192 lines
No EOL
7.2 KiB
Text
192 lines
No EOL
7.2 KiB
Text
Title:
|
|
======
|
|
SonicWall SonicOS 5.8.1.8 WAF - POST Inject Vulnerability
|
|
|
|
|
|
Date:
|
|
=====
|
|
2012-12-18
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=769
|
|
|
|
DELL Sonicwall Bug ID [DSBID]: 123995
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
769
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
3.5
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
The Dell® SonicWALL® Network Security Appliance (NSA) Series combines the patented Dell SonicWALL Reassembly
|
|
Free Deep Packet Inspection™ (RFDPI) engine with a powerful and massively scalable multi-core architecture to
|
|
deliver intrusion prevention, gateway anti-virus, gateway anti-spyware, and application intelligence and control
|
|
for businesses of all sizes. By integrating automated and dynamic security capabilities into a single platform,
|
|
the NSA Series provides comprehensive Next-Generation Firewall protection without compromising performance.
|
|
|
|
(Copy of the Vendor Homepage: http://www.sonicwall.com/us/en/products/NSA_Series.html)
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered a web vulnerability in the official DELL Sonicwall SonicOS v5.8.1.8 Firewall Series Appliance Application.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2012-11-18: Researcher Notification & Coordination
|
|
2012-11-20: Vendor Notification
|
|
2012-11-20: Vendor Response/Feedback
|
|
2012-12-04: Vendor Fix/Patch (SonicOS 5.8.1.9)
|
|
2012-12-18: Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
DELL
|
|
Product: Sonicwall SonicOS v5.8.1.8
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Medium
|
|
|
|
|
|
Details:
|
|
========
|
|
A persistent POST Injection (input validation) vulnerability is detected in the official DELL Sonicwall SonicOS v5.8.1.8 Firewall Series Appliance Application.
|
|
The vulnerability typus allows an attacker to inject via POST request own malicious script code in the vulnerable module on application side (persistent).
|
|
|
|
The vulnerability is located in the Firewall > Match Object > Edit Match Object section when processing to request via the `Search > appFirewallObjects`
|
|
module the bound vulnerable [searchStr] application parameter. The persistent injected script code will be executed out of the searchstr name listing
|
|
web application context.
|
|
|
|
The bug can be exploited with a low (restricted) privileged application user account and low required user inter action. Successful exploitation of
|
|
the vulnerability result in persistent session hijacking, persistent phishing, external redirect, external malware loads and persistent vulnerable
|
|
module context manipulation.
|
|
|
|
Vulnerable Section(s):
|
|
[+] Firewall > Match Object > Edit Match Object
|
|
|
|
Vulnerable Module(s):
|
|
[+] Search > appFirewallObjects
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] [searchStr] - Name Listing
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The persistent post injection vulnerability can be exploited by remote attackers with low privileged application user account and
|
|
low required user interaction. For demonstration or reproduce ...
|
|
|
|
|
|
Review: appFirewallObjects > searchStr
|
|
|
|
csrfToken=benjamin1337
|
|
inputxml=<dbInfo><dbInfoRequest><pageId>appFirewallObjects</pageId><tableType>157</tableType><viewType>table</viewType>
|
|
<cmd>get</cmd><sort>false</sort><searchStr><[PROVOKE EXCEPTION]>%20%20%20%20"><[PERSISTENT INJECTED SCRIPT CODE!]")
|
|
<</searchStr></dbInfoRequest></dbInfo>
|
|
|
|
|
|
--- POST REQUEST FULL (MANIPULATED!) ---
|
|
Host=realtime.pentest.server.com
|
|
User-Agent=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
|
|
Accept=application/json,
|
|
text/javascript, */*
|
|
Accept-Language=de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
|
|
Accept-Encoding=gzip, deflate
|
|
DNT=1
|
|
Connection=keep-alive
|
|
Content-Type=
|
|
application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With=XMLHttpRequest
|
|
Referer=https://realtime.pentest.server.com/appFirewallObjects.html?
|
|
sortCol=1&sortInverted=0.html
|
|
Content-Length=475
|
|
Cookie=__utma=31673917.1419029853.1353291737.1353291737.1353374336.9;
|
|
%3FsortCol%3D1%26sortInverted%3D0.html;
|
|
curUsr=; 1008=2; 1021=600; 1023=10; 1024=5; 1031=0; 1032=0; 1033=0; 1034=0; 1035=0; 1040=4; 1041=1; 1042=0; 1043=0;
|
|
|
|
1044=0; 1045=0; 1022=true;
|
|
1007=applFolder; 2103=appFolderId
|
|
Pragma=no-cache
|
|
Cache-Control=no-cache
|
|
POSTDATA=csrfToken=benjamin1337&inputxml=
|
|
|
|
%3CdbInfo%3E%3CdbInfoRequest%3E%3CpageId%3E
|
|
appFirewallObjects%3C%2FpageId%3E%3CtableType%3E157%3C%2FtableType%3E%3CviewType%3Etable%3C%2FviewType%3E%3Ccmd
|
|
%3Eget%3C%2Fcmd%3E%3Csort%3Efalse
|
|
%3C%2Fsort%3E%3CsearchStr%3E%3C-'%20[PERSISTENT INJECTED SCRIPT CODE!])+%3C%3C%2FsearchStr%3E%3C%2FdbInfoRequest%3E%3C
|
|
%2FdbInfo%3E
|
|
|
|
|
|
Reference(s):
|
|
https://firewall.127.0.0.1:31337/dbselect.cgi
|
|
https://2400mx.127.0.0.1:31337/dbselect.cgi
|
|
|
|
|
|
Solution:
|
|
=========
|
|
The vulnerability can be patch by parsing the name listing searchStr web application parameter request.
|
|
|
|
2012-12-04: Vendor Fix/Patch - Update or Upgrade your Sonicwall SonicOS v5.8.1.8 to v5.8.1.9 [Customer Area].
|
|
|
|
|
|
Risk:
|
|
=====
|
|
The secuirty risk of the post injection web vulnerability is estimated as medium.
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
|
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
|
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright © 2012 | Vulnerability Laboratory
|
|
|
|
--
|
|
VULNERABILITY RESEARCH LABORATORY
|
|
LABORATORY RESEARCH TEAM
|
|
CONTACT: research@vulnerability-lab.com |