Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.

[publists@xxxxxxxxxxxxxxxxxx]

____________________________________________________________________________

Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities. 

____________________________________________________________________________

An advisory by EnableSecurity. 
Trustwave published a joint advisory named TWSL2009-001

ID: ES-20090500

Advisory URL: 
http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt

Affected Versions: versions prior to 2.4.4 and 2.2.22 

Fixed versions: 2.4.4, 2.2.22 and later

Description:

Armorlogic Profense is a Web Application Firewall and load balancing solution.

From their website (armorlogic.com):
"Protecting and securing websites and web applications can be a complicated 
business. Profense web application firewall simplifies protection with an 
affordable and easy to use, feature rich, solution that gives you full PCI DSS 
1.1 and 1.2 section 6.6 compliance."

Credits:

These vulnerabilities were discovered during WAF testing by Sandro Gauci of 
EnableSecurity and Wendel Guglielmetti Henrique of Trustwave's SpiderLabs.
We worked with the Armorlogic security team to have these security flaws 
reported and fixed. 
We would like to publicly thank the Armorlogic team for their prompt response!

__________________________________________________________________

Technical details:

The following vulnerabilities were identified:

Major issues:
  - Whitelist / positive model bypass
  - Blacklist / negative model bypass

Other issues:
  - static root password exposes administrative interface


----------- Major issues -----------

::::: Whitelist / positive model bypass :::::

CVE: CVE-2009-1594

Description: 
Profense Web Application Firewall configured in positive model can be evaded.

Technical details:
Profense Web Application Firewall configured to make use of the strong positive 
model (white-list approach) can be evaded to launch various attacks including 
XSS (Cross-Site Scripting), SQL Injection, remote command execution, and 
others. 

The vulnerability can be reproduced by making use of a URL-encoded new line 
character. The pattern matching in multi line mode matches any non-hostile line 
and marks the whole request as legitimate, thus allowing the request. This 
results in a bypass in the positive model. An example is showed below:

http://testcases/phptest/xss.php?var=%3CEvil%20script%20goes%20here%3E=%0AByPass



::::: Blacklist / negative model bypass :::::

CVE: CVE-2009-1593

Description: Profense Web Application Firewall with default configuration in 
negative model can be evaded to inject XSS.
 
Technical Description:
 
Versions 2.4 and 2.2 of Profense Web Application Firewall with the default 
configuration in negative model (blacklist approach) can be evaded to inject 
XSS (Cross-Site Scripting). The problem is due to the built-in core rules that 
can be abused using the flexibility provided by HTML and JavaScript.

The vulnerability can be reproduced by injecting a common XSS attack in a 
vulnerable application protected by Profense Web Application Firewall. 
Inserting extra characters in the JavaScript close tag will bypass the XSS 
protection mechanisms. An example is shown below:

 
http://testcases/phptest/xss.php?var=%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E


::::: Static root password exposes administrative interface :::::

Description: Profense Web Application Firewall with default configuration has a 
default password hash.

Technical Description:
 
Versions 2.4 and 2.2 of Profense Web Application Firewall with the default 
configuration the root password hash is the same default in all available 
products. The SSH server is enabled by default on the administrative interface 
and accepts root authentication using user and password credential. The hashing 
algorithm used is OpenBSD's blowfish password hash which is known to be strong. 
However the existence of a static password means that if this password is 
leaked in some way or another, then the attacker potentially has access to all 
exposed administrative interfaces. 


__________________________________________________________________

Exploit code:
Available to organizations by contacting info@xxxxxxxxxxxxxxxxxx

Timeline:

Oct 10, 2008: Initial contact.
Oct 10, 2008: Confirmation of the vulnerabilities.
Oct 11, 2008: Discussion of possible fixes.
Oct 13, 2008: Fix from Armorlogic complete.
Oct 14, 2008: Fix issued to customers.
May 13, 2009: Advisory public release.

Solution:

Upgrade to the latest version of Profense:
http://www.armorlogic.com/



__________________________________________________________________

About EnableSecurity:

EnableSecurity is dedicated to providing high quality Information Security 
Consultancy, Research and Development. EnableSecurity develops security tools 
such as VOIPPACK (for Immunity CANVAS) and SIPVicious. EnableSecurity is 
focused on analysis of security challenges and providing solutions to such 
threats. EnableSecurity works on developing custom targeted security solutions, 
as well as working with existing off the shelf security tools to provide the 
best results for their customers. More info at enablesecurity.com


Disclaimer: The information in the advisory is believed to be accurate at the 
time of publishing based on currently available information. Use of the 
information constitutes acceptance for use in an AS IS condition. There are no 
warranties with regard to this information. Neither the author nor the 
publisher accepts any liability for any direct, indirect, or consequential loss 
or damage arising from use of, or reliance on, this information.