Full Disclosure mailing list archives
Corsaire Security Advisory: PeopleSoft Gateway Administration
From: "advisories" <advisories () corsaire com>
Date: Thu, 13 Nov 2003 09:50:55 -0000
-- Corsaire Security Advisory -- Title: PeopleSoft IScript XSS issue Date: 04.07.03 Application: PeopleTools 8.20/8.43 and prior Environment: Various Author: Glyn Geoghegan [glyn.geoghegan () corsaire com] Audience: General distribution Reference: c030704-004 -- Scope -- The aim of this document is to clearly define a vulnerability in the PeopleSoft IScript functionality, as supplied by PeopleSoft Ltd. [1], that would allow an attacker to perform a Cross Site Scripting (XSS) attack. -- History -- Discovered: 01.07.03 (Glyn Geoghegan) Vendor notified: 04.07.03 Document released: 12.11.03 -- Overview -- The PeopleSoft IScript environment allows developers to produce custom environments, tailored to an organisations needs. By using a malformed URL in an HTTP request to the IScript application, it is possible to achieve an XSS attack, potentially giving access to confidential information, such as session cookies etc. -- Analysis -- The IScript interface accepts a number of arguments via HTTP POST/GET calls. By using a carefully constructed URL, mobile code such as JAVA, can be executed within the users context. This style of attack can be used to gain access to sensitive information, such as session cookies etc. -- Recommendations -- PeopleSoft have released details of this and other issues under security rollup vulnerability ID 20031112, which is available to registered users from the PeopleSoft support site [2]. PeopleSoft recommends that customers address the vulnerability by applying the following fixes available on PeopleSoft Customer Connection. Release Patch 8.18 8.18.15 8.19 8.19.12 8.20 8.20.03 8.42 8.42.14 8.43 8.43.11 For those who can not implement the patches promptly, as a mitigating strategy a firewall or other HTTP filtering device can be used to block queries containing sensitive strings, or as a last resort all access to the PeopleSoft application can be disabled in entirety. -- CVE -- The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0629 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardises names for security problems. -- References -- [1] http://www.peoplesoft.com [2] http://www.peoplesoft.com/corp/en/patch_fix/search.jsp -- Revision -- a. Initial release. b. Minor detail revisions. c. Revised to include vendor information. -- Distribution -- This security advisory may be freely distributed, provided that it remains unaltered and in its original form. -- Disclaimer -- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Corsaire accepts no responsibility for any damage caused by the use or misuse of this information. Copyright 2003 Corsaire Limited. All rights reserved. ---------------------------------------------------------------------- CONFIDENTIALITY: This e-mail and any files transmitted with it are confidential and intended solely for the use of the recipient(s) only. Any review, retransmission, dissemination or other use of, or taking any action in reliance upon this information by persons or entities other than the intended recipient(s) is prohibited. If you have received this e-mail in error please notify the sender immediately and destroy the material whether stored on a computer or otherwise. ---------------------------------------------------------------------- DISCLAIMER: Any views or opinions presented within this e-mail are solely those of the author and do not necessarily represent those of Corsaire Limited, unless otherwise specifically stated. ---------------------------------------------------------------------- Corsaire Limited, 3 Tannery House, Tannery Lane, Send, Surrey, GU23 7EF Telephone: +44(0)1483-226000 Email:info () corsaire com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Corsaire Security Advisory: PeopleSoft Gateway Administration advisories (Nov 13)