Exploiting the parameter user-agent in ADF application

hi all
i'm using jdeveloper 11g and when information security test my APP they gave me report with Security Risk MED
i try to solve all problems but still a one
i dont know how to solve it and they insist to prevent deployment unless resolve this issue
150022Syntax Error Occurred
Category Information Disclosure
Threat
A test payload generated a syntax error within the Web application. This often points to a problem with input validation routines or lack of filters on
user-supplied content.
Impact
A malicious user may be able to create a denial of service, serious error, or exploit depending on the error encountered by the Web application
Detection Information
Parameter It has been detected by exploiting the parameter user-agent
The payloads section will display a list of tests that show how the param could have been exploited to collect the
information
#1 User-Agent: Mozilla/*
#2 Cookie: JSESSIONID=6vYgRG1GGNyQxszysL4nnyg53SH48BMBkQvvnPhNKTCNvTy2gyKD!569345819
please heeeeeeeeeeeeeeeelp

hi Timo Hahn
thnx for ur replay
i m using jdev 11.1.2.1 and update it to 11.1.2.3 to try to solve but it still.
all fields in the form are required and have a validator .
the report for this issue is :
#1 Response
Vulnerable to slow HTTP headers attack Server resets timeout after accepting header data from peer.
150022Syntax Error Occurred (1)
150022Syntax Error Occurred
URL: http://10.1.156.101:7001/ecs/faces/default New
Finding # 85633583
Category Information Disclosure
CWE -
OWASP A6 Security Misconfiguration
WASC WASC-15 APPLICATION
MISCONFIGURATION
First Time Detected 18 Mar 2013 11:07AM GMT
Last Time Detected 18 Mar 2013 11:07AM GMT
Last Time Tested 18 Mar 2013 11:07AM GMT
Times Detected 1
Details
Threat
A test payload generated a syntax error within the Web application. This often points to a problem with input validation routines or lack of filters on
user-supplied content.
Impact
A malicious user may be able to create a denial of service, serious error, or exploit depending on the error encountered by the Web application
Detection Information
Parameter It has been detected by exploiting the parameter user-agent
The payloads section will display a list of tests that show how the param could have been exploited to collect the
information
Authentication In order to detect this vulnerability, no authentication has been required.
Payloads (5 instances)
#1 Request
Payload /*
Request GET http://10.1.156.101:7001/ecs/faces/default
#1 User-Agent: Mozilla/*
#2 Cookie: JSESSIONID=6vYgRG1GGNyQxszysL4nnyg53SH48BMBkQvvnPhNKTCNvTy2gyKD!569345819;
Error 500--Internal Server Error
java.lang.IllegalArgumentException: version must be non-empty
at org.apache.myfaces.trinidad.context.Version._checkNonEmptyString(Version.java:200)
at org.apache.myfaces.trinidad.context.Version.(Version.java:69)
at org.apache.myfaces.trinidad.context.Version.(Version.java:54)
at org.apache.myfaces.trinidadinternal.agent.TrinidadAgentImpl.(TrinidadAgentImpl.java:55)
at org.apache.myfaces.trinidadinternal.context.RequestContextImpl.getAgent(RequestContext
please any help

Similar Messages

Content repository FD does not exist :user agent sap web application server

Hi All
i am using 3rd party software(dms SERVER) and connecting it using archive link interface SAP HTTP 4.5 AL
i have created a new repository with name FD using tcode OAC0.when i give inputs in OACO and click on test connection it gives me information Content repository FD does not exist
here is my HTTP trace at receiver content server side
TRACE:(5) - GET /Default.aspx?serverInfo&pVersion=0045&contRep=FD HTTP/1.0
TRACE:(5) - user-agent: SAP Web Application Server (1.0;700)
TRACE:(5) - host: SERVERIP:PORT
TRACE:(5) - accept-encoding: gzip
TRACE:(5) -
--> C05 --> S06 ==== (15.583) Request <GET /Default.aspx?serverInfo&pVersion=0045&contRep=FD HTTP/1.0>
--> C05 --> S06 GET /Default.aspx?serverInfo&pVersion=0045&contRep=FD HTTP/1.0
--> C05 --> S06 user-agent: SAP Web Application Server (1.0;700)
--> C05 --> S06 host: SERVERIP:PORT
--> C05 --> S06 accept-encoding: gzip
--> C05 --> S06 ==== Body 0 bytes
--> C05 --> S06 Body =>
Sockets 6 of 4,5,6 need checking ####
TRACE:(6) - HTTP/1.1 200 OK
TRACE:(6) - Cache-Control: private
TRACE:(6) - Content-Length: 189
TRACE:(6) - Content-Type: text/plain; charset=utf-8
TRACE:(6) - Server: Microsoft-IIS/7.5
TRACE:(6) - X-AspNet-Version: 2.0.50727
TRACE:(6) - boundary:
TRACE:(6) - X-dateC: 2010-10-22
TRACE:(6) - X-timeC: 07:07:23
TRACE:(6) - X-dateM: 2010-10-22
TRACE:(6) - X-timeM: 07:07:23
TRACE:(6) - X-contentRep: FD
TRACE:(6) - X-numberComps: 1
TRACE:(6) - X-docId: 0
TRACE:(6) - X-docStatus: online
TRACE:(6) - X-pVersion: 0045
TRACE:(6) - X-ContentServer: contentServer=Server ip;contentServerPort='9025;pVersion='0045';id='DMSSRV1'
TRACE:(6) - X-Powered-By: ASP.NET
TRACE:(6) - Date: Fri, 22 Oct 2010 13:37:23 GMT
TRACE:(6) - Connection: close
TRACE:(6) -
TRACE:(6) - serverType='DMSSRV1';1;serverVersion=12;serverPatch=0;serverBuild=180;pVersion='0045';serverStatus=running;serverStatusDescription=;serverDate='2010-10-22';serverTime='07:07:23';startUpDate='2010-10-22';startUpTime='07:07:23';lastAccessDate='2010-10-22';lastAccessTime='07:07:23';contRep='FD';contRepStatus=defined;contRepStatusDescription=;contRepDescription=Content-Repository Test;contentStorageHost=localhost;contentStorageName=FD;secKeyVerification=y;defaultDocProt=rucd;
one change which i have observed in this trace is .. this trace is showing trace agent as SAP Web application server ... ideally it should show user agent :SAP HTTP
Please suggest me some solution.
Thanks
sandeep

Dear all,
my issue is resolved.I solved my issue myself
solution: SAP sends HTTP request in the form of URL like
http://serverip:port/GET /Default.aspx?serverInfo&pVersion=0045&contRep=FD HTTP/1.0
Now your response should contain string contRep="FD"
dont forget double quotes on repository name coz SAP program matches string with double quotes. if you will return value like this contRep=FD
this will through error.
Thanks
sandeep sharma

How to add user search in adf application?

hi,iam using jdeveloper 11.1.2.3.0 my requirement as follows ....i have a form ex:company_master in this form i need to search relavent data to master / user need to search the data in internet how to achieve this requirement in adf

The question is about adding "user search in adf application?"
"You can create search forms that allow users to enter search criteria into input fields for known attributes of an object. "
Creating ADF Databound Search Forms - 11g Release 1 (11.1.1.5.0)

My Safari systematically use the wrong User Agent and I cannot fix it

My Safari systematically use the wrong User Agent and I cannot fix it

Back up all data before proceeding.
Please triple-click anywhere in the line below on this page to select it:
defaults delete -app Safari CustomUserAgent
Copy the selected text to the Clipboard by pressing the key combination command-C. Quit Safari.
Launch the built-in Terminal application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Terminal in the icon grid.
Paste into the Terminal window by pressing the key combination command-V.
Wait for a new line ending in a dollar sign ($) to appear below what you entered. You can then quit Terminal. Test.

Questions for the end users in Building an application.

Questions for the end users in Building an application.
Hello,
I am assigned a project in building a CF application. As far
as the business requirements, I have an idea from the MIS people.
However, I have a meeting with direct users and I have to ask
questions to add to my requirements. I am still a beginner in this
but I need to ask questions.
Can anyone give me tips? what basic / important questions?

For starters,
DO:
Ask them to discuss what they want to do with the application
Try to understand their level of computer literacy
Keep your conversation non-technical
Continue to interact with the users during the design and
development process
Try to identify a "champion" with whom you can interface as the
project progresses
DON'T:
Use technical terms or discuss technical issues
Talk down to them
Promise delivery dates until you have documented their
requirements and they have approved them

Multiple user sessions for ADF application

Hi All,
We have a ADF application with 3-4 pages starting with a login screen.
Assume we have two users, user1 and user2. In same system but different browser windows, when both users are logging in, only user2 's session is active. Though user1 logged in first and is able to perform transactions, the moment user2 logs in, user1's session is being over-written by user2 (user1's window now displays user2's information). I have observed the URL of user1 window which now changes to user2's URL (_adf.ctrl-state parameter of user2 is displayed in user1 browser)
How do we overcome this?? We have a requirement to be able to open multiple user sessions.
We are using JDeveloper 11.1.2.3.0 and browsers being used are IE 8, IE9 and chrome.
Thanks,
Deepti

Hi,
Continuation to my above question
I am using these two statements in my code..
ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContext();
HttpSession httpSession = (HttpSession)ectx.getSession(true);
On any event in Window1, I gues it is getting the context and session of window2(this being the latest)..
Shouldnt it return the context and session of the current window instead of the latest window???
This problem is well explained here
internet explorer 8 - How to avoid session sharing provided by IE8 programmatically in Java EE application? - Stack Over…
I want to know.. what is the best way to handle this in ADF... We are using managed beans with request scope and using HttpSession to store few values like user Id.

How to Generate Audit table entries for user navigation in ADF application?

Hi all,
I have a requirement that I need to have audit table entries for each user action in my application. Along with entries for user actions like insertion,deletion and updation I also need to have entries in the audit log even when a user simply navigates to or views any page.
Although I was successful in creating the entries for user actions like insertion,deletion and updation I failed to do so for simple user navigation through the pages.
Can anyone please help me out?
Thanks in advance,
Arijit

Hi,
Thanks for the quick reply. I am using JSF for my ADF application.Could u please elaborate how to use the PhaseListener for Auditing user navigation?
Arijit

Bad http.agent in Java properties : a bug in the HTTP user-agent string?

Hi all,
Me :
I'm patching AWSTATS (web log analyzer tool) in order to recognize which Java version has
been used to download files.
Context of the problem :
Each time a Java program (or applet) is downloading a file (for example .class, .png, .html)
from a web server, a line will be added in the web server log file. If the web server is well
configured, the user agent used to download the file will be at the end of the line in the log file.
For Sun Java JVM, the user agent string is configured in the Java properties under "http.agent".
Usually, the user-agent string contains the word "Java" and the virtual machine version. In most
cases, this is just a string like "Java/1.4.2", so this is relatively easy to parse.
Problem :
Looking in my web server stats, and then on the web, I found that a JVM's user-agent is
"Mozilla/4.0 (Windows XP 5.1)", which obviously does not contains the word "Java".
Consequently, it is difficult to say that this user-agent string belongs to a JVM.
Further look in my log files and on google shows that this http.agent string appears
on Microsoft Internet Explorer (it seems MSIE 6.0) over Windows XP with the J2RE plugin:
http://board.gulli.com/thread/300321
http://forum.java.sun.com/thread.jsp?thread=531295&forum=30&message=2559523
http://forum.java.sun.com/thread.jsp?forum=63&thread=132769&start=210&range=15&tstart=0&trange=15
http://forum.java.sun.com/thread.jsp?forum=32&thread=480899
http://www.goodidea.ru/setupJava/javaInstall.htm
The J2RE plugin version does not seems to play a role as this user-agent string has
been seen on 1.4.1_02-b06, 1.4.2_01, 1.4.2_03 and 1.4.2_04-b05.
Further information requested :
I would like to know:
1) if you have reported the same problem;
2) if there is some rules for the http.agent property;
3) if this is a bug.
Thank you very much, and feel free to add you opinion.
Julien

The web log files where the "Mozilla/4.0 (Windows XP 5.1)" user-agent appears can be displayed using the following search terms on google :
"Mozilla/4.0 (Windows XP 5.1)" -"(Windows XP 5.1) Java"
http://www.google.ch/search?hl=fr&ie=UTF-8&q=%22Mozilla%2F4.0+%28Windows+XP+5.1%29%22+-%22%28Windows+XP+5.1%29+Java%22&btnG=Rechercher&meta=
Julien

What is the minimum client requirement for ADF Application?

Dear All,
What is the minimum client hardware and software requirement for ADF Application?
Operation System, Web Browser etc...
Thank you,

Presumably you mean for delivering ADF applications across the web to client PCs. As far as I know there's no hardware requirements. However you can find the browser certification matrix in the following link:
http://www.oracle.com/technetwork/developer-tools/jdev/index-091111.html
Alternatively by "client" you mean a developer PC's hardware/software requirements to run the JDev IDE, the following link gives more information: http://download.oracle.com/docs/cd/E17904_01/install.1111/e13666/ojdig.htm#BDCDAGAH
CM.

Change Users Password within ADF Application

We are trying to update a users password within a webcenter based ADF app but are struggling as the operations on the UserProfile seem to be locked down for read -only access
oracle.security.idm.UserProfile userProfile = null;
userProfile = WCSecurityUtility.getUserFromUserName(userName).getUserProfile();
userProfile.setPassword(oldPassword.toCharArray(), newPassword.toCharArray());
Gives the following error:
oracle.security.idm.OperationNotSupportedException: WebCenterUser supports only read operations
at oracle.webcenter.framework.security.idm.WebCenterUserImpl.setPassword(WebCenterUserImpl.java:101)
Does this mean we have to use LDAP API's to establish a connection and set the password that way? I dont really want to have to store the connection details within the ADF app for the the LDAP.
Regards
Jason

I think this is using that exact method:
user.getUserProfile().setPassword("old".toCharArray(), "new".toCharArray());
its this that falls over.
I have a feeling that its mandatory to use this method over SSL

How to pass parameter from SSO login page to ADF application page?

We have ADF-JSF application (running on AS 1013) that is being protected by OID running on AS 1012. SSO login page contains (among others) paramter ssousername and I wish to pass this to my ADF application. For the testing purpose I created ADF application entry point page that has something like this:
<h:outputText value="#{param.ssousername}"/>and my sso login page has:
<input type="text" size="30" maxlength="50" name="ssousername" value="<%=str_user%>">OID and ADF OC4j are running on two different servers, same network.
So after successful login, when my page displays param passed is NULL?!
Why?

I solved it with the following....when my page loads, I execute test method:
    public void processLogin(String ssousername) {
         Object o = JSFUtils.getUserFromSSOLogin();
         if (o!=null) System.out.println(o.toString());
    public static Object getUserFromSSOLogin(){
        FacesContext ctx = FacesContext.getCurrentInstance();
        return ctx.getExternalContext().getRemoteUser();
    }

How to access to a resource in the ADF application?

Hi
I have a jasper report file named report.jrxml in the following path in my ADF application named “app”:
app\ViewController\src\org\nmp\app\view\report
I wanna access to this file inside a java file located in the ViewController project as follows:
InputStreaminSt = new FileInputStream(new File(“app\ViewController\src\org\nmp\app\view\report\report.jrxml”));
But I get the following exception:
java.io.FileNotFoundException: app\ViewController\src\org\nmp\app\view\report\report.jrxml (The system cannot find the path specified)
How could I access to this resource in my application? I am using JDev 11.1.2.3
Cheers,
Ferez

Timo,
I made a test case named fileaccess and uploaded it here:
http://rapidshare.com/files/2200118787/fileaccess.zip
Just open the project in JDev 11.1.2.3, the Model project is empty and in the viewController project there is a single page named home.jsf in which contains a commandButton. Clicking the button executes the #{fileAccess.readFile} method. The fileAccess bean is located in org.company.fileaccess.view.beans and introduced in faces-config.xml. Body of readFile method is as the following:
FileInputStream fis = new FileInputStream(new File("/org/company/fileaccess/view/resources/file.txt")); file.txt is located in org.company.fileaccess.view.resources and viewController project is set to copy .txt files into output directory. Clicking the button causes FileNotFoundException.
Thank you in advance,
Ferez

Issue in the user interface of ICSS application

Hi Experts,
Please find the below description of the issue.
Ours is a migration project of ICSS application from one landscape to another landscape. Both the landscapes are in CRM 7.0 with the same patch levels.
For this migration we have copied the existing track A to the new track B and mapped to the new CRM 7.0 B system.
The XCM setting has maintained in the new B system exactly the same way like the A system
All the related backend code like FMs, Data Dictionary objects etc in CRM 7.0 A system has been moved to the CRM 7.0 B System.
   After this when we tried to run the application B, we are not seeing the same user interface like in application A.
   We are seeing only black font with white background. The color combination, fonts, styles etc like in application A are not visible in application B.
There are no CSS files in the XCM settings in A system. So I have also not maintained in B system.
We have not done any changes in the track. So we have not deployed the application.
I have created the projects for both the tracks A and B and compared the code manually. Everything is same.
Question:
   Please let me know what needs to be done additionally to get the same user interface.
   Is Shopadmin settings has to be maintained. Is this mandatory.
   Thanks in advance.
Thanks and Regards,
Raghu

Hello Waldemar,
Thank you for contacting National Instruments. I would like to apologize for the delay in responding to your support request. We have been on holiday for the past few days due to Thanksgiving.
From the information you have provided here, it sounds like you are on the right track with getting your application up and running with a chinese font interface. I would like to point out an extremely helpful KnowledgeBase that you might use for reference now and any other time you need to localize your user interface:
http://digital.ni.com/public.nsf/websearch/5987FCAFE3FBE8B98625693B0052EBD9?OpenDocument
(This KB was written for LabVIEW 6.0, but is still relevant for LabVIEW 7.0.) Based on this document, you only need "an MBCS-enabled operating s
ystem with an IME for the corresponding language." All 32-bit Windows operating systems are MBCS-enabled. Please see these links from the Microsoft website for more information:
http://search.microsoft.com/search/results.aspx?View=msdn&st=a&qu=mbcs&c=4&s=2
You may also find this tutorial describing localization procedures useful:
http://zone.ni.com/devzone/conceptd.nsf/2d17d611efb58b22862567a9006ffe76/6d94f90fc9b93aad862568a7007cd4c0?OpenDocument
I would recommend that you go ahead and install the Chinese fonts to your OS (if you have not already), and develop your user interface using the new font. This application should have no problem on any other machine with the Chinese font enabled.
I hope this helps! Let me know if there is anything else I can help with or clarify. Have a great day!
Liz Fausak
National Instruments

How to append the User Agent String in IE11

We use "Internet Explorer maintenance" GPO to append the standard User Agent String for IE9 with "ADFSIntAuth". "Internet Explorer maintenance" is deprecated and will not work anymore for IE11 and later.
Now we want to move to IE11 and I can't find a solution to append the User Agent String. With GPO this isn't possible anymore (Why Microsoft?). And the registry keys I've tested won't do the job. I've tested
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform
So whats is the best way to append the user agent string for IE11?
http://social.technet.microsoft.com/Forums/en-US/cdc999aa-faec-4aa5-9025-f12a524794f0/ie10-user-agent-string?forum=winserverGP didn't help.

Thank you for the Reply Roger.
I have already read the website you are referring to, but it doesn't say how to append the User Agent String.
Only this:
"Earlier versions of the browser included
Pre-Platform and Post-platform registry value tokens in the user-agent string. However, this led to
performance issues for customers of certain tools and add-ons. As a result, these tokens are now reported only through the
navigator.userAgent property"
With a dead link to the article "navigator.userAgent", but with a search I came to this article: http://msdn.microsoft.com/en-us/library/ie/ms534712(v=vs.85).aspx But also this article won't say how to append the User Agent String for all
clients in a corporate environment.

How can we make the selected Debug User Agent Netscape 7.0 stick?

To get into http://gap.com I have to go to the Debug menu, choose User Agent and choose Netscape 7.0.
It works Ok.
Then I quit Safari. Get back into Safari. User Agent is back to Automatically Chosen, and gap.com to not working.
How can we make the selected User Agent stick?
Thanks,
Roberto

Unfortunately, I don't think there is an automated way of going about this. To begin with, the 'Debug' menu was never meant to be user accessible in the most common context.
However, that said, you could lessen the pain by assigning a keyboard shortcut to the 'Netscape 7.0' menu-item in the 'Keyboard & Mouse' preference pane (under the 'Keyboard Shortcuts' tab). Hope that helps, somewhat.
Yang

Exploiting the parameter user-agent in ADF application

Similar Messages

Maybe you are looking for