UNSOLVED
K2
kevins7189-2
2 Intern
•
9 Posts
0
2545
January 12th, 2022 09:00
OMSA 10.1 Vulernable to CGI Generic SQL Injection?
Our Tenible Nessus scanner is saying that OMSA 10.1 is Vulnerable to
CGI Generic SQL
Injection (blind,
time based)
Severity HIGH
Using the GET HTTP method, Nessus found that :
+ The following resources may be vulnerable to blind SQL injection (time based) :
+ The 'searchQuery' parameter of the /help/omahip/en/search.html CGI :
/help/omahip/en/search.html?searchQuery='%20AND%20SLEEP(21)='
-------- output --------
------------------------
Synopsis: A CGI application hosted on the remote web server is potentially prone to SQL injection attack.
Description: By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower
response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database.
An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the
remote operating system.
Note that this script is experimental and may be prone to false positives
Solution: Modify the affected CGI scripts so that they properly escape arguments.
See Also: http://www.securiteam.com/securityreviews/5DP0N1P76E.html
http://www.nessus.org/u?ed792cf5
http://projects.webappsec.org/w/page/13246963/SQL%20Injection
Risk Factor: High
CVSS V3 Base Score:
1807
0
Posted January 16th, 2022 06:00
struggling to find 10.2 in a Redhat version.
1799
0
Posted January 16th, 2022 14:00
maybe you can also ask why a management application try to download external stuff and may leak sensitive information because of query to "https://fonts.googleapis.com/css?family=Noto+Sans+JP:300,400,500,700|Noto+Sans+KR:300,400,500,700|Noto+Sans+SC:300,400,500,700|Noto+Sans+TC:300,400,500,700|Noto+Sans:400,400i,700,700i|Roboto:300,300i,400,400i,500,500i,700,700i&display=swap&subset=chinese-simplified,chinese-traditional,japanese,korean"
iam not sure how smart nessus is but we have a 20sec. delay because of access to google is not possible in our management network and this will slow down OMSA when using a normal browser.
Regards,
Joerg
1577
0
Posted April 13th, 2022 12:00
Hello laakins,
I am not finding anything related in our Security Advisories and Notices:
I will do some checking and update you.
DELL-Charles R
Social Media and Communities Professional
Dell Technologies | Enterprise Support Services
#IWork4Dell
Did I answer your query? Please click on ‘Accept as Solution’. ‘Thumbs up’ the posts you like!1580
0
Posted April 13th, 2022 12:00
We are running 10.2 and get the same Nessus plugin output in addition to two additional CGI related findings. Any help would be greatly appreciated.
44967 - CGI Generic Command Execution (time-based)
DescriptionThe remote web server hosts CGI scripts that fail to adequately sanitize request strings. By leveraging this issue, an attacker may be able to execute arbitrary commands on the remote host.
Note that this script uses a time-based detection method which is less reliable than the basic method.See Alsohttps://en.wikipedia.org/wiki/Code_injection http://projects.webappsec.org/w/page/13246950/OS%20Commanding SolutionRestrict access to the vulnerable application. Contact the vendor for a patch or upgrade.Using the GET HTTP method, Nessus found that :
+ The following resources may be vulnerable to arbitrary command execution (time based) :
+ The 'searchQuery' parameter of the /help/omahip/en/search.html CGI :
/help/omahip/en/search.html?searchQuery=%26%20ping%20-n%2021%20127.0.0.1
%20%26
-------- output --------
------------------------42424 - CGI Generic SQL Injection (blind)-DescriptionBy sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a very different response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database.
An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.
Note that this script is experimental and may be prone to false positives.See Alsohttp://www.securiteam.com/securityreviews/5DP0N1P76E.html http://www.nessus.org/u?ed792cf5 http://projects.webappsec.org/w/page/13246963/SQL%20Injection SolutionModify the affected CGI scripts so that they properly escape arguments.Using the GET HTTP method, Nessus found that :
+ The following resources may be vulnerable to blind SQL injection :
+ The 'app' parameter of the /HelpViewer CGI :
/HelpViewer?file=Redirect&app=oma'||'Redirect&app=oma
-------- output --------
HTTP/1.1 302
-------- vs --------
HTTP/1.1 400
------------------------
Clicking directly on these URLs should exhibit the issue :
(you will probably need to read the HTML source)
43160 - CGI Generic SQL Injection (blind, time based)-DescriptionBy sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a slower response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database.
An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.
Note that this script is experimental and may be prone to false positives.See Alsohttp://www.securiteam.com/securityreviews/5DP0N1P76E.html http://www.nessus.org/u?ed792cf5 http://projects.webappsec.org/w/page/13246963/SQL%20Injection SolutionModify the affected CGI scripts so that they properly escape arguments.Plugin OutputUsing the GET HTTP method, Nessus found that :
+ The following resources may be vulnerable to blind SQL injection (time based) :
+ The 'searchQuery' parameter of the /help/omahip/en/search.html CGI :
/help/omahip/en/search.html?searchQuery='%20AND%20SLEEP(21)='
-------- output --------
------------------------1537
0
Posted April 14th, 2022 13:00
Hello laakins,
This was decided as not an issue for OMSA.
OMSA does not use SQL and cannot parse SQL syntax so it would not be applicable.
The other one is not applicable either. It is referencing /help/omahip/en/search.html which is just the mechanism that the OMSA Online Help is launched. search.html is the mechanism for how it pulls the relevant page to where you are and the search query isn't going to provide an attacker anything.
DELL-Charles R
Social Media and Communities Professional
Dell Technologies | Enterprise Support Services
#IWork4Dell
Did I answer your query? Please click on ‘Accept as Solution’. ‘Thumbs up’ the posts you like!
Dell-Martin S
Moderator
•
3872 Posts
•
25777 Points
1832
0
Posted January 13th, 2022 05:00
Hi kevins,
thank you for your feedback i will forward this to our Software team.
Did you try also our newest Version( 10.2)?
https://dell.to/33pX2PL
Did you have any further questions?
Regards Martin
with kind regards Martin/ Liebe Grüße Martin
Did I answer your query? Please click on ‘Mark as Accepted Answer’. ‘Thumbs up’ the posts you like!
DELL-Martin S
Social Media and Communities Professional
Dell Technologies | Enterprise Support Services
#IWork4Dell