PeopleSoft <Control><J> Information Disclosure

[<info@i-assure.com>]

Vendor:                 PeopleSoft
Solution ID:            200749177
Product:                People Tools
Version:                8.42, Others? 
Platform:               Solaris 8, BEA WebLogic, Others?
Remote/Local:           Remote, Authenticated
Title:                  Information Gathering
Impact:                 Disclosure of potentially sensitive information


Description:            
<Control><J> is a hot key that is used by everyone that helps in 
troubleshooting many issues within the PIA or Portal environment. Ever since 
PeopleTools 8.1x, <Control><J> allows us to see information like: Browser and 
its version, name of Operating System, PeopleTools version, Application type 
and its version, Service Pack number, current Menu name, and current Component 
name, current Page name, the UserID who is logging in, the name of the Database 
logged into, the Database platform, and the IP of the Application Server.

Although most of the information may seem to be harmless, some of the 
information is considered too sensitive and should not be shared with all of 
the user community. The following information should be hidden from the users: 
the UserID who is logging in, the name of the Database logged into, the 
Database platform, and the IP of the Application Server.


Vendor Solution:        
Control - J functionality is modified by changing the following line in 
configuration.properties:

# If set to true, the database name and other potentially sensitive connection 
information
# will appear in the HTML generated for use in a help display.
# Default: true
connectionInformation=true

Setting this value to false will hide security related information from CTLR-J 
and HTML object PT_INFOPAGE will be displayed:

Browser IE/6.0
Operating System WINNT
Browser Compression ON (gzip)
Tools Release 8.42.01
Application Release HRMS 8.80.00.000
Service Pack 0
Page NID_LOOKUP
Component NID_LOOKUP
Menu ADMINISTER_WORKFORCE_(GBL)

If connectionInformation=true, the following HTML object PT_INFOPAGECONNECT is 
displayed:

Browser IE/6.0
Operating System WINNT
Browser Compression ON (gzip)
Tools Release 8.42.01
Application Release HRMS 8.80.00.000
Service Pack 0
Page NID_LOOKUP
Component NID_LOOKUP
Menu ADMINISTER_WORKFORCE_(GBL)
User ID PS
Database Name HRMS
Database Type MICROSFT
Application Server //127.0.0.1:9000

Further, the actual HTML objects can be modified to restrict display of 
sensitive objects. Please note that this is a customization to a delivered 
PeopleTools object and will require special attention when applying PeopleTools 
patches and upgrades.


Vendor Trail:           
3 June 03       PeopleSoft contacted
3 June 03       PeopleSoft confirms
24 June 03      PeopleSoft teleconference
19 July 03      PeopleSoft posts to Customer Connection
                        

Contributers:
                
Barrett McGuire 
Larry Wargo
Matt Fotter