<<< Date Index >>>     <<< Thread Index >>>

Netegrity SiteMinder smpwservicescgi.exe target specification



 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dear ladies and gentlemen

We have found a potential security vulnerability in the Netegrity SiteMinder 
script smpwservicescgi.exe. If a user is connecting to a secured web server 
over an url like https://www.scip.ch (just an example with our domain) he will 
get forwarded to the logon url 
https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TYPE=32564432&REALMOID=02-0005b182-32f3-2121-ab24-8350cdfdaf3b&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=$SM$5rR6TLmkLOjh8Qac1FGeB5OHEA63VfWpQjt0OYda1BBrydPC0NKSWg%3d%3d&TARGET=$SM$https%3a%2f%2fwww%2escip%2ech%2fintern%2ehtml
 - In this url string several data is prepared to be processed as $QUERY_STRING 
in a common form http get request. As you can see, the last variant is named 
TARGET. This specifies the target url after authentication. In the example the 
url https://www.scip.ch/internal.html

The problem is, that a malicous user may use this to realize a social hacking 
or phishing attack. He may define a malicous web site as target to forward to 
another web site with unrelated content (e.g. porn), a cross site scripting or 
more severe vulnerability (e.g. JPEG exploit). The lack of reputation or 
launching another attack may be possible. It is also possible to shorten the 
malicous url to 
https://www.scip.ch/siteminderagent/pwcgi/smpwservicescgi.exe?TARGET=http%3a%2f%2fwww%2ecomputec%2ech
 - This is ideal to put it into a phishing mail. You find the original 
advisory, written in german, on 
http://www.scip.ch/cgi-bin/smss/showadvf.pl?id=1022 (Netegrity SiteMinder Login 
TARGET-Weiterleitung Designfehler).

We have not found any information on that issue. So I sent this information 
(nearly the same posting) on 14/12/04 to info-emea@xxxxxxxxxxxxx and asked for 
a solution. As I haven't heard _anything_ until 23/12/04 I sent a reminder 
email. Due no reply came back we made this vulnerability public finally to 
force Netegrity to react on this case. An Attack Tool Kit (ATK) plugin that 
addresses this vulnerability will be published in the next days[1].

Regards,

Marc Ruef

[1] http://www.computec.ch/projekte/atk/

- -- 
) scip AG (
Technoparkstr. 1
8005 Zürich
T +41 1 445 18 18 
F +41 1 445 18 19

maru@xxxxxxx
www.scip.ch

- - Aktuellste IT-Sicherheitsluecken -

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
Comment: http://www.scip.ch

iQA/AwUBQevrDhe5hzJzqVMhEQLX8QCeNnfaNUTqAlkNqF49dV/jyTFwuBoAn3UG
KAjYMXWByPzqHfyzGxw7dlHw
=eo/G
-----END PGP SIGNATURE-----