Cross-site scripting in CA Automic Workload Automation Web Interface

Project Description

The use of an outdated Java UI framework makes CA Automic AWI (formerly Automic or UC4) susceptible to persistent Cross-Site Scripting (XSS). Attackers with limited privileges in AWI can exploit this vulnerability to take over other users’ accounts and to escalate privileges.


Vendor description

“The modern enterprise needs to orchestrate a complex, diverse landscape of applications, platforms and technologies. Workload automation can prove a critical differentiator, but only if it provides intelligent automation driven by data analytics.
[…]
CA Automic Workload Automation gives you the agility, speed, visibility and scalability needed to respond to the constantly changing technology landscape. It centrally manages and automates the execution of business processes end-to-end; across mainframe, cloud and hybrid environments in a way that never stops—even when doing an upgrade to the next version.”

 

Source: https://www.ca.com/us/products/workload-automation-solution.html

Business recommendation

Be aware that restrictions on privileges can be bypassed and that attackers may be able to take over other users’ accounts. SEC Consult recommends to apply the vendor patch as soon as possible.

Vulnerability overview/description

The Automation Engine Web Interface, short AWI, is susceptible to a persistent cross-site scripting attack (XSS). The origin of this vulnerability is in an outdated version of the Vaadin framework (version 7.7.9), which is heavily used in the implementation of the UI. This version of the Vaadin framework is vulnerable to an XSS vulnerability in tooltips. If attackers can control the content of tooltips created with the framework, they can execute arbitrary JavaScript code in the context of the user viewing the tooltip. AWI uses tooltips for various data-fields, e.g. for the title of objects created. Thus, if a user has the privilege to create or edit objects, they can inject JavaScript code, which will get executed by other users if they move their cursor over the text containing the tooltip.

 

Proof of concept

The vulnerability can be reproduced by creating/editing any object in AWI and using a normal JavaScript payload, e.g. with an onerror handler.

Because tooltips are only shown in AWI when the text length exceeds the column width, the text needs to be padded with some sample-text to make sure the JavaScript code gets executed.

 

Vulnerable / tested versions

The tested version of AWI was 12.2.0.

 

Vendor contact timeline

2018-10-18:SEC Consult contacts vendor through vuln@ca.com via encrypted email.
2018-10-25:Vendor confirms the receipt of the vulnerability information.
2018-11-22:Vendor confirms the vulnerability and asks for postponement of advisory release date.
2018-12-11:Vendor provides planned patch numbers.
2019-01-17:Vendor informs SEC Consult that patches have been published.
2019-01-18:CA Technologies and SEC Consult define January 24th 2019 as release date for SEC Consult advisory and CA Technologies Security Notice.
2019-01-24:Public release of security advisory.

Solution

The vendor provides patched versions:

Automic.Web.Interface 12.0.6 HF2
Automic.Web.Interface 12.1.3 HF3
Automic.Web.Interface 12.2.1 HF1

Available from: https://downloads.automic.com/

The vendor released a security advisory which is available here.

Workaround

None.

 

Advisory URL

https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html

 

EOF M. Nimmerrichter / @2019

 

 

Interested to work with the experts of SEC Consult? Send us your application.
Want to improve your own cyber security with the experts of SEC Consult?
Contact our local offices.

Project Details

  • TitleCross-site scripting
  • ProductCA Automic Workload Automation Web Interface (AWI), formerly Automic Automation Engine (UC4)
  • Vulnerable version12.0, 12.1, 12.2
  • Fixed version12.0.6 HF2, 12.1.3 HF3, 12.2.1 HF1
  • CVE numberCVE-2019-6504
  • Impactmedium
  • Homepagehttps://www.ca.com
  • Found2018-10-15
  • ByMarc Nimmerrichter (Office Vienna) SEC Consult Vulnerability Lab

Cookie Preference

Please select an option. You can find more information about the consequences of your choice at Help.

Select an option to continue

Your selection was saved!

Help

Help

To continue, you must make a cookie selection. Below is an explanation of the different options and their meaning.

  • Accept all cookies:
    All cookies such as tracking and analytics cookies.
  • Accept first-party cookies only:
    Only cookies from this website.
  • Reject all tracking cookies:
    No cookies except for those necessary for technical reasons are set.

You can change your cookie setting here anytime: Blog. Blog

Back