Medium
Advisory ID
ZSL-2016-5306
Release Date
16 February 2016
Affected Version
7.8.1 (b2016012216) and 7.8.0 (b2015101414)
Tested On
Microsoft Windows 7 Professional SP1 (EN), Microsoft Windows 7 Ultimate SP1 (EN), Ubuntu Linux 14.04, Mac OS X, HP-UX Itanium, Jetty(9.2.z-SNAPSHOT), Java/1.8.0_73, Java/1.8.0_66
Summary
Ignition is a powerful industrial application platform with fully integrated development tools for building SCADA, MES, and IIoT solutions.
Description
Remote unauthenticated atackers are able to read arbitrary data from other HTTP sessions because Ignition uses a vulnerable Jetty server. When the Jetty web server receives a HTTP request, the below code is used to parse through the HTTP headers and their associated values. The server begins by looping through each character for a given header value and checks the following:
- On Line 1164, the server checks if the character is printable ASCII or not a valid ASCII character. - On Line 1172, the server checks if the character is a space or tab. - On Line 1175, the server checks if the character is a line feed. - If the character is non-printable ASCII (or less than 0x20), then all of the checks above are skipped over and the code throws an 'IllegalCharacter' exception on line 1186, passing in the illegal character and a shared buffer.
File: jetty-http\src\main\java\org\eclipse\jetty\http\HttpParser.java
---------------------------------------------------------------------------
920: protected boolean parseHeaders(ByteBuffer buffer)
921: {
[..snip..]
1163: case HEADER_VALUE:
1164: if (ch>HttpTokens.SPACE || ch<0)
1165: {
1166: _string.append((char)(0xff&ch));
1167: _length=_string.length();
1168: setState(State.HEADER_IN_VALUE);
1169: break;
1170: }
1171:
1172: if (ch==HttpTokens.SPACE || ch==HttpTokens.TAB)
1173: break;
1174:
1175: if (ch==HttpTokens.LINE_FEED)
1176: {
1177: if (_length > 0)
1178: {
1179: _value=null;
1180: _valueString=(_valueString==null)?takeString():(_valueString+" "+takeString());
1181: }
1182: setState(State.HEADER);
1183: break;
1184: }
1185:
1186: throw new IllegalCharacter(ch,buffer);
Disclosure Timeline
14.01.2016Vulnerability discovered.
20.01.2016Vendor contacted.
15.02.2016No response from the vendor.
16.02.2016Public security advisory released.
22.02.2016Vendor informs that version 7.8.1 is patched with Jetty 9.3.3v20150827.