W6NR8CpnLCVX19j-4XUMEFt02_HZTHwVvXgXkSQ2N6-KoeIpveCWlH3iNPHHAHW2nbAMW41; WTCookie=z4pyloighywxm4a3yxncmu14; IdForLoginValidation=9d5b2c47cbd242669377ae0539cd012c Connection: keep-alive Cache-Control: max-age=0 Content-Length: 0 Host: stage.workterra.net

      Solution :
      Rewrite the background program using proper return length checking. This will require a recompile of the background executable.

      Other information

      Potential Buffer Overflow. The script closed the connection and threw a 500 Internal Server Error

      Reference: https://www.owasp.org/index.php/Buffer_overflow_attack

      Please refer attached HTML report for more details.

      CC: Rakesh RoySachin HingoleHrishikesh DeshpandeSamirVijayendra ShindeVijay SiddhaBharti SatputeGaurav SodaniNidhi Kaul

        Attachments

          Issue Links

            Activity

            prasadp Prasad Pise (Inactive) created issue -
            prasadp Prasad Pise (Inactive) made changes -
            Field Original Value New Value
            Link This issue relates to NF-2714 [ NF-2714 ]
            satyap Satya made changes -
            Assignee Satya [ ID10004 ] Jaideep Vinchurkar [ jaideep.vinchurkar ]
            jaideep.vinchurkar Jaideep Vinchurkar (Inactive) made changes -
            Assignee Jaideep Vinchurkar [ jaideep.vinchurkar ] Aditya Vishwakarma [ aditya.vishwakarma ]
            gaurav.sodani Gaurav Sodani (Inactive) made changes -
            Sprint WT Sprint 37 - Bugs [ 87 ]
            jaideep.vinchurkar Jaideep Vinchurkar (Inactive) made changes -
            Dev Due Date 22/Sep/2017
            gaurav.sodani Gaurav Sodani (Inactive) made changes -
            Item State Parent values: Development(10200)Level 1 values: In Analysis(10204)
            jaideep.vinchurkar Jaideep Vinchurkar (Inactive) made changes -
            Dev Due Date 22/Sep/2017
            jaideep.vinchurkar Jaideep Vinchurkar (Inactive) made changes -
            Item State Parent values: Development(10200)Level 1 values: In Analysis(10204) Parent values: Development(10200)Level 1 values: On Hold(10207)
            gaurav.sodani Gaurav Sodani (Inactive) made changes -
            Sprint WT Sprint 37 - Bugs [ 87 ]
            satyap Satya made changes -
            Labels Security
            satyap Satya made changes -
            Environment_New Stage [ 18443 ]
            aditya.vishwakarma Aditya Vishwakarma (Inactive) made changes -
            Assignee Aditya Vishwakarma [ aditya.vishwakarma ] Santosh Balid [ santosh.balid ]
            santosh.balid Santosh Balid (Inactive) made changes -
            Assignee Santosh Balid [ santosh.balid ] Gaurav Sodani [ gaurav.sodani ]
            vijayendra Vijayendra Shinde (Inactive) made changes -
            Assignee Gaurav Sodani [ gaurav.sodani ] Prasad Pise [ prasadp ]
            Prashant.samal Prashant Samal (Inactive) made changes -
            Status Open [ 1 ] In Development [ 10007 ]
            Prashant.samal Prashant Samal (Inactive) made changes -
            Resolution Cancelled [ 10300 ]
            Status In Development [ 10007 ] Rejected [ 10004 ]
            vijayendra Vijayendra Shinde (Inactive) made changes -
            Link This issue relates to DEV-13718 [ DEV-13718 ]

              People

              Assignee:
              prasadp Prasad Pise (Inactive)
              Reporter:
              prasadp Prasad Pise (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 2h
                  2h
                  Remaining:
                  Remaining Estimate - 2h
                  2h
                  Logged:
                  Time Spent - Not Specified
                  Not Specified