Security Advisories and Notifications


Security Advisory: (BEA00-04.00)

From: Oracle Corporation

Minor Subject: Compilation and execution of arbitrary files in web document root directory

Product(s) Affected: BEA WebLogic Server and Express

It has come to our attention that there is a common mis-configuration that has the potential to lead to a security vulnerability in BEA WebLogic Server and Express on all platforms. BEA treats such possibilities with the highest degree of urgency and does everything possible to ensure the security of all customer assets. As a result, we strongly suggest the following action:

      I. Read the following advisory.

      II. Apply the suggested action.

      III. If you know of any additional users interested in future security advisories, please forward them the registration instructions below.


I. ADVISORY

Recently, Foundstone, Inc., a security consulting and training firm, reported a potential security vulnerability in BEA WebLogic Server and Express. This potential security vulnerability could result in the ability for applications to write files to the web document root directory that could then be viewed or executed by clients. When the deployment environment is not properly locked down, a user may have inappropriate write access to the web document root directory. This user could knowingly or unknowingly execute a malicious application that may insert executable code in JSP or jHTML files residing in the web document root directory. This causes BEA WebLogic Server and Express servlet handlers to compile and execute the extraneous code . This type of vulnerability has the potential to allow an attacker to gain administrative control of the operating system, or application server, or to obtain unauthorized information.

The theory behind similar vulnerabilities is described in the CERT Advisory CA-2000-02.

The following BEA WebLogic Server Server and Express releases are affected by this behavior:
  • Version: The J-Engine in BEA WebLogic Enterprise 5.1.x
  • Version: All releases of BEA WebLogic Server and Express are affected.

CAUSE

By default, BEA WebLogic Server and Express use a single directory, commonly known as the web document root directory, as the location that contains static content (HTML files, images, etc.) and dynamic content (JSP, jHTML, etc.). A potential vulnerability may occur if a malicious application is allowed to create or modify files containing dynamic content within the web document root directory.

If an application, be it malicious, misconfigured, or through an anomaly, is capable of modifying existing files in the web document root directory, there is the potential that it could insert executable code in the form of JSP or jHTML tags in an existing file. If the particular file provides dynamic content, the inserted code would be executed the next time the file was served to a client.

The same type of situation could occur if the application created a new file containing executable code. But in order for this vulnerability to be exploited, the client would need to have knowledge of the location and name of the newly created file. As a result, collaboration would be required between the developer of the "rogue" application or knowledge of its use and the client.


II. SUGGESTED ACTION

Oracle strongly recommends the following course of actions:
  • It is essential to implement necessary security measures to protect the production environment. BEA provides a set of guidelines for locking down the environment in the BEA WebLogic Server and Express documentation at
    http://www.weblogic.com/docs51/admindocs/lockdown.html.
  • In addition, to prevent the scenario under which this vulnerability could occur, Oracle strongly recommends the following supplemental security measures:
    • BEA WebLogic Server or Express should only be installed on disks that support the ability to control access to specific directories and files (e.g., secure file system) to one or more specific user accounts. The use of an encrypted file system can be used to heighten the level of security at the cost of performance.
    • A special operating system specific user account, for example wls_owner, should be established specifically to run BEA WebLogic Server or Express. This user account should be granted only the minimum operating system rights and privileges that are essential for successful execution of an application.
    • The user account , e.g., wls_owner, should be the only user account that can access, create, or modify files in the web document root directory. This protection limits the ability of other applications executing on the same machine as BEA WebLogic Server or Express from accessing this directory.
    • Directories containing JSP or jHTML files should be protected so that they can only be accessed or modified by the user account, e.g., wls_owner, under which BEA WebLogic Server or Express is executed. Read-only access can be granted for administrative accounts, such as root or Administrator, for the purpose of archiving (e.g., backup).
    • The user account (e.g. wls_owner) that is used to create JSP and jHTML files, should be granted read/execute only access to these files. This protective measure will prevent the user account from knowingly or unknowingly writing to these files.
      1. Remove any unnecessary applications from the machine(s) that will be used to host BEA WebLogic Server or Express. If it is not possible to remove an application, review the security environment under which the application will be executed. Applications executed with privileges (e.g., under a privileged user account, applications with setuid privilege) should be reviewed carefully for the directories they access. BEA advises that no other application share the user account, e.g., wls_owner, which will be used to run BEA WebLogic Server or Express.
      2. Consider the use of an Intrusion Detection System (IDS) to detect attempts to modify the production environment. If the operating system supports security auditing of file and directory access, BEA recommends using audit logging to track any denied directory or file access violations.


SECURITY COMMUNICATIONS

Oracle strongly suggests that customers apply the remedies recommended in all our security advisories. Oracle also urges customers to apply every Service/Maintenance Pack as they are released. Service/Maintenance Packs include a roll-up of all bug fixes for each version of the product, as well as each of the prior Service/Maintenance Packs. Service/Maintenance Packs and information about them can be found at: http://www.oracle.com/technology/software/products/ias/bea_main.html

Note: Information about securing WebLogic Server and WebLogic Express can be found at http://edocs.bea.com/wls/docs103/security.html. Specific lockdown information is provided at http://e-docs.bea.com/wls/docs103/lockdown/index.html. We strongly encourage you to review this documentation to ensure your server deployment is securely configured.

As a policy, if there are any security-related issues with any Oracle product, Oracle will distribute an advisory and instructions with the appropriate course of action. Because the security of your site, data, and code is our highest priority, we are committed to communicating all security-related issues clearly and openly.

All previous advisories can be viewed at: http://www.oracle.com/technology/deploy/security/wls-security.

Additional users who wish to register for product advisory distribution should follow the registration directions at: http://www.oracle.com/technology/deploy/security/alerts.htm.

Security issues can be reported to Oracle by following the directions at: http://www.oracle.com/technology/deploy/security/alerts.htm.

Thank you,
Oracle Corporation