How to remediate – Oracle 9i Application Server HTTP Request Smuggling

1. Introduction

Oracle 9i Application Server is affected by an HTTP request smuggling vulnerability. This allows attackers to manipulate web server processing, potentially leading to cross-site scripting attacks and bypassing security controls like web application firewalls. Systems running Oracle Application Server are at risk. A successful exploit could compromise the confidentiality, integrity, and availability of web applications served by the vulnerable instance.

2. Technical Explanation

The vulnerability occurs because Oracle Application Server does not correctly handle HTTP requests containing both ‘Transfer-Encoding: chunked’ and ‘Content-Length’ headers. This allows attackers to craft malicious requests that are interpreted differently by different components of the web server, poisoning the cache and enabling cross-site scripting (XSS). The CVE associated with this issue is CVE-2005-2093.

• Root cause: Incorrect handling of conflicting HTTP headers (‘Transfer-Encoding: chunked’ and ‘Content-Length’).
• Exploit mechanism: An attacker sends a specially crafted HTTP request containing both headers. The server processes the request in an unexpected way, allowing for cache poisoning and XSS attacks. For example, sending a request with a malicious script injected into the body of the request can lead to arbitrary code execution within a user’s browser if the cache is poisoned.
• Scope: Oracle Application Server 9i is affected. Specific versions are not explicitly detailed in available information but all instances should be considered vulnerable until patched or mitigated.

3. Detection and Assessment

Confirming vulnerability requires analysing HTTP request processing. A quick check involves identifying the version of Oracle Application Server installed. Thorough assessment needs testing with crafted requests.

• Quick checks: Use the following command to identify the application server version: opmnctl status (look for the Oracle Application Server process and its associated version).
• Scanning: Nessus plugin ID 30846 may detect this vulnerability. This is an example only, results should be verified manually.
• Logs and evidence: Examine application server logs for unusual request processing or errors related to HTTP header parsing. Look for entries containing both ‘Transfer-Encoding’ and ‘Content-Length’. Log file locations vary based on installation but typically reside in /u01/app/oracle/product//admin//log/.

opmnctl status

4. Solution / Remediation Steps

Currently, there is no known official patch for this vulnerability. Mitigation focuses on disabling chunked transfer encoding or implementing web application firewall (WAF) rules to block malicious requests.

4.1 Preparation

• Stopping and starting the application server may be required; plan for downtime. A roll back plan involves restoring the configuration from backup.
• Changes should be approved by the security team or system owner.

4.2 Implementation

1. Step 1: Edit the Oracle Application Server configuration file (httpd.conf) to disable chunked transfer encoding. Locate the relevant section and set ‘EnableChunkedEncoding’ to ‘Off’.
2. Step 2: Restart the application server for the changes to take effect. Use the command opmnctl restartall.

4.3 Config or Code Example

Before

EnableChunkedEncoding On

After

EnableChunkedEncoding Off

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue.

• Practice 1: Input validation is crucial; validate all incoming HTTP requests and reject those that do not conform to expected formats.
• Practice 2: Least privilege reduces the impact if an attack succeeds; limit the permissions granted to the application server process.

4.5 Automation (Optional)

Automation is difficult without a configuration management system, but scripts can be used to check for ‘EnableChunkedEncoding’ setting.

#!/bin/bash
# Check if chunked encoding is enabled in httpd.conf
if grep -q "EnableChunkedEncoding On" /u01/app/oracle/product//admin//config/httpd.conf; then
  echo "Chunked Encoding is ENABLED. Vulnerable!"
else
  echo "Chunked Encoding is DISABLED."
fi

5. Verification / Validation

Confirm the fix by checking the configuration and testing with a crafted request.

• Post-fix check: Run opmnctl status and verify that the application server has restarted successfully. Then, inspect httpd.conf to confirm ‘EnableChunkedEncoding’ is set to ‘Off’.
• Re-test: Attempt to send a malicious HTTP request with both ‘Transfer-Encoding: chunked’ and ‘Content-Length’ headers. Verify that the request is rejected or handled correctly without cache poisoning.
• Monitoring: Monitor application server logs for errors related to HTTP header parsing and unusual request processing.

opmnctl status

6. Preventive Measures and Monitoring

Regular security assessments and patch management are essential.

• Baselines: Update your server baseline configuration to include the ‘EnableChunkedEncoding Off’ setting.
• Pipelines: Implement input validation checks in your CI/CD pipeline to prevent deployment of vulnerable code.
• Asset and patch process: Establish a regular review cycle for security patches and configuration updates, prioritizing critical vulnerabilities like this one.

7. Risks, Side Effects, and Roll Back

Disabling chunked transfer encoding may cause compatibility issues with some clients.

• Risk or side effect 2: Disabling chunked transfer encoding could slightly reduce performance in certain scenarios.
• Roll back: Restore the original httpd.conf file from backup and restart the application server using opmnctl restartall.

8. References and Resources

Link only to sources that match this exact vulnerability.

• Vendor advisory or bulletin: http://www.securiteam.com/securityreviews/5GP0220G0U.html
• NVD or CVE entry: CVE-2005-2093
• Product or platform documentation relevant to the fix: Oracle documentation on configuring HTTP server parameters.