Some vulnerabilities have been discovered in vCAP, which can be exploited by malicious people to disclose sensitive information, conduct cross-site scripting attacks, or cause a DoS (Denial of Service).

1) An input validation error within the handling of HTTP requests can be exploited to access arbitrary files outside the web root via directory traversal attacks.

2) An error in the processing of parameter values using a malformed URL encoded representation can be exploited to crash vCAP.EXE by sending a specially crafted HTTP request.

Example:
http://[host]/%AA%A

The web service needs to be restarted manually before functionality is restored.

3) Input passed in an URL for a non-existent resource is not properly sanitised before being returned to users in an error message. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

Example:
http://[host]:6100/[code]

4) Input passed to the "statusmsg" parameter in RegisterPage.cgi is not properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of a vulnerable site.

Example:
http://[host]:6100/RegisterPage.cgi?statusmsg=[code]&session=1

The vulnerabilities have been confirmed in version 1.7.0. Other versions may also be affected.

Solution
Restrict access to trusted users only and filter malicious characters and character sequences in a proxy.

Provided and/or discovered by
1-2) secuma massime, MorX Security Research Team
3-4) AliG

Changelog
Further details available in Customer Area

Original Advisory
http://www.morx.org/vcap.txt

Deep Links
Links available in Customer Area