Webspeed security issue

[georger () NLS NET (George)]

I reported this to Progress (maker of Webspeed) a month ago and they said
they would fix it but since then I've not seen any fixes released. I also
pondered whether or not to release this information because some rather
large web databases use Webspeed but I do believe in full disclosure as the
best security so here goes...

Webspeed is a website creation language used by some of the larger db based
websites on the net. Version 3 comes with a java GUI configuration program.
This configuration program has certain security setting options in it. One
of which doesn't actually do anything.

There is one option to turn off access to a utility called WSMadmin. It's in
the messenger section of the GUI config program. However checking or
unchecking this option doesn't change anything. In fact to turn this feature
off you have to hand edit the ubroker.properties file. Look for the
following entries:

AllowMsngrCmds=1

and each time you find this set it =0 in each of the sections. This will
disable the feature (you want to do this on the production server).

AllowMsngrCmds=0

Ok, now the exploit to show how serious an issue this is on the web. It's
just a misconfiguration really but it's caused by a bug in the java config
program (I tested the NT version but since the config program is java it may
also affect other platforms)

Exploit:

go to search engines and search for "wsisa.dll", I used google 3rd page or
further (first 3 pages are all junk)

Go to URL similar to
http://www.domain.com/scripts/wsisa.dll/extra/somepage.htm with your browser

change the url in the browser to
http://www.domain.com/scripts/wsisa.dll/WService=anything?WSMadmin

(note capitals are important)

click on the link "End Sessions Logging and Display Sessions Info" (note you
may have to start logging first then stop it if they've never used the
logging feature)

When you pick the End Sessions Logging choice it displays the log, find a
statement in the log for the default service "Default Service =
nameofservice"

back up one page (hit your back button)

type nameofservice into the Verify WebSpeed Configuration box and click the
verify button.

If everything worked you now own their site. I won't explain how to use the
utility but anyone familiar with this should know exactly how dangerous this
is.

Geo.