Netegrity SiteMinder smpwservicescgi.exe target specification
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Dear ladies and gentlemen
We have found a potential security vulnerability in the Netegrity SiteMinder
script smpwservicescgi.exe. If a user is connecting to a secured web server
over an url like https://www.scip.ch (just an example with our domain) he will
get forwarded to the logon url
https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TYPE=32564432&REALMOID=02-0005b182-32f3-2121-ab24-8350cdfdaf3b&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$5rR6TLmkLOjh8Qac1FGeB5OHEA63VfWpQjt0OYda1BBrydPC0NKSWg%3d%3d&TARGET=$SM$https%3a%2f%2fwww%2escip%2ech%2fintern%2ehtml
- In this url string several data is prepared to be processed as $QUERY_STRING
in a common form http get request. As you can see, the last variant is named
TARGET. This specifies the target url after authentication. In the example the
url https://www.scip.ch/internal.html
The problem is, that a malicous user may use this to realize a social hacking
or phishing attack. He may define a malicous web site as target to forward to
another web site with unrelated content (e.g. porn), a cross site scripting or
more severe vulnerability (e.g. JPEG exploit). The lack of reputation or
launching another attack may be possible. It is also possible to shorten the
malicous url to
https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TARGET=http%3a%2f%2fwww%2ecomputec%2ech
- This is ideal to put it into a phishing mail. You find the original
advisory, written in german, on
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1022 (Netegrity SiteMinder Login
TARGET-Weiterleitung Designfehler).
We have not found any information on that issue. So I sent this information
(nearly the same posting) on 14/12/04 to info-emea@xxxxxxxxxxxxx and asked for
a solution. As I haven't heard _anything_ until 23/12/04 I sent a reminder
email. Due no reply came back we made this vulnerability public finally to
force Netegrity to react on this case. An Attack Tool Kit (ATK) plugin that
addresses this vulnerability will be published in the next days[1].
Regards,
Marc Ruef
[1] http://www.computec.ch/projekte/atk/
- --
) scip AG (
Technoparkstr. 1
8005 Zürich
T +41 1 445 18 18
F +41 1 445 18 19
maru@xxxxxxx
www.scip.ch
- - Aktuellste IT-Sicherheitsluecken -
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
Comment: http://www.scip.ch
iQA/AwUBQevrDhe5hzJzqVMhEQLX8QCeNnfaNUTqAlkNqF49dV/jyTFwuBoAn3UG
KAjYMXWByPzqHfyzGxw7dlHw
=eo/G
-----END PGP SIGNATURE-----