Document Title:
===============
Wibu Systems CodeMeter v6.50 - (UI) XSS Web Vulnerability
References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2074
ID: FB49498
Acknowledgements: https://www.flickr.com/photos/vulnerabilitylab/36912680045/
Sources:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13754
http://www.cvedetails.com/cve/CVE-2017-13754
https://nvd.nist.gov/vuln/detail/CVE-2017-13754
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-13754
CVE-ID:
=======
CVE-2017-13754
Release Date:
=============
2017-09-03
Vulnerability Laboratory ID (VL-ID):
====================================
2074
Common Vulnerability Scoring System:
====================================
2.8
Vulnerability Class:
====================
Cross Site Scripting - Non Persistent
Current Estimated Price:
========================
500€ - 1.000€
Product & Service Introduction:
===============================
CodeMeter is the universal technology for software publishers and intelligent device manufacturers, upon which all
solutions from Wibu-Systems are built. You want to protect the software you have developed against piracy and
reverse engineering. CodeMeter requires your attention only once: its integration in your software and your business
workflow is necessary at one point in time only. Protection Suite is the tool that automatically encrypts your
applications and libraries. In addition, CodeMeter offers an API for custom integration with your software.
(Copy of the Homepage: http://www.wibu.com/us/codemeter.html )
Abstract Advisory Information:
==============================
The vulnerability laboratory core research team discovered a cross site and input validation vulnerability in the Wibu Systems CodeMeter WebAdmin v6.50 application.
Vulnerability Disclosure Timeline:
==================================
2017-05-20: Researcher Notification & Coordination (Benjamin Kunz Mejri - Evolution Security GmbH)
2017-05-21: Vendor Notification (Wibu Systems AG - Security Department)
2017-05-22: Vendor Response/Feedback (Wibu Systems AG - Security Department)
2017-08-01: Vendor Fix/Patch (Wibu Systems AG - Service Developer Team)
2017-08-20: Security Acknowledgements (Wibu Systems AG - Security Department)
2017-09-04: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Affected Product(s):
====================
Wibu-Systems AG
Product: CodeMeter & Control Panel - WebAdmin (Web-Application) 6.50.2624.500
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Low
Technical Details & Description:
================================
A cross site and input validation issue has been discovered in the Wibu Systems AG CodeMeter WebAdmin v6.50 web-server web-application.
The vulnerability allows remote attackers to inject own malicious script code with client-side vector to the vulnerable function or module to
followup with a compromising attack.
The input validation vulnerability has been discovered in the `server name` input field of the `advanced settings - time server` module.
The request method to inject is POST and the attack vector is located on the client-side. First the attacker injects the payload and after
it the POST request is performed to save the content permanently as regedit db entry.
The basic validation in the application is well setup but in case of the advanced settings the validation parameter are still not implemented
to secure the function at all. The vulnerability is a classic filter input validation vulnerability. The application has no cookies and therefore
the attack risk is more minor but not that less then to ignore it. The vulnerable files are `ChangeConfiguration.html`, `time_server_list.html`
and `certified_time.html`. The `ChangeConfiguration.html` is marked as injection point for the payload. The `time_server_list.html` and
`certified_time.html` files are marked as the execution point of the issue.
The security issue was uncovered during the blurrybox hacking contest of the wibu systems ag and acknowledged by the internal management.
The security risk of the cross site issue and input validation bug is estimated as low with a cvss (common vulnerability scoring system) count of 2.8.
Exploitation of the cross site issue and input validation web vulnerability requires medium user interaction and a privileged web-application user account.
Successful exploitation of the vulnerability results in phishing attacks, external redirects to malicious sources and manipulation of affected or connected application modules.
Request Method(s):
[+] POST
Vulnerable Module(s):
[+] Advanced Settings - Time Server
Vulnerable File(s):
[+] ChangeConfiguration.html
Vulnerable Parameter(s):
[+] server name
Affected Module(s):
[+] time_server_list.html
[+] certified_time.html
Proof of Concept (PoC):
=======================
The input validation issue can be exploited by remote attackers with privileged user account and with medium user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
Manual steps to reproduce the vulnerability ...
1. Start the CodeMeter software
2. Open the webadmin gui
3. Move to advanced settings
4. Open the time-server module
5. Click the plus to add a new time server
Note: The request method is POST
6. Inject a test script code payload with matching domain and save via POST
7. The code is saved and executes of the dbms in the time-server list module index
8. Successful reproduce of the vulnerability!
Note: The method can be automated by usage of post method requester to include a payload.
PoC: Payload (Exploitation)
cmtime.codehacker.de/>"
cmtime.codehacker.de/>"