-
Type:
Bug
-
Status: Rejected
-
Priority:
Medium
-
Resolution: Cancelled
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: None
-
Labels:
-
Environment:Stage
-
Bug Type:Functional
-
Bug Severity:Medium
-
Level:Employee
-
Module:BenAdmin - Security
-
Reported by:Harbinger
-
Item State:Development - On Hold
[Security] [ZAP-Active Scan Alert] Buffer Overflow error reported for images load request in Benadmin.
URL : https://stage.workterra.net/BenAdmin/Images/benadmin-logo.png
Method : GET
Parameter : query
Attack :
GET https://stage.workterra.net/BenAdmin/Images/benadmin-logo.png?query=svYCMJYVvnByQVkQrRDtmsCoIAeMPkyQVZafbGLyQeHpQfpxNEAIWbeJFriRNwOLWhOvuxhTkvekLvVQgQWMsBgVGloxCpEyupPexadDBkuodaLxxfjmCEcpAuyCwFMbjPrLXeUYQGiQVJDoXeOpLEscJxyBSYUkSNFPHQPBShsBhJnhimZJXQTDDGCMVXuRlyryXyOHsqgASyDZSDAgRpfCrtUdtnsdKmyfTDNftMdxsyFWBFbrZTUWhmBlKYQeeSKelwXdcaBlylUIMEpeRZJMwQGvgifwUlimSNIXyuARqpMoDtyouvwTHqXVBrHrsfsjubCJolpHEBgSSMmKWUuaWcZxhFjBHKQmJkqbwCdtQYSBjQGkaunZvCkwpCtTwLUoghXdCDaGplexpQWpcruWRfkiFOoqnWEPnAJBjvVbydeQVkCPINRmeJXCvANGNPrsutHhTKWklBCdROnefWaWmfeBaIrkLflOjxWwgnIhvnMvVnTjmjZpHdXHKcSeuNoQWRQZgQjDBVIAhOBOqtpgybZCiYFZsTxJwiEELdOQlPnsMHpFQuMQFUCqPYGWlmETFoZLTiaIQeUeUScAFXFeZvhHgLtMJWWgbYadOjSyFAflKylFZLGbtstAgouHAYyWWkUtONuSBFdWoEPEyVITqSjpPEvSrFnfCZWOwZClJUUxbcrfVTYIwrmOTXbaHANcgGdRHMPNWYJLnjGlFjpmsnBRMnhfuTrwWgSYECJpGboystAInCBkWtfaQqlpEhJaEamGakPOrPDwTIkxOLljnWQnSfaBwnmZVpVgwyRARbFEoZJweIiNoxxuhcTxpDMYHLKZyMyfJdTPqDwMcTJUWoWVGorWlyqIMoDTabmrnhPFwwdirylGhuoXFQTUdLMfMiUQXklTuOSggCWTehEXbDxuCdKVpYyxLfqTUhifgapknxLvKgXJlRFVlnkvChYCZhclsQDUhTXfEuYPiFOOegOMmydiNLVIuwTYleSJKWJTYHvLRtpIyvEBvmdetlAMFytYGyelUJQvEgDbRKeKHLEhSaPQaiSNyELTibdvoGvxNPoDiytjZtwYHtCQctFxZOGtBYBXvUbXueTWoCVIlKjhVtEqEJtaKNGqiTVShcEmoGnQVLGOcQelFrFFtaBeJIDHLWNeqlGyJLfifHeakXMDvrarerKLnMcOERrfsFWnOtvfBjKTJZBexxCdBwebpvalnQIdBpynImlTXmWkIaXsOgrOccjWheOhuvOBLiiUfFpXBceToDhHZYWxGOSAraqnviycMpKgcYFKLsXEjZciAmQiEdjoNRlXxiHvXfosRQIFmgHUnXfpRyydrZFtJCjwdRiRPZQMbGjhHdvaOPcllDmFKtUPlruklZqxqhRNanbQseWQQwShWGBLHjMIrQcLGgPVCqxXKEHLauZCOdeXNDqLcuGSifeQnXYMWEkFdlJYWdKPpyKVCHTCJJUdivAKJpescwCZATMFHFVpKfKtamKwWlUcaebbiLpIwHBLWKBidfInAIYExhfAMGVJqZOTsbIAUWBYjhilCHxplqNouRgaEuuZhSlUskwVgpaySxixUkhuYJqkptXRDTIXaPjkIUuldOhOHSBjflEjjdGBFvfctrDDvhOSaMgVQArAASrKCloEDFxXgvtKkEGPghNktrCsxIToMQSDdnvKNBCnbwArFZdomGYecRorHgApxsRNlmITaSheaJsxGppsZJHmCucXPmFSFaEMwHHJnAmxfqTpmerSMHWEdrtAvRpPBrHKVoPSulxXUXJDDbqfwvrflEaPgOOevYfgMtMYbqyDyyDTUlplmCyKvcOrBTOEHQKkjNmYLVawmxILexeCFZLoshCfGGdChPKFAvfnaIOKRAsocFlvKJAgvFvDuJvnMkfFkygkasRtsdUXtEyrIOdhKMDsakkwjGagPEYqcspCVUGlpyUNXceloaSXMjhUXWeGdULIPAlvHarCgtheTRCFSnrhAAYTtovnQamSRxcviktuvSOJcmpyGhUyQbLWvNZyKKbrhGJpWAOISSJjVnDwcoXqLuheFZPqhIbQmQjZpTwVsXVoDYJtXtDASfnPVAkm HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0 Accept: image/png,image/;q=0.8,/*;q=0.5 Accept-Language: en-US,en;q=0.5 Referer: https://stage.workterra.net/Platform/UserDetails/UserDetails/EmployeeAgreement?InputType=9z0E7HUDFw5SKo3KBuo7SIzEyO6XP6fcXaGmHkabhLo%3d Cookie: __RequestVerificationToken_L1BsYXRmb3Jt0=2SmNWnxiViamQP6s84v4-hFJ7JZ7qmfgd1gg4W6NR8CpnLCVX19j-4XUMEFt02_HZTHwVvXgXkSQ2N6-KoeIpveCWlH3iNPHHAHW2nbAMW41; WTCookie=z4pyloighywxm4a3yxncmu14; IdForLoginValidation=9d5b2c47cbd242669377ae0539cd012c Connection: keep-alive Cache-Control: max-age=0 Content-Length: 0 Host: stage.workterra.net
Solution :
Rewrite the background program using proper return length checking. This will require a recompile of the background executable.
Other information
Potential Buffer Overflow. The script closed the connection and threw a 500 Internal Server Error
Reference: https://www.owasp.org/index.php/Buffer_overflow_attack
Please refer attached HTML report for more details.
CC: Rakesh RoySachin HingoleHrishikesh DeshpandeSamirVijayendra ShindeVijay SiddhaBharti SatputeGaurav SodaniNidhi Kaul
- relates to
-
NF-2714 Vulnerability Assessment and Penetration Testing for Workterra on Azure US environment.
-
- To Do
-
Assignee | Satya [ ID10004 ] | Jaideep Vinchurkar [ jaideep.vinchurkar ] |
Assignee | Jaideep Vinchurkar [ jaideep.vinchurkar ] | Aditya Vishwakarma [ aditya.vishwakarma ] |
Sprint | WT Sprint 37 - Bugs [ 87 ] |
Dev Due Date | 22/Sep/2017 |
Item State | Parent values: Development(10200)Level 1 values: In Analysis(10204) |
Dev Due Date | 22/Sep/2017 |
Item State | Parent values: Development(10200)Level 1 values: In Analysis(10204) | Parent values: Development(10200)Level 1 values: On Hold(10207) |
Sprint | WT Sprint 37 - Bugs [ 87 ] |
Labels | Security |
Environment_New | Stage [ 18443 ] |
Assignee | Aditya Vishwakarma [ aditya.vishwakarma ] | Santosh Balid [ santosh.balid ] |
Assignee | Santosh Balid [ santosh.balid ] | Gaurav Sodani [ gaurav.sodani ] |
Assignee | Gaurav Sodani [ gaurav.sodani ] | Prasad Pise [ prasadp ] |
Status | Open [ 1 ] | In Development [ 10007 ] |
Resolution | Cancelled [ 10300 ] | |
Status | In Development [ 10007 ] | Rejected [ 10004 ] |
Link | This issue relates to DEV-13718 [ DEV-13718 ] |