diff --git a/README.md b/README.md index 86b7251..80e2df9 100644 --- a/README.md +++ b/README.md @@ -141,6 +141,7 @@ Apache Wicket Arbitrary Resource Access (CVE-2015-2080) * Apache Axis2 - Web Service Enumeration * Apache Axis2 - Admin Console Weak Password * Apache Axis2 - Local File Include Vulnerability (OSVDB 59001) + * Apache Axis2 - Happy Axis ## How to install ? @@ -173,6 +174,7 @@ Apache Wicket Arbitrary Resource Access (CVE-2015-2080) * Added check for Oracle Glassfish version * Added check for Oracle Weblogic version * Added check Apache Struts OGNL Console + * Added check for Happy Axis ### Version 1.2.3dev (26 Feb, 2015): diff --git a/src/main/java/burp/j2ee/issues/impl/ApacheAxis.java b/src/main/java/burp/j2ee/issues/impl/ApacheAxis.java index b9abdbb..c847be2 100644 --- a/src/main/java/burp/j2ee/issues/impl/ApacheAxis.java +++ b/src/main/java/burp/j2ee/issues/impl/ApacheAxis.java @@ -35,6 +35,14 @@ public class ApacheAxis implements IModule { + "the Apache Axis2 console. It was possible to enumerate the registered " + "Web Services"; + private static final String TITLE_HAPPY_AXIS = "Happy Axis Page Available"; + private static final String DESCRIPTION_HAPPY_AXIS = "J2EEscan identified " + + "the Happy Axise page available. This test resources allows to detect if some " + + "external libreries/dependencies are missing
The test page also could contains" + + "internal system information, such as internal classpaths, env variables and internal system properties" + + "

References:
" + + "http://axis.apache.org/axis/java/install.html#Validate_Axis_with_happyaxis"; + private static final String TITLE_AXIS_ADMIN_CONSOLE = "Apache Axis2 - Admin Console"; private static final String DESCRIPTION_AXIS_ADMIN_CONSOLE = "J2EEscan identified " + "the Apache Axis2 administration console"; @@ -55,13 +63,25 @@ public class ApacheAxis implements IModule { private static final List AXIS_PATHS = Arrays.asList( "/axis2/", - "/dswsbobje/" //SAP BusinessObjects path + "/axis/", + "/dswsbobje/", // SAP BusinessObjects path + "/jboss-net/" // JBoss + ); + + private static final List HAPPY_AXIS_PATHS = Arrays.asList( + "/dswsbobje/happyaxis.jsp", // SAP BusinessObjects path + "/jboss-net/happyaxis.jsp", // JBoss + "/happyaxis.jsp", + "/axis2/axis2-web/HappyAxis.jsp", + "/axis2-web/HappyAxis.jsp", + "/axis/happyaxis.jsp" ); private static final String AXIS_SERVICES_PATH = "/services/listServices"; private static final String AXIS_ADMIN_PATH = "/axis2-admin/"; private static final byte[] GREP_STRING_AXIS_SERVICE_PAGE = "List Services".getBytes(); + private static final byte[] GREP_STRING_HAPPY_AXIS = "Axis Happiness Page".getBytes(); private static final byte[] GREP_STRING_AXIS_XML = "> credentials; WeakPassword wp = new WeakPassword(); credentials = wp.getCredentials(); - List listOfPwd = new ArrayList<>(); for (Map.Entry credential : credentials) { @@ -145,6 +164,52 @@ public List scan(IBurpExtenderCallbacks callbacks, IHttpRequestRespo String protocol = url.getProtocol(); Boolean isSSL = (protocol.equals("https")); + /** + * Test for Happy Axis + * http://axis.apache.org/axis/java/install.html#Validate_Axis_with_happyaxis + * + * + */ + for (String HAPPY_AXIS_PATH : HAPPY_AXIS_PATHS) { + + try { + + // Test for happy axies + URL happyAxisUrlToTest = new URL(protocol, url.getHost(), url.getPort(), HAPPY_AXIS_PATH); + byte[] happyAxisTest = helpers.buildHttpRequest(happyAxisUrlToTest); + byte[] happyAxisResponse = callbacks.makeHttpRequest(url.getHost(), + url.getPort(), isSSL, happyAxisTest); + IResponseInfo happyAxisInfo = helpers.analyzeResponse(happyAxisResponse); + + if (happyAxisInfo.getStatusCode() == 200) { + + String happyAxisResp = helpers.bytesToString(happyAxisResponse); + String happyAxisRespBody = happyAxisResp.substring(happyAxisInfo.getBodyOffset()); + + // look for matches of our active check grep string + List matchHappyAxis = getMatches(helpers.stringToBytes(happyAxisRespBody), + GREP_STRING_HAPPY_AXIS, helpers); + + if ((matchHappyAxis.size() > 0)) { + stdout.println("Happy Axis detected " + happyAxisUrlToTest.toString()); + + issues.add(new CustomScanIssue( + baseRequestResponse.getHttpService(), + happyAxisUrlToTest, + new CustomHttpRequestResponse(happyAxisTest, happyAxisResponse, baseRequestResponse.getHttpService()), + TITLE_HAPPY_AXIS, + DESCRIPTION_HAPPY_AXIS, + "Restrict access to Happy Axis debug page", + Risk.Medium, + Confidence.Certain + )); + } + } + } catch (MalformedURLException ex) { + stderr.println("Malformed URL Exception " + ex); + } + } + for (String AXIS_PATH : AXIS_PATHS) { try { @@ -298,4 +363,4 @@ public List scan(IBurpExtenderCallbacks callbacks, IHttpRequestRespo return issues; } -} +} \ No newline at end of file