Vulnerabilities > CVE-2004-2320 - Information Exposure vulnerability in BEA Weblogic Server

# @DEPRECATED@
#
# (C) Tenable Network Security, Inc.
#

# HTTP/1.1 is defined by RFC 2068
#
# Check for proxy on the way (transparent or reverse?!)
#


include("compat.inc");

if(description)
{
 script_id(11040);
 script_version ("1.37");
 script_cve_id("CVE-2004-2320", "CVE-2005-3398", "CVE-2005-3498", "CVE-2007-3008");

 script_name(english: "HTTP Reverse Proxy Detection (Deprecated)");
 script_set_attribute(attribute:"synopsis", value:
"A transparent or reverse HTTP proxy is running on this port." );
 script_set_attribute(attribute:"description", value:
"This web server is reachable through a reverse HTTP proxy.

Note: This plugin has been deprecated.
" );

 script_set_attribute(attribute:"solution", value:"Disable the HTTP reverse proxy.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
 script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N");
 script_set_attribute(attribute:"cvss_score_source", value:"CVE-2004-2320");
 script_cwe_id(79, 200);

 script_set_attribute(attribute:"plugin_publication_date", value: "2002/07/02");
 script_cvs_date("Date: 2019/09/26 12:31:13");

script_set_attribute(attribute:"plugin_type", value:"remote");
 script_end_attributes();

 script_summary(english: "Look for an HTTP proxy on the way");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2002-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
 script_family(english: "Web Servers");
 script_dependencies("http_version.nasl");
 script_require_ports("Services/www", 80);
 exit(0);
}

# Deprecated
exit(0, 'This plugin has been deprecated.');

include("global_settings.inc");
include("misc_func.inc");
include("http.inc");

port = get_http_port(default:80, embedded: 1);

r = http_send_recv3(port: port, method: 'GET', item: "/", exit_on_fail: 1);
h = parse_http_headers(status_line: r[0], headers: r[1]);
via = h["via"];
trace="";

  while(via)
  {
    # display("Via=", via, "\n");
    proxy = ereg_replace(string:via, pattern: " *([^,]*),?.*", replace: "\1");
    via = ereg_replace(string: via, pattern: "([^,]*)(, *)?(.*)", replace: "\3");
    # display(string("Proxy=", proxy, " - Via=", via, "\n"));
    proto = ereg_replace(string:proxy, 
		pattern:"^([a-zA-Z0-9_-]*/?[0-9.]+) +.*",
		replace: "\1");
    line = ereg_replace(string:proxy, 
		pattern:"^([a-zA-Z0-9_-]*/?[0-9.]+) *(.*)",
		replace: "\2");
    # display(string("Proto=", proto, "\nLine=", line, "\n"));
    if (egrep(pattern:"^[0-9]+", string: proto))
      proto = "HTTP/" + proto;
    trace = trace + proto;
    l = strlen(proto);
    for (i= l;i < 12; i=i+1) trace=trace+" ";
    trace = strcat(trace, " ", line, '\n');
  }

if (trace)
  security_warning(port: port, extra: 
strcat(
'The GET method revealed those proxies on the way to this web server :\n', trace));
else if (h["x-cache"])
{
  p = ereg_replace(pattern:'^ *[A-Z]+ +from +([^ \t\r\n]+)[ \t\r\n]+',
	string: h["x-cache"], replace: "\1");
  r = 'There might be a caching proxy on the way to this web server';
  if (p != heads) r = strcat(r, ':\n', p);
  security_warning(port: port, extra: r);
}

exit(0); # broken at this time
#
ver = get_kb_item(string("http/", port));
if (int(ver) < 11)  exit(0);	# No TRACE in HTTP/1.0

n=0;
for (i = 0; i < 99; i ++)
{
  r = http_send_recv3(port: port, method: 'TRACE', item: '/', 
  add_headers: make_array("Max-Forwards", i), exit_on_fail: 0 );
  if (isnull(r)) break;
  h = parse_http_headers(status_line: r[0], headers: r[1]);
  via = h["via"];
  if (via)
    viaL[i] = via;
  else
    viaL[i] = "?";

  if (r[0] =~ '^HTTP/[0-9.]+ +200 ')
    {
      # The proxy is supposed to send back the request it got. 
      # i.e. "TRACE / HTTP/1.1"
      # However, NetCache appliance change it to "TRACE http://srv HTTP/1.1"
      if (egrep(pattern: "^TRACE (/|http://.*) HTTP/1.1", string: r[2]))
      {
        srv = h["server"];
        if (srv)
          srvL[i+1] = srv;
        else
          srvL[i+1] = "?";
        n ++;
      }
    }
    else
      break;
}

trace="";
for (i = 1; i <= n; i = i+1)
  trace = strcat(trace, viaL[i]," - ", srvL[i], '\n');

if (n > 0)
  security_warning(port:port, protocol:"tcp",
	extra: strcat(
	'The TRACE method revealed ', n, 
	' proxy(s) between us and the web server :\n',
	trace) );

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if(description)
{
 script_id(14722);
 script_version ("1.20");
 script_cve_id("CVE-2004-2320");
 script_bugtraq_id(11168);
 script_xref(name:"CERT", value:"867593");
 
 script_name(english:"WebLogic < 8.1 SP3 Multiple Vulnerabilities");
 
 script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by multiple flaws." );
 script_set_attribute(attribute:"description", value:
"According to its banner, the remote web server is BEA WebLogic version
8.1 SP2 or older.  There are multiple vulnerabilities in such versions
that may allow unauthorized access on the remote host or to get the
content of the remote JSP scripts." );
 script_set_attribute(attribute:"see_also", value:"https://securitytracker.com/id/1008866" );
 script_set_attribute(attribute:"solution", value:
"Apply Service Pack 3 on WebLogic 8.1." );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
 script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
 script_set_attribute(attribute:"exploit_available", value:"false");
 script_cwe_id(200);

 script_set_attribute(attribute:"plugin_publication_date", value: "2004/09/14");
 script_set_attribute(attribute:"vuln_publication_date", value: "2004/09/13");
 script_cvs_date("Date: 2018/11/15 20:50:19");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe",value:"cpe:/a:oracle:weblogic_server");
script_end_attributes();

 script_summary(english:"Checks the version of WebLogic");
 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.");
 script_family(english:"CGI abuses");
 script_dependencies("weblogic_detect.nasl");
 script_require_ports("Services/www", 80, 7001);
 script_require_keys("www/weblogic");
 exit(0);
}

#

include("global_settings.inc");
include("misc_func.inc");
include("audit.inc");
include("http.inc");

appname = "WebLogic";
get_kb_item_or_exit("www/weblogic");
port = get_http_port(default:80);
version = get_kb_item_or_exit("www/weblogic/" + port + "/version");
banner = get_http_banner(port:port);

if (!banner || "WebLogic " >!< banner) audit(AUDIT_INST_VER_NOT_VULN, appname, version);

vuln = FALSE;
pat = "^Server:.*WebLogic .*([0-9]+\.[0-9.]+) ";
matches = egrep(pattern:pat, string:banner);
if (matches) {
  foreach match (split(matches)) {
    match = chomp(match);
    ver = eregmatch(pattern:pat, string:match);
    if (!isnull(ver)) {
      # Extract the version and service pack numbers.
      nums = split(ver[1], sep:".", keep:FALSE);
      ver_maj = int(nums[0]);
      ver_min = int(nums[1]);

      sp = ereg_replace(
        string:match, 
        pattern:".* (Service Pack |SP)([0-9]+) .+",
        replace:"\2"
      );
      if (!sp) sp = 0;
      else sp = int(sp);

      # Check them against vulnerable versions listed in BEA's advisories.
      if (
        # version 6.x
        (
          ver_maj == 6 && 
          (
            ver_min < 1 ||
            (ver_min == 1 && sp <= 6)
          )
        ) ||

        # version 7.x
        (ver_maj == 7 && (ver_min == 0 && sp <= 5)) ||
  
        # version 8.x
        (
          ver_maj == 8 && 
          (
            ver_min < 1 ||
            (ver_min == 1 && sp <= 2)
          )
        )
      ) vuln = TRUE;
    }
  }
}

if (vuln)
{
  security_hole(port);
  exit(0);
}
audit(AUDIT_INST_VER_NOT_VULN, appname, version);

#
# This script was written by Thomas Reinke <[email protected]>
# Improvements re TRACK and RFP reference courtesy of <[email protected]>
# Improvements by rd - http_get() to get full HTTP/1.1 support,
# security_warning() instead of security_hole(), slight re-phrasing
# of the description
#
# See the Nessus Scripts License for details
#

# Changes by Tenable:
#   - added solution in the plugin output for JSAS9 (3/29/13)
#   - added CVE xref.
#   - title update (9/18/09)
#   - updated CVSS score (12/14/2015)
#   - Added note when TRACE/TRACK is enabled but reply is empty, added CVSSv3 score. (26/11/2018)

include("compat.inc");

if (description)
{
 script_id(11213);
 script_version("1.73");
 script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");

 script_cve_id("CVE-2003-1567", "CVE-2004-2320", "CVE-2010-0386");
 script_bugtraq_id(9506, 9561, 11604, 33374, 37995);
 script_xref(name:"CERT", value:"288308");
 script_xref(name:"CERT", value:"867593");

 script_name(english:"HTTP TRACE / TRACK Methods Allowed");
 script_summary(english:"Test for TRACE / TRACK Methods.");

 script_set_attribute(attribute:"synopsis", value:
"Debugging functions are enabled on the remote web server.");
 script_set_attribute(attribute:"description", value:
"The remote web server supports the TRACE and/or TRACK methods. TRACE
and TRACK are HTTP methods that are used to debug web server
connections.");
 script_set_attribute(attribute:"see_also", value:"https://www.cgisecurity.com/whitehat-mirror/WH-WhitePaper_XST_ebook.pdf");
 script_set_attribute(attribute:"see_also", value:"http://www.apacheweek.com/issues/03-01-24");
 script_set_attribute(attribute:"see_also", value:"https://download.oracle.com/sunalerts/1000718.1.html");
 script_set_attribute(attribute:"solution", value:
"Disable these HTTP methods. Refer to the plugin output for more information.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
 script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
 script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
 script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
 script_set_attribute(attribute:"cvss_score_source", value:"CVE-2004-2320");
 script_set_attribute(attribute:"cvss_score_rationale", value:"Tenable believes the XST vulnerability only affects Confidentiality, not Integrity (reflected in NVD's score for CVE-2010-0386)");
 script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"false");
 script_cwe_id(16, 200);

 script_set_attribute(attribute:"vuln_publication_date", value:"2003/01/20");
 script_set_attribute(attribute:"plugin_publication_date", value:"2003/01/23");

 script_set_attribute(attribute:"plugin_type", value:"remote");
 script_end_attributes();

 script_category(ACT_GATHER_INFO);
 script_copyright(english:"This script is Copyright (C) 2003-2020 E-Soft Inc.");
 script_family(english:"Web Servers");

 script_dependencies("http_version.nasl");
 script_require_ports("Services/www", 80);
 exit(0);
}

sol["apache"] = "
To disable these methods, add the following lines for each virtual
host in your configuration file :

    RewriteEngine on
    RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
    RewriteRule .* - [F]

Alternatively, note that Apache versions 1.3.34, 2.0.55, and 2.2
support disabling the TRACE method natively via the 'TraceEnable'
directive.
";

sol["iis"] = "
Use the URLScan tool to deny HTTP TRACE requests or to permit only the
methods needed to meet site requirements and policy.
";

sol["SunONE"] = '
To disable this method, add the following to the default object
section in obj.conf :

    <Client method="TRACE">
     AuthTrans fn="set-variable"
     remove-headers="transfer-encoding"
     set-headers="content-length: -1"
     error="501"
    </Client>

If you are using Sun ONE Web Server releases 6.0 SP2 or below, compile
the NSAPI plugin located at :

http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50603
';

sol["Sun_JSAS7"] = '
To disable this method, add the following to the top of the default
object in <server-instance>-obj.conf :

  <Client method="TRACE">
  AuthTrans fn="set-variable" remove-headers="transfer-encoding"
  set-headers="content-length: -1" error="501"
           </Client>

and restart the Application server.
';

# this fix also works for JSAS 8 (tested against 8.2) even though it's undocumented for that version.
# unfortunately version 8 doesn't explicitly report its version in the server header
sol["Sun_JSAS9"] = '
To disable this method, edit domain.xml, adding the "traceEnabled"
property (set to "false") to the end of the http-service element :

        <property name="traceEnabled" value="false"/>
      </http-service>

and restart the application server.  Refer to the JSAS 9 Administrator
Reference for more information :

http://docs.oracle.com/cd/E19501-01/819-3661/auto126/index.html
';

#
# The script code starts here
#

include("global_settings.inc");
include("http_func.inc");
include("http_keepalive.inc");

note = "";

port = get_http_port(default:80, embedded:TRUE);

if (! get_port_state(port)) exit(0, 'Port ' + port + ' is not open.');

banner = get_http_banner(port:port);
if ( ! banner ) exit(1, 'Unable to get the web server banner on port ' + port + '.');

if ( egrep(pattern:"^Server:.*IIS", string:banner) ) report = sol["iis"];
else if ( egrep(pattern:"^Server:.*Apache", string:banner) ) report = sol["apache"];
else if ( egrep(pattern:"^Server.*SunONE", string:banner) ) report = sol["SunONE"];
else if ( egrep(pattern:"^Server.*Sun-Java-System-Application-Server/7", string:banner) ) report = sol["Sun_JSAS7"];
else if ( egrep(pattern:"^Server.*Sun Java System Application Server (Platform Edition )?9", string:banner) ) report = sol["Sun_JSAS9"];

file = "/Nessus"+rand() + ".html";	# Does not exist

    cmd1 = http_get(item: file, port:port);
    cmd2 = cmd1;
    
    cmd1 = ereg_replace(pattern:"GET /", string:cmd1, replace:"TRACE /");
    cmd2 = ereg_replace(pattern:"GET /", string:cmd2, replace:"TRACK /");

    ua = egrep(pattern:"^User-Agent", string:cmd1, icase:TRUE);
 
    reply = http_keepalive_send_recv(port:port, data:cmd1, bodyonly:FALSE);
    if ( reply == NULL ) exit(0, 'The host is not affected on port ' + port + '.');
    if ( ereg(pattern:"^HTTP/.* 200 ", string:reply) )
    {
     r = strstr(reply, '\r\n\r\n');
     if (! r ) r = strstr(reply, '\n\n');
     full_reply = reply;
     reply = r;
     if(egrep(pattern:"^TRACE "+file+" HTTP/1\.", string:reply))
     {
	if ( ua && tolower(ua) >!< tolower(reply) ) exit(0, 'The host is not affected on port ' + port + '.');
        report += string(
          '\n',
          "Nessus sent the following TRACE request : \n",
          "\n",
          crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n",
          str_replace(find:'\r\n', replace:'\n', string:cmd1),
          crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n",
          "\n",
          "and received the following response from the remote server :\n",
          "\n",
          crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n",
          str_replace(find:'\r\n', replace:'\n', string:full_reply),
          crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n"
        );
	security_warning(port:port, extra:report);
	set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);
	exit(0);
     }
     else
     {
       note += '\n\nAlthough TRACE is enabled on the remote web server, the server\n' +
               'replies with an empty response, which prevents XST (cross-site\n' +
               'tracing).';
     }
    }

    reply = http_keepalive_send_recv(port:port, data:cmd2, bodyonly:FALSE);
    if ( ereg(pattern:"^HTTP/.* 200 ", string:reply) )
    {
     r = strstr(reply, '\r\n\r\n');
     if (! r ) r = strstr(reply, '\n\n');
     full_reply = reply;
     reply = r;
     if(egrep(pattern:"^TRACK "+file+" HTTP/1\.", string:reply))
     {
       if ( ua && tolower(ua) >!< tolower(reply) ) exit(0, 'The host is not affected on port ' + port + '.');

       report += string(
         '\n',
         "Nessus sent the following TRACK request : \n",
         "\n",
         crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n",
         str_replace(find:'\r\n', replace:'\n', string:cmd2),
         crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n",
         "\n",
         "and received the following response from the remote server :\n",
         "\n",
         crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n",
         str_replace(find:'\r\n', replace:'\n', string:full_reply),
         crap(data:"-", length:30), " snip ", crap(data:"-", length:30), "\n"
       );
       security_warning(port:port, extra:report);
       set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);
     }
     else
     {
       note += '\n\nAlthough TRACK is enabled on the remote web server, the server\n' +
               'replies with an empty response, which prevents XST (cross-site\n' +
               'tracing).';
     }
   }
exit(0, 'The host is not affected on port ' + port + '.' + note);