FOREGROUND SECURITY, SECURITY ADVISORY 2013-002
Corda suffers Path Disclosure in Highwire.ashx and XSS vulnerabilities
Corda Highwire allows you to generate pdf documents
Corda Server .NET Redirector version: 7.3.11.6715 allows the Web server to handle client requests for visualizations.
Corda Path Disclosure in Highwire.ashx
Corda Redirector XSS when a file isn't found
Path Disclosure
Execution of a url can expose the file system directory
/highwire.ashx?url=…/…/
XSS
Execution of a similar URL allows XSS to be run as long as the Domain of the File parameter matches the domains allowed
http://<URL>/Corda/redirector.corda/?@_FILEhttp://<URL>/?<script>alert('Text')</script><iframe src=http://www.exploit-db.com></iframe>@_TEXTDESCRIPTIONEN
Discover path structure of a drive and attempt directory/file traversal
An attacker could perform session hijacking or phishing attacks.
Systems implementing Corda/Domo products
Software has been marked EOL by Domo; Highwire products no longer supported.
http://www.domo.com
http://www.foregroundsecurity.com
This vulnerability has been discovered by Adam Willard (awillard (at) foregroundsecurity (dot) com)
July 9, 2013: Issue identified within a deployed application by Adam Willard.
July 9, 2013: Vulnerability discovered by Adam Willard.
July 12, 2013: Contacted Vendor
July 12, 2013: Vendor commented that the software is EOL with no support.
July 12, 2013: Security advisory released.
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.