The affected Vignette commands are: - NEEDS - VALID_PATHS
All the TCL templates or scripts, that use this commands, are vulnerable to remote code injection.
This is overly broad. The actual vulnerability depends on the code path taken in the NEEDS Tcl procedure.
SET queryString [SHOW HTTP_QUERY_STRING] <--- (!)
This problematic line was already identified by Bas Scheffers (IIRC). http://bas.scheffers.net/vgn-needs-login-exploit.html
regsub -all {; } [SHOW HTTP_COOKIE] { } cookieString <--- (!)
-- Lines 1272/1277 (VALID_PATHS command) --
system_error "Invalid path \"$_Path\" for template (referer='[SHOW HTTP_REFERER]')" <--- (!)
As seen, the value of some unfiltered variables is used and evaluated with the SHOW command. If the external variable contains Vignette code, then arbitrary TCL execution is posible. The affected input variables are:
- HTTP_QUERY_STRING, converted to queryString in NEEDS command.
- HTTP_COOKIE, converted to cookieString in NEEDS command.
- HTTP_REFERER, showed in VALID_PATHS command.
This is incorrect. While this might enable XSS attacks, it does not allow for Tcl code injection. The problematic command here is not SHOW, but SET.
A (simplified) version of the Vignette SET command would look like this:
proc SET {var val {noeval {}} {
if {$noeval != "NOEVAL"} {
set val [EVAL $val]
}
namespace eval ::VgnDefaultNamespace [list set $var $val]
}That is, unless a third argument of "NOEVAL" is passed to the SET command, the value will be interpreted as a Vignette Tcl template piece, and any Tcl command embedded in it in the form of "[code]" will be executed.
Solution --------
Replace the offending SHOW evaluations in stdlib.tcl with directly passed variables. For example:
instead: SET queryString [SHOW HTTP_QUERY_STRING] use ==> SET queryString $HTTP_QUERY_STRING
This is incorrect, and will likely break your application.
-- Stefan Bethke <s.bethke@tallence.com> Tallence GmbH, Steinhöft 11, D-20459 Hamburg, Germany Mobile +49 170 3460140, Office +49 40 36099860, Fax +49 40 36099869
