Re: BEA WebLogic internal hostname disclosure

From: Kurt Seifried (kurtat_private)
Date: Thu Apr 03 2003 - 01:00:37 PST

Next message: drG4njubas: "Sakki's guestbook V.1.01 script injection vulnerability."

Previous message: dong-h0un U: "passlogd sniffer remote buffer overflow root exploit."
In reply to: Michael Hendrickx: "BEA WebLogic internal hostname disclosure"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> Hi,
>
> During a penentration test, I discovered that the BEA Weblogic Server
> reveals it hostname (on windows machines NetBIOS name) while sending the
> following request:
>
> GET . HTTP/1.0\r\n\r\n
>
> On older systems (Weblogic 7.0), a simple "BLAH . BLAH\r\n\r\n" will do
> the same trick.  BEA was contacted about two weeks ago, but I haven't
> heard from them (yet).
>
> Regards,
> Michael

Reveals hostname:
./
.//
.//////////////
.%20
.%20%20
..

Does not reveal hostname:
...
.a
.1
.\
.%21

Seems that a single "." or a "." followed by a "special" character such as
"/" or %20 (space) works. Don't know what other "special" characters work.


Kurt Seifried, kurtat_private
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/

Next message: drG4njubas: "Sakki's guestbook V.1.01 script injection vulnerability."
Previous message: dong-h0un U: "passlogd sniffer remote buffer overflow root exploit."
In reply to: Michael Hendrickx: "BEA WebLogic internal hostname disclosure"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Apr 03 2003 - 15:08:38 PST