317 lines
No EOL
15 KiB
Text
317 lines
No EOL
15 KiB
Text
Document Title:
|
||
===============
|
||
Barracuda Bug Bounty #30 Firewall - Multiple Persistent Web Vulnerabilities
|
||
|
||
|
||
References (Source):
|
||
====================
|
||
http://www.vulnerability-lab.com/get_content.php?id=1065
|
||
|
||
Barracuda Networks Security ID (BNSEC): BNSEC-2067
|
||
|
||
Video: http://www.vulnerability-lab.com/get_content.php?id=1208
|
||
|
||
View Video: http://www.youtube.com/watch?v=-yQVyik3Ggo
|
||
|
||
|
||
Release Date:
|
||
=============
|
||
2014-02-19
|
||
|
||
|
||
Vulnerability Laboratory ID (VL-ID):
|
||
====================================
|
||
1065
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
3.9
|
||
|
||
|
||
Product & Service Introduction:
|
||
===============================
|
||
The Barracuda Firewall goes beyond traditional network firewalls and UTMs by providing powerful network security, granular layer 7
|
||
application controls, user awareness and secure VPN connectivity combined with cloud-based malware protection, content filtering
|
||
and reporting. It alleviates the performance bottlenecks in Unified Threat Management (UTM) appliances through intelligent integration
|
||
of on-premise and cloud-based technologies. While the powerful on-premises appliance is optimized for tasks like packet forwarding and
|
||
routing, Intrusion Prevention (IPS), DNS/DHCP services and site-to-site connectivity; CPU intensive tasks like virus scanning, content
|
||
filtering and usage reporting benefit from the scalable performance and elasticity of the cloud.
|
||
|
||
(Copy of the Vendor Homepage: https://www.barracuda.com/products/firewall )
|
||
|
||
|
||
Abstract Advisory Information:
|
||
==============================
|
||
The Vulnerability Laboratory Research Team discovered multiple persistent input validation web vulnerabilities in the Barracuda Web Firewall appliance web-application.
|
||
|
||
|
||
Vulnerability Disclosure Timeline:
|
||
==================================
|
||
2013-09-04: Researcher Notification & Coordination (Benjamin Kunz Mejri)
|
||
2013-09-05: Vendor Notification (Barracuda Networks Security Team - Bug Bounty Program)
|
||
2013-09-26: Vendor Response/Feedback (Barracuda Networks Security Team - Bug Bounty Program)
|
||
2014-02-17: Vendor Fix/Patch (Barracuda Networks Developer Team) [Coordinated Disclosure]
|
||
2014-02-19: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Discovery Status:
|
||
=================
|
||
Published
|
||
|
||
|
||
Affected Product(s):
|
||
====================
|
||
Barracuda Networks
|
||
Product: Web Firewall 6.1.0.016 - Models: X100; X200; X300; X400 & X600
|
||
|
||
|
||
Exploitation Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity Level:
|
||
===============
|
||
Medium
|
||
|
||
|
||
Technical Details & Description:
|
||
================================
|
||
Multiple persistent input validation web vulnerabilities are detected in the Barracuda Networks Web Firewall X300 (v6.1.0.016) Appliance Web Application.
|
||
The validation web vulnerability allows remote attackers or local low privileged application user accounts to inject (persistent) own malicious script
|
||
codes on application-side of the vulnerable module.
|
||
|
||
The vulnerability is located in the firewall menu when processing to create a custom user object with manipulated create user expresson
|
||
group credentials. Remote attackers can inject script codes to the `Login Name` & `Group Match pattern text` input fields. After the inject
|
||
the attacker can save the input via add (POST Method) to execute the persistent code in the edit listing. After the first add (inject) in the
|
||
edit formular the remote attacker is also able to add the input via `add to the second selection` listing to execute the persistent code in
|
||
both listing values of the bottom page. Remote attackers are able to add the persistent injected context to the main custom user objects
|
||
module in the predefined user objects listing. The attack vector is persistent and the request method is POST. The security risk of the
|
||
persistent input validation web vulnerabilities are estimated as medium with a cvss (common vulnerability scoring system) count of 3.8(+)|(-)3.9.
|
||
|
||
Exploitation of the vulnerability requires a low privileged application user account and low user interaction. Successful exploitation results
|
||
in session hijacking, persistent phishing, persistent external redirects & persistent manipulation of affected or connected web module context.
|
||
|
||
|
||
Vulnerable Application(s):
|
||
[+] Firewall (WAF) Appliance Application (X300Vx v6.1.0.016)
|
||
|
||
Vulnerable Module(s):
|
||
[+] Firewall > User Objects > Custom User Objects > Create User Object > Create User Expression
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] login name
|
||
[+] pattern - Group Match
|
||
|
||
Affected Module(s):
|
||
[+] Firewall > User Objects > Custom User Objects > Predefined User Objects Listing
|
||
[+] Firewall > User Objects > Custom User Objects > Create User Object > Create User Expression (Group)
|
||
|
||
|
||
Proof of Concept (PoC):
|
||
=======================
|
||
The persistent input validation web vulnerabilities can be exploited by remote attackers with low privileged application user account and low user interaction.
|
||
For security demonstration or to reproduce the vulnerability follow the provided information and steps below.
|
||
|
||
Manual steps to reproduce the vulnerability:
|
||
|
||
1. Login with the user account to the barracuda networks web firewall appliance application
|
||
2. After the login open the firewall and switch to the User Objects > Custom User Objects > Create User Object module
|
||
3. Start creating via user expression a group
|
||
4. Include a random name for the main mask, and add your script code as payload to the login name and pattern (group match) input fields
|
||
5. Click the checkbox for the group match and click the add button to save the input
|
||
6. The code executes in the add box context itself and the group match or pattern values listing (bottom) [3 times]
|
||
7. Now, the attacker is also able to add the already injected persistent context to the main menu listing by a click of the add button to save at the bottom
|
||
8. The script code execution occurs when processing to watch the firewall_user_objects module index item listing
|
||
Note: The vulnerable values are login name (name) and pattner
|
||
9. Successful reproduce of the persistent web vulnerabilities!
|
||
|
||
|
||
PoC: firewall_user_objects - index listing
|
||
|
||
<tr style="" class="config_module_tr display oddRow" id="config_module_rowfw_predefined_user_objects_1_1"
|
||
onmouseout="if (!this.isSelected) {this.style.background=this.prevBackground;}"
|
||
onmouseover="if (!this.isSelected) {this.prevBackground=this.style.background;this.style.background='#a1a1a1';}">
|
||
<td style="width: 150px;"> </td>
|
||
<td style="width: 200px;"> </td>
|
||
<td style="width:150px"><[PERSISTENT INJECTED SCRIPT CODE!]></td>
|
||
<td style="width:250px"><[PERSISTENT INJECTED SCRIPT CODE!]></td>
|
||
<td style="width: 116px;"> </td>
|
||
</tr>
|
||
|
||
|
||
Reference(s):
|
||
https://firewall.ptest.localhost:6299/cgi-mod/index.cgi
|
||
?auth_type=Local&et=1378340277&locale=en_US&password=b9bc2762a9868729613918058ac1fb56&user=guest&primary_tab=FIREWALL&secondary_tab=firewall_user_objects
|
||
|
||
|
||
PoC: Create User Object > Create User Expression - Listing
|
||
|
||
<tr class="config_module_tr" id="config_module_row_4">
|
||
<td valign="top" width="15"> </td>
|
||
<td valign="top" width="100">Group Match</td>
|
||
|
||
<td valign="top" width="400"><table class="config_module IT" frame="box" id="group_match_table" rules="none" summary="Box"
|
||
cellpadding="0" cellspacing="0"><tbody><tr bgcolor="#cccccc"><td style="text-align:center;"><b>Pattern</b></td>
|
||
<td style="text-align:center;" width="20"><b></b></td></tr><tr><td><input class="" autocomplete="off"
|
||
id="group_match_pattern" name="group_match_pattern" size="30" type="text"></td><td width="20"><input class="new_button"
|
||
id="+" name="+" onclick="add_group_match_pattern()" value="+" type="button"></td></tr>
|
||
<tr class="pattern"><td>a%20>"<[PERSISTENT INJECTED SCRIPT CODE!]"></iframe></td><td><input class="new_button" value="-"
|
||
name="0" type="button"></td></tr></tbody></table><input id="pattern_group_match:yes" name="pattern_group_match" value="yes" type="checkbox">
|
||
<label for="pattern_group_match:yes" style="display:inline">All Group Patterns must match</label></td>
|
||
|
||
<td valign="top" width="120"><div id="helpbox"><b class="outlinetop">
|
||
|
||
<b class="outline1"></b>
|
||
<b class="outline2"></b>
|
||
<b class="outline3"></b>
|
||
|
||
<b class="outline4"></b></b>
|
||
<div id="contents"><div>List of user group patterns according to efficient authentication method.<br>
|
||
If the check box is cleared, only one list item may match. <b>Default</b>: Off</div></div>
|
||
<b class="outlinebottom"><b class="outline4"></b><b class="outline3"></b><b class="outline2"></b><b class="outline1"></b></b>
|
||
</div></td></tr>
|
||
|
||
... && Add
|
||
|
||
<tbody><tr bgcolor="#cccccc"><td style="text-align:center;" width="100"><b>Name</b></td><td style="text-align:center;"
|
||
width="100"><b>Group Match</b></td><td style="text-align:center;" width="50"><b></b></td></tr>
|
||
<tr class="pattern">
|
||
<td>a%20>"<[PERSISTENT INJECTED SCRIPT CODE!]"></iframe></td><td>a%20>"<[PERSISTENT INJECTED SCRIPT CODE!]">
|
||
</iframe></td><td><img style="cursor:pointer;" name="0" src="/images/edit.png"><input name="0" src="/images/del.png" type="image"></td></tr></tbody>
|
||
|
||
|
||
|
||
--- Request Session Logs ---
|
||
|
||
Status: 200[OK]
|
||
POST https://firewall.ptest.localhost:6299/cgi-mod/index.cgi
|
||
Load Flags[LOAD_BYPASS_CACHE LOAD_BACKGROUND ]
|
||
Content Size[-1] Mime Type[text/plain]
|
||
|
||
Request Headers:
|
||
Host[firewall.ptest.localhost:6299]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0]
|
||
Accept[text/javascript, text/html, application/xml, text/xml, */*]
|
||
Accept-Language[en-US,en;q=0.5]
|
||
Accept-Encoding[gzip, deflate]
|
||
DNT[1]
|
||
X-Requested-With[XMLHttpRequest]
|
||
X-Prototype-Version[1.7]
|
||
Content-Type[application/x-www-form-urlencoded; charset=UTF-8]
|
||
Referer[https://firewall.ptest.localhost:6299/cgi-mod/index.cgi?
|
||
password=4b3c71efe69b776c7af9c2a0e44d8da6&et=1378331067&content_only=1&primary_tab=FIREWALL&new_secondary_tab=
|
||
firewall_user_objects&auth_type=Local&user=guest&locale=en_US&secondary_tab=add_firewall_user_object&ispopup=1&
|
||
parent_name=add_firewall_user_object&popup_width=530&popup_height=500]
|
||
Content-Length[237]
|
||
Connection[keep-alive]
|
||
Pragma[no-cache]
|
||
Cache-Control[no-cache]
|
||
Post Data:
|
||
ajax_action[check_param_ajax_single]
|
||
name[group_match_pattern]
|
||
value[(PERSISTENT INJECTED SCRIPT CODE!)<]
|
||
user[guest]
|
||
password[2f156d447f2d3972ab50762e5b0f581d]
|
||
et[1378331075]
|
||
locale[en_US]
|
||
auth_type[Local]
|
||
realm[]
|
||
|
||
|
||
Response Headers:
|
||
Server[BarracudaFirewallHTTP 4.0]
|
||
Date[Wed, 04 Sep 2013 21:26:16 GMT]
|
||
Content-Type[text/plain; charset=utf-8]
|
||
Transfer-Encoding[chunked]
|
||
Connection[keep-alive]
|
||
|
||
|
||
GET https://firewall.ptest.localhost:6299/cgi-mod/[PERSISTENT INJECTED SCRIPT CODE!]<
|
||
Load Flags[LOAD_DOCUMENT_URI ]
|
||
Content Size[1789] Mime Type[text/html]
|
||
Request Headers:
|
||
Host[firewall.ptest.cudasvc.com]
|
||
User-Agent[Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101 Firefox/23.0]
|
||
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
|
||
Accept-Language[en-US,en;q=0.5]
|
||
Accept-Encoding[gzip, deflate]
|
||
DNT[1]
|
||
Referer[https://firewall.ptest.localhost:6299/cgi-mod/index.cgipassword=4b3c71efe69b776c7af9c2a0e44d8da6&et=1378331067&content_only=
|
||
1&primary_tab=FIREWALL&new_secondary_tab=firewall_user_objects&auth_type=Local&user=guest&locale=en_US&secondary_tab=
|
||
add_firewall_user_object&ispopup=1&parent_name=add_firewall_user_object&popup_width=530&popup_height=500]
|
||
Connection[keep-alive]
|
||
Response Headers:
|
||
Server[BarracudaFirewallHTTP 4.0]
|
||
Date[Wed, 04 Sep 2013 21:26:16 GMT]
|
||
Content-Type[text/html]
|
||
Content-Length[1789]
|
||
Connection[keep-alive]
|
||
|
||
Reference(s):
|
||
https://firewall.ptest.localhost:6299/cgi-mod/index.cgi?
|
||
password=a1524626db9371fd7c3db09cc21836aa&et=1378331929&content_only=1&primary_tab=FIREWALL&new_secondary_tab=firewall_user_objects
|
||
&auth_type=Local&user=guest&locale=en_US&secondary_tab=add_firewall_user_object&ispopup=1&parent_name=add_firewall_user_object&
|
||
popup_width=530&popup_height=500
|
||
|
||
|
||
https://firewall.ptest.localhost:6299/cgi-mod/index.cgi?
|
||
auth_type=Local&et=1378340277&locale=en_US&password=b9bc2762a9868729613918058ac1fb56&user=guest&primary_tab=FIREWALL&
|
||
secondary_tab=firewall_user_objects
|
||
|
||
|
||
Solution - Fix & Patch:
|
||
=======================
|
||
The vulnerability can be patched by a secure parse of the match group pattern and login name input fields in the firewall_user_objects module.
|
||
Encode also the vulnerable output item listing of the pattern text and login name in the main- and edit firewall_user_objects listing to prevent
|
||
further persistent script code injection attacks via POST method request. Implement the regular alos the regular formular validation of barracuda
|
||
the the item list module.
|
||
|
||
2014-02-17: Vendor Fix/Patch (Barracuda Networks Developer Team) [Coordinated Disclosure]
|
||
|
||
Barracuda Networks: Appliances > Advanced > Firmware Updates (automatic) page or use the regular customer panel (https://login.barracudanetworks.com/auth/login/) to update manually.
|
||
|
||
|
||
Security Risk:
|
||
==============
|
||
The security risk of the persistent input validation web vulnerabilities are estimated as medium.
|
||
|
||
|
||
Credits & Authors:
|
||
==================
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||
|
||
|
||
Disclaimer & Information:
|
||
=========================
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2014 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |