RedTeam Pentesting GmbH

Endeca Latitude Cross-Site Request Forgery

RedTeam Pentesting discovered a Cross-Site Request Forgery (CSRF) vulnerability in Endeca Latitude. Using this vulnerability, an attacker might be able to change several different settings of the Endeca Latitude instance or disable it entirely.

Details

Product: Endeca Latitude
Affected Versions: 2.2.2, potentially others
Fixed Versions: N/A
Vulnerability Type: Cross-Site Request Forgery
Security Risk: low
Vendor URL: N/A
Vendor Status: decided not to fix
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2013-002
Advisory Status: published
CVE: CVE-2014-2399
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2399

Introduction

Endeca Latitude is an enterprise data discovery platform for advanced, yet intuitive, exploration and analysis of complex and varied data. Information is loaded from disparate source systems and stored in a faceted data model that dynamically supports changing data. This integrated and enriched data is made available for search, discovery, and analysis via interactive and configurable applications.

(from the vendor’s homepage)

More Details

Endeca Latitude offers administrators the ability to perform different administrative and configuration operations by accessing URLs. These URLs are not secured by a randomly generated token and therefore are prone to Cross-Site Request Forgery attacks.

For example by accessing the URL http://example.com/admin?op=exit an administrator can shut down the Endeca Latitude instance. Several other URLs exist (as documented at http://docs.oracle.com/cd/E29220_01/mdex.222/admin/toc.htm#List%20of%20administrative%20operations and http://docs.oracle.com/cd/E29220_01/mdex.222/admin/toc.htm#List%20of%20supported%20logging%20variables) which can be used to trigger operations such as flushing cashes or changing the logging settings.

Proof of Concept

An attacker might prepare a website, which can trigger arbitrary functionality (see http://docs.oracle.com/cd/E29220_01/mdex.222/admin/toc.htm#List%20of%20administrative%20operations and http://docs.oracle.com/cd/E29220_01/mdex.222/admin/toc.htm#List%20of%20supported%20logging%20variables) of an Endeca Latitude instance if someone opens the attacker’s website in a browser that can reach Endeca Latitude. An easy way to implement this is to embed a hidden image into an arbitrary website which uses the corresponding URL as its source:

<img src="http://example.com/admin?op=exit" style="display:hidden" />
<img src="http://example.com/config?op=log-disable" style="display:hidden" />
[...]

Workaround

The vendor did not update the vulnerable software, but recommends to configure all installations to require mutual authentication using TLS certificates for both servers and clients, while discouraging users from installing said client certificates in browsers.

Fix

Not available. The vendor did not update the vulnerable software to remedy this issue.

Security Risk

The vulnerability can enable attackers to be able to interact with an Endeca Latitude instance in different ways. Possible attacks include the changing of settings as well as denying service by shutting down a running instance. Attackers mainly benefit from this vulnerability if the instance is not already available to them, but for example only to restricted IP addresses or after authentication. Since this makes it harder to identify potential target systems and the attack mainly allows to disturb the service until it is re-started, the risk of this vulnerability is considered to be low.

Timeline

2013-10-06 Vulnerability identified
2013-10-08 Customer approved disclosure to vendor
2013-10-15 Vendor notified
2013-10-17 Vendor responded that investigation/fixing is in progress
2014-02-24 Vendor responded that bug is fixed and scheduled for a future
CPU
2014-03-13 Vendor responded with additional information about a
potential workaround
2014-04-15 Vendor releases Critical Patch Update Advisory with little
information on the proposed fix
2014-04-16 More information requested from vendor
2014-05-02 Vendor responds with updated information
2014-06-25 Advisory released

RedTeam Pentesting offers individual penetration tests, short pentests, performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security-related areas. The results are made available as public security advisories.

More information about RedTeam Pentesting can be found at https://www.redteam-pentesting.de.