Vulnerabilities > CVE-2011-4460 - SQL Injection vulnerability in Bestpractical RT

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN

Summary

SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by leveraging access to a privileged account.

Vulnerable Configurations

Part Description Count
Application
Bestpractical
187

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Object Relational Mapping Injection
    An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject his or her own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.
  • SQL Injection through SOAP Parameter Tampering
    An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.
  • Expanding Control over the Operating System from the Database
    An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base management system (DBMS) system includes facilities that if compromised allow an attacker complete access to the file system, operating system, and full access to the host running the database. The attacker can then use this privileged access to launch subsequent attacks. These facilities include dropping into a command shell, creating user defined functions that can call system level libraries present on the host machine, stored procedures, etc.
  • SQL Injection
    This attack exploits target software that constructs SQL statements based on user input. An attacker crafts input strings so that when the target software constructs SQL statements based on the input, the resulting SQL statement performs actions other than those the application intended. SQL Injection results from failure of the application to appropriately validate input. When specially crafted user-controlled input consisting of SQL syntax is used without proper validation as part of SQL queries, it is possible to glean information from the database in ways not envisaged during application design. Depending upon the database and the design of the application, it may also be possible to leverage injection to have the database execute system-related commands of the attackers' choice. SQL Injection enables an attacker to talk directly to the database, thus bypassing the application completely. Successful injection can cause information disclosure as well as ability to add or modify data in the database. In order to successfully inject SQL and retrieve information from a database, an attacker:

Nessus

  • NASL familyCGI abuses
    NASL idRT_3_8_12_OR_4_0_6.NASL
    descriptionAccording to its self-reported version number, the Best Practical Solutions Request Tracker (RT) running on the remote web server is version 3.x prior to 3.8.12 or version 4.x prior to 4.0.6. It is, therefore, potentially affected by the following vulnerabilities : - The
    last seen2020-06-01
    modified2020-06-02
    plugin id61434
    published2012-08-06
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/61434
    titleRequest Tracker 3.x < 3.8.12 / 4.x < 4.0.6 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(61434);
      script_version("1.9");
      script_cvs_date("Date: 2018/07/27 18:38:14");
    
      script_cve_id(
        "CVE-2011-2082",
        "CVE-2011-2083",
        "CVE-2011-2084",
        "CVE-2011-2085",
        "CVE-2011-4458",
        "CVE-2011-4459",
        "CVE-2011-4460",
        "CVE-2011-5092",
        "CVE-2011-5093"
      );
      script_bugtraq_id(53660);
    
      script_name(english:"Request Tracker 3.x < 3.8.12 / 4.x < 4.0.6 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Request Tracker.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote web server is running a Perl application that is affected
    by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its self-reported version number, the Best Practical
    Solutions Request Tracker (RT) running on the remote web server is
    version 3.x prior to 3.8.12 or version 4.x prior to 4.0.6. It is,
    therefore, potentially affected by the following vulnerabilities :
    
      - The 'vulnerable-passwords' script fails to update the
        password-hash of disabled users, which could enable an
        attacker to more easily determine plaintext passwords
        using brute force methods. (CVE-2011-2082)
    
      - Multiple cross-site scripting vulnerabilities exist that
        an attacker can utilize to execute script code with the
        user's credentials. (CVE-2011-2083)
    
      - A remote, authenticated attacker can read the hashes of
        former passwords and the ticket correspondence history
        by accessing a privileged account. (CVE-2011-2084)
    
      - Multiple cross-site request forgery vulnerabilities
        exist which a remote attacker can exploit to hijack user
        authentication. (CVE-2011-2085)
    
      - A remote code execution vulnerability exists if the
        optional VERP configuration options (VERPPrefix and
        VERPDomain) are enabled. (CVE-2011-4458)
    
      - Groups are not properly disabled, allowing users in
        disabled groups to gain escalated privileges.
        (CVE-2011-4459)
    
      - A remote, authenticated attacker can inject SQL commands
        by utilizing access to a privileged account, allowing
        the disclosure or manipulation of arbitrary data on the
        back-end database. (CVE-2011-4460)
    
      - An unspecified vulnerability exists that allows remote
        attackers to gain privileges or execute a restricted
        amount of arbitrary code. (CVE-2011-5092)
    
      - The DisallowExecuteCode option is not properly
        implemented and allows a remote, authenticated attacker
        to bypass intended access restrictions and execute
        arbitrary code by using access to a privileged account.
        (CVE-2011-5093)
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      #http://blog.bestpractical.com/2012/05/security-vulnerabilities-in-rt.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ebd34bfd");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Request Tracker 3.8.12 / 4.0.6 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/05/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/05/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/06");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:bestpractical:rt");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("rt_detect.nasl");
      script_exclude_keys("Settings/disable_cgi_scanning");
      script_require_keys("installed_sw/RT", "Settings/ParanoidReport");
      script_require_ports("Services/www", 80);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("install_func.inc");
    
    app = 'RT';
    get_install_count(app_name:app, exit_if_zero:TRUE);
    
    port = get_http_port(default:80);
    install = get_single_install(app_name:app, port:port, exit_if_unknown_ver:TRUE);
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    path = install["path"];
    version = install["version"];
    install_loc = build_url(port:port, qs:path + "/");
    
    ver = split(version, sep:'.', keep:FALSE);
      for (i=0; i<max_index(ver); i++)
        ver[i] = int(ver[i]);
    
    # Versions less than 3.8.12 / 4.0.6 are affected.
    if (
      ver[0] < 3 ||
      (
        ver[0] == 3 &&
        (
          ver[1] < 8 || 
          (ver[1] == 8 && ver[2] < 12) ||
          (ver[1] == 8 && ver[2] == 12 && version =~ "(rc|pre|alpha|RC|test|CH|beta|preflight)")
        )
      ) ||
      (
        ver[0] == 4 && ver[1] == 0 &&
        (
          (ver[2] < 6) ||
          (ver[2] == 6 && version =~ "(rc|pre|alpha|RC|test|CH|beta|preflight)")
        )
      )
    )  
    {
      set_kb_item(name:"www/"+port+"/XSS", value:TRUE);
      set_kb_item(name:"www/"+port+"/XSRF", value:TRUE);
      set_kb_item(name:"www/"+port+"/SQLInjection", value:TRUE);
    
      if (report_verbosity > 0)
      {
        report =
          '\n  URL               : ' +install_loc+
          '\n  Installed version : ' +version+
          '\n  Fixed version     : 3.8.12 / 4.0.6\n';
        security_hole(port:port, extra:report);
      }
      else security_hole(port);
    }
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_loc, version);
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2480.NASL
    descriptionSeveral vulnerabilities were discovered in Request Tracker, an issue tracking system : - CVE-2011-2082 The vulnerable-passwords scripts introduced for CVE-2011-0009 failed to correct the password hashes of disabled users. - CVE-2011-2083 Several cross-site scripting issues have been discovered. - CVE-2011-2084 Password hashes could be disclosed by privileged users. - CVE-2011-2085 Several cross-site request forgery vulnerabilities have been found. If this update breaks your setup, you can restore the old behaviour by setting $RestrictReferrer to 0. - CVE-2011-4458 The code to support variable envelope return paths allowed the execution of arbitrary code. - CVE-2011-4459 Disabled groups were not fully accounted as disabled. - CVE-2011-4460 SQL injection vulnerability, only exploitable by privileged users. Please note that if you run request-tracker3.8 under the Apache web server, you must stop and start Apache manually. The
    last seen2020-03-17
    modified2012-06-29
    plugin id59758
    published2012-06-29
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59758
    titleDebian DSA-2480-4 : request-tracker3.8 - several vulnerabilities
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_E0A969E4A51211E190B4E0CB4E266481.NASL
    descriptionBestPractical report : Internal audits of the RT codebase have uncovered a number of security vulnerabilities in RT. We are releasing versions 3.8.12 and 4.0.6 to resolve these vulnerabilities, as well as patches which apply atop all released versions of 3.8 and 4.0. The vulnerabilities addressed by 3.8.12, 4.0.6, and the below patches include the following : The previously released tool to upgrade weak password hashes as part of CVE-2011-0009 was an incomplete fix and failed to upgrade passwords of disabled users. RT versions 3.0 and above contain a number of cross-site scripting (XSS) vulnerabilities which allow an attacker to run JavaScript with the user
    last seen2020-06-01
    modified2020-06-02
    plugin id59283
    published2012-05-29
    reporterThis script is Copyright (C) 2012-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/59283
    titleFreeBSD : RT -- Multiple Vulnerabilities (e0a969e4-a512-11e1-90b4-e0cb4e266481)