[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Suspected Spam] Astaro Command Center v2.x - Multiple Web Vulnerabilities
- To: bugs@xxxxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx
- Subject: [Suspected Spam] Astaro Command Center v2.x - Multiple Web Vulnerabilities
- From: Research <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 08 Apr 2012 05:09:24 +0200
Title:
======
Astaro Command Center v2.x - Multiple Web Vulnerabilities
Date:
=====
2012-04-03
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=4
VL-ID:
=====
4
Introduction:
=============
We are pleased to announce the General Availability of the Astaro Command
Center Version 2.0. This new version introduces the major new ability
to configure and manage IPSEC tunnels entirely within ACC itself. By providing
a centralized location from which to work with and deploy VPN
tunnels between Astaro installations, administrators can save management time
and automate many of the tasks involved in successfully linking
sites together with encrypted links. The Astaro Command Center is an entirely
free product that allows you to centrally monitor and maintain
multiple Astaro installations & devices. If you currently are responsible for
more than one Astaro Gateway product, ACC is designed for you!
Read on for more information. Starting with this release, it is now possible to
setup site-to-site VPN tunnels with an amazing degree of ease
from within Astaro Command Center itself. Simply indicate the devices to be
joined together via VPN, select a few options, and the rest is
automated with no need to login to each individual WebAdmin for the
configuration. ACC is presented in the same administrative style as our AxG
Version 7 WebAdmin, so that if you are new to ACC you will have no trouble
getting started within a familiar looking environment.
(Copy from vendors homepage:
http://up2date.astaro.com/2009/03/astaro_comand_center_20_releas.html#more)
Abstract:
=========
Vulnerability-Lab Team discovers multiple Input Validation Vulnerabilities on
Astaros Command Center Application v2.x
Report-Timeline:
================
2011-01-12: Verified by Vulnerability-Lab
2011-06-15: Secure Vendor Notification
2011-06-17: Vendor Reply/Feedback
2012-03-22: Vendor Fix/Patch Disclosure by Check
2012-04-03: Discovery by Vulnerability-Lab
Status:
========
Published
Affected Products:
==================
Exploitation-Technique:
=======================
Remote
Severity:
=========
High
Details:
========
Multiple persistent input validation vulnerabilities are detected in Astaro
Command Center v2.x.
The bugs allows an local privileged attackers to implement/inject malicious
script code on the application side (persistent).
Successful exploitation of the vulnerability can lead to session hijacking
(manager/admin) or stable (persistent)
context manipulation. Exploitation requires user inter action & minimum
restricted access to the panel.
Vulnerable Module(s):
[+] Configuration - Networks
Definition
[+] Deploy Function
[+] Summary
[+] VPN Information/
Configuration VPN Details
[+] Management - Organizational
Units
Proof of Concept:
=================
This vulnerabilities can be exploited local(persistent) by low privileged user
accounts or
by user inter-action (remote) via request force ...
Code Review: Networks Definition
<tr><td style="width: 72px; vertical-align: top;" valign="top"><img
class="TABLEOBJITEM_BUTTON_edit" src="core/img/blank1x1.gif"><span>
</span><img class="TABLEOBJITEM_BUTTON_clone" src="core/img/blank1x1.gif"><img
style="width: 72px; height: 1px;" src="core/img/blank1x1.gif">
<img style="padding: 2px; cursor: pointer;"
src="wfe/acc/img/buttons/button_custom_delete.png"><img style="padding: 2px;
cursor: pointer;
display: none;" src="wfe/acc/img/buttons/button_custom_info.png"></td><td
style="vertical-align: top; padding: 2px;" valign="top"><table style=
"width: 100%;" border="0" cellpadding="0" cellspacing="0"><tbody><tr><td
style="padding-top: 2px;" id="global_object_td_REF_ACC_GBL_
16fe7d084bbe4b05b7f25b74e5d18aa98aa9"><table border="0" cellpadding="0"
cellspacing="0"><tbody><tr><td style="padding-right: 4px; width: 16px;">
<input id="global_objects_cb_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9"
class="registration_checkbox_style" type="checkbox"></td><td style="
padding-right: 4px; width: 16px;"><img
src="wfe/acc/img/icons/host.png"></td><td style="font-weight: bold;
padding-right: 4px; width: 300px;">
<span>>"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!></iframe></span></td><td
style="padding-right: 4px; width: 185px;">
<span>10.129.11.11</span></td><td style="padding-right: 4px;"><img
class="img_button" src="wfe/acc/img/buttons/button_deploy_70.png"
id="button_deploy
_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9"></td></tr></tbody></table></td></tr><tr><td><table
border="0" cellpadding="0" cellspacing="0">
<tbody><tr><td style="padding-right: 4px; width: 16px;"><span></span></td><td
style="padding-right: 4px; padding-top: 4px; width: 320px;"><span>
</span></td><td style="padding-right: 4px; padding-top: 4px; width:
185px;"><span><img src="wfe/acc/img/icons/ldap-container.gif" style="float:
left;
padding-right: 4px;">Astaro AG</span></td><td style="padding-right: 4px;
padding-top: 4px;"><img class="img_button_transparent" src="wfe/acc/img/buttons
/button_undeploy_70.png"
id="button_undeploy_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9"></td></tr></tbody></table></td></tr><tr><td><table
border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-right:
4px; width: 16px;"><span></span></td><td style="padding-right: 1px;
padding-top: 4px; width: 16px;"><img style="cursor: pointer;"
src="wfe/acc/img/icons/check_14.png"></td><td style="font-weight: normal;
padding-right:
4px; padding-top: 4px; width: 40px;"><span>0</span></td><td
style="padding-right: 1px; padding-top: 4px; width: 16px;"><img style="cursor:
pointer;"
src="wfe/acc/img/icons/cancel_14.png"></td><td style="font-weight: normal;
padding-right: 4px; padding-top: 4px; width: 40px;"><span>0</span></td><td
style="padding-right: 1px; padding-top: 4px; width: 16px;"><img style="cursor:
pointer;" src="wfe/acc/img/icons/service-fail_14.png"></td><td style="
font-weight: normal; padding-right: 4px; padding-top: 4px; width:
40px;"><span>0</span></td><td style="padding-right: 1px; padding-top: 4px;
width:
16px;"><img style="cursor: pointer;"
src="wfe/acc/img/icons/icon_deploy_14.png"></td><td style="font-weight: normal;
padding-right: 4px; padding-top:
4px; width:
120px;"><span>0</span></td></tr></tbody></table></td></tr></tbody></table></td><td
style="width: 40px; vertical-align: top;" valign="top">
<img class="TABLEOBJITEM_BUTTON_usageinformation"
src="core/img/blank1x1.gif"></td></tr>
Code Review: Deploy Functions
<tr><td><img src="core/img/icons/trash.png" style="margin-right: 6px;
margin-left: 2px; cursor: pointer;" id="__DND__DROPPED_REF_ACC_GBL_
16fe7d084bbe4b05b7f25b74e5d18aa98aa9_trash_icon"></td><td><div
style="vertical-align: middle; overflow: hidden; cursor: pointer; white-space:
nowrap;"><img src="wfe/acc/img/icons/host.png" style="display: inline;
vertical-align: middle; padding: 2px;"><div style="display: inline;
vertical-align: middle; white-space: nowrap; padding: 2px 2px 2px
0px;">>"<<INCLUDE PERSISTENT SCRIPTCODE HERE!!!>></div>
<div style="position: relative; overflow: hidden; height: 0px; width: 0px;
margin-left: 20px;"></div></div></td></tr>
Code Review: Summery Repaste
<form id="__FORM" style="width: 100%;"><div style="font-size: 14px;
font-weight: bold;">Summary</div><br><div>This is a summary of the resulting
VPN configuration. Please review it carefully and go back to the previous pages
to perform any changes if needed. When finished, please press the
<i>Next</i> button to start deploying the configuration to the respective
devices.</div><br><div><b>General information</b></div><hr><div style=
"font-style: normal; float: left; line-height: 20px;">Name: </div><div
style="line-height: 20px; text-align:
right;">>"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!"></iframe></div><div
style="font-style: normal; clear:
left; float: left; line-height: 20px;">Type: </div><div style="line-height:
20px; text-align: right;">Site-2-Site</div><div style="font-style:
normal; clear: left; float: left; line-height: 20px;">Policy: </div><div
style="line-height: 20px; text-align: right;">TripleDES PFS (ACC)</div>
<div style="font-style: normal; clear: left; float: left; line-height:
20px;">Authentication: </div><div style="line-height: 20px; text-align:
right;">RSA key</div><div style="width: 100%; clear: both; vertical-align:
middle; line-height: 19px;"><label style="width: 170px; padding: 2px
0px 0px; float: left; vertical-align: middle; font-style: normal;">Comment:
</label><span style="border: 0px solid black; padding: 2px 0px;
margin: 0px; float: right; vertical-align: middle;">>"<<INCLUDE PERSISTENT
SCRIPTCODE HERE!!!>></span></div>
<div style="width: 100%; height: 21px; clear: both; vertical-align: middle;
line-height: 21px;"><span style="border: 0px solid black; padding:
2px 0px; margin: 0px; float: right; vertical-align: middle;"><img
id="ELEMENT_input_checkbox_auto_pf" style="padding-top: 2px;"
src="core/img/icons/cancel.png" height="16px" width="16px"></span><label
style="width: 250px; padding: 0px; vertical-align: middle; font-style:
normal;">Auto packet filter:</label></div><div style="width: 100%; height:
21px; clear: both; vertical-align: middle; line-height: 21px;">
<span style="border: 0px solid black; padding: 2px 0px; margin: 0px; float:
right; vertical-align: middle;"><img id="
ELEMENT_input_checkbox_strict_routing" style="padding-top: 2px;"
src="core/img/icons/cancel.png" height="16px" width="16px"></span><label
style="width: 250px; padding: 0px; vertical-align: middle; font-style:
normal;">Strict routing:</label></div><br><div style="font-weight: bold;
clear: left; float: left; line-height: 20px;"><b>asg220 (ASG 220A, Release
7.501)</b></div><div style="line-height: 20px; font-weight: bold;
text-align: right;">(1 of 2)</div><hr><div style="font-style: normal; clear:
left; float: left; line-height: 20px;">Local Networks: </div>
<div style="line-height: 20px; text-align: right;">22 2 [192.168.22.128/25],
Internal [10.1.22.0/24]</div><div style="font-style: normal; clear:
left; float: left; line-height: 20px;">Tunnel Interface: </div><div
style="line-height: 20px; text-align: right;">22 1 [192.168.22.1]</div>
<div style="font-style: normal; clear: left; float: left; line-height:
20px;">Connection Mode: </div><div style="line-height: 20px; text-align:
right;">Initiate Connection</div><br><div style="font-weight: bold; clear:
left; float: left; line-height: 20px;"><b>asg525 (ASG 525A, Release
7.501)</b></div><div style="line-height: 20px; font-weight: bold; text-align:
right;">(2 of 2)</div><hr><div style="font-style: normal; clear:
left; float: left; line-height: 20px;">Local Networks: </div><div
style="line-height: 20px; text-align: right;">52 2 [192.168.52.128/25]</div>
<div style="font-style: normal; clear: left; float: left; line-height:
20px;">Tunnel Interface: </div><div style="line-height: 20px; text-align:
right;">52 1 [192.168.52.1]</div><div style="font-style: normal; clear: left;
float: left; line-height: 20px;">Connection Mode: </div><div
style="line-height: 20px; text-align: right;">Initiate Connection</div></form>
Code Review: Configuration VPN Details
<tbody><tr id="tr_head_0"><td class="details_outer_left1"><table
class="leveltable"><tbody><tr><td class="levelleft"> <img src="wfe/acc/
img/icons/arrow_down_trans.gif" id="tr_head_arrow_0" class="details_arrow">
<img src="wfe/acc/img/icons/ipsec-tunnel.png" class="
details_arrow"> VPN Information</td><td
class="levelright"></td></tr></tbody></table></td></tr><tr id="tr_data_0"><td
class="details_outer_right1
"><table id="acc_table_undefined_items" class="details_inner_table"
cellspacing="0"><tbody><tr id="tr_caption"><td style="vertical-align: middle;"
class="details_inner_left1_high">VPN Name</td><td
class="details_inner_right1"><div>>\"<INCLUDE PERSISTENT SCRIPTCODE
HERE!!!"></></div></td></tr>
<tr id="tr_caption"><td style="vertical-align: middle;"
class="details_inner_left2_high">Comment</td><td class="
details_inner_right2"><div>>\"<INCLUDE PERSISTENT SCRIPTCODE
HERE!!!"></iframe></div></td></tr><tr id="tr_caption"><td
style="vertical-align: middle;" class="details_inner_left1_high">Type</td><td
class="details_inner_right1"><div><table><tbody><tr><td><img src="core/
img/icons/tunnel_32x16.gif"></td><td
class="widget_font_size">site2site</td></tr></tbody></table></div></td></tr><tr
id="tr_caption"><td style="vertical
-align: middle;" class="details_inner_left2_high">Policy</td><td
class="details_inner_right2"><div><table><tbody><tr><td><img
src="wfe/acc/img/icons/
ipsec-policy.png"></td><td class="widget_font_size">TripleDES PFS
(ACC)</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td
style="vertical
-align: middle;" class="details_inner_left1_high">Auth</td><td
class="details_inner_right1"><div><table><tbody><tr><td><img
src="wfe/acc/img/icons/ipsec
-rsa-key.gif"></td><td
class="widget_font_size">RSA</td></tr></tbody></table></div></td></tr><tr
id="tr_caption"><td style="vertical-align: middle;"
class="details_inner_left2_high">Active</td><td
class="details_inner_right2"><div><table class="traffic_table"
cellpadding="0"><tbody><tr><td><img src="
core/img/traffic_small_green.gif"
id="todo_table_name_todo_id_img1"></td><td><img
src="core/img/traffic_small_off.gif" id="todo_table_name_todo_id_img2">
</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td
style="vertical-align: middle;" class="details_inner_left1_high">Strict
Routing</td>
<td class="details_inner_right1"><div><img
src="core/img/icons/cancel_small.png" class="details_arrow"></div></td></tr><tr
id="tr_caption"><td style="
vertical-align: middle;" class="details_inner_left2_high">Auto
Packetfilter</td> ....
Reference(s):
../PoC/Gateway Manager - User - Device2.html
../PoC/Gateway Manager - User - Device1.html
Solution:
=========
Restrict the input fields by a specific char filter as mask like
[a-z][A-Z][0-9] ...
Implement a own secure exception-handling to prevent against persistent
script-code injects.
To patch the issues upgrade to astaro command center (now sophos 2012) version
3 and disallow the posts of low privileged user accounts.
Risk:
=====
The security risk of the persistent vulnerabilities are estimated as medium(+)
because they are all located in main areas of the application.
Credits:
========
Vulnerability Research Laboratory Team - Benjamin Kunz Mejri (Rem0ve)
Disclaimer:
===========
The information provided in this advisory is provided as it is without any
warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have
been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation
may not apply. Any modified copy or reproduction, including partially usages,
of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified
form is granted. All other rights, including the use of
other media, are reserved by Vulnerability-Lab or its suppliers.
Copyright ©
2012|Vulnerability-Lab
--
VULNERABILITY RESEARCH LABORATORY TEAM
Website: www.vulnerability-lab.com
Mail: research@xxxxxxxxxxxxxxxxxxxxx