[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Fortigate UTM WAF Appliance - Cross Site Vulnerabilities

Title:
======
Fortigate UTM WAF Appliance - Cross Site Vulnerabilities


Date:
=====
2012-09-07


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=559


VL-ID:
=====
559


Common Vulnerability Scoring System:
====================================
3.5


Introduction:
=============
The FortiGate series of multi-threat security systems detect and eliminate the 
most damaging, content-based threats from email 
and Web traffic such as viruses, worms, intrusions, inappropriate Web content 
and more in real time - without degrading 
network performance.

Ranging from the FortiGate-30 series for small offices to the FortiGate-5000 
series for large enterprises, service providers and 
carriers, the FortiGate line combines the FortiOS™ security operating system 
with FortiASIC processors and other hardware to provide 
a comprehensive and high-performance array of security and networking functions 
including:

    * Firewall, VPN, and Traffic Shaping
    * Intrusion Prevention System (IPS)
    * Antivirus/Antispyware/Antimalware
    * Web Filtering
    * Antispam
    * Application Control (e.g., IM and P2P)
    * VoIP Support (H.323. and SCCP)
    * Layer 2/3 routing
    * Multiple WAN interface options

FortiGate appliances provide cost-effective, comprehensive protection against 
network, content, and application-level threats - including 
complex attacks favored by cybercriminals - without degrading network 
availability and uptime. FortiGate platforms incorporate sophisticated 
networking features, such as high availability (active/active, active/passive) 
for maximum network uptime, and virtual domain (VDOM) 
capabilities to separate various networks requiring different security policies.

Fortigate applainces are Pentagon & US Military certified. 
The military provides high security standards & save outdoor camps, air base, 
offices with fortigate hardware.

(Copy from the Vendor Homepage: http://www.fortinet.com/products/fortigate )


Abstract:
=========
Vulnerability-Lab Research Team discovered multiple non-persistent Web 
Vulnerabilities in the FortiGates UTM Appliance Application.


Report-Timeline:
================
2012-05-07:     Researcher Notification & Coordination
2012-05-10:     Vendor Notification
2012-06-08:     Vendor Response/Feedback
2012-08-30:     Vendor Fix/Patch ( FortiOS v4.3.8 B0630 & FortiOS v5.0 B064 )
2012-09-07:     Public or Non-Public Disclosure


Status:
========
Published


Affected Products:
==================
Fortigate
Product: UTM Firewall Appliance Application vFortiGate-5000 
Series;FortiGate-3950 Series;FortiGate-3810A;


Exploitation-Technique:
=======================
Remote


Severity:
=========
Medium


Details:
========
Multiple input validation vulnerabilities (non-persistent) are detected in the 
FortiGates UTM Appliance Application. 
The vulnerability allows remote attackers to hijack admin/customer sessions 
with required user inter action (client-side). 
Successful exploitation allows to phish user accounts, hijacking sessions, 
redirect over client side requests or manipulate 
website context on client-side browser requests.


Vulnerable Module(s): (Non-Persistent)
                                                [+] Exception Handling - 
objusagedlg
                                                [+] WiFi-controller SSID - Topic
                                                [+] Display Message - Title & 
Message

Picture(s):
                                                ../1.png
                                                ../2.png


Interface - UTM WAF Web Application [Appliance]
FortiGate-5000 Series;FortiGate-3950 
Series;FortiGate-3810A;FortiGate-3600A;FortiGate-3016B;FortiGate-1240B
FortiGate-800;FortiGate-620B;FortiGate-311B;FortiGate-310B;FortiGate-300A;FortiGate-224B;FortiGate-200B
 Series


Proof of Concept:
=================
The non-persistent vulnerability can be exploited by remote attackers with 
medium or high required user inter action. 
For demonstration or reproduce  ...


Code Review:    Exception Handling - objusagedlg
URL:            http://appliance.127.0.0.1:137/objusagedlg?type=220&mkey=

<div style="text-align: center;"><h2>WiFi-controller SSID "<span 
class="emphasized_msg">"><[EXECUTES NON-PERSISTENT SCRIPTCODE HERE!] <
</span>" is used by:</h2><div>Total References: <span 
id="total_refcount"></span></div><div class="info_msg"><span id="total_unused">
</span> object types that may be configured to use this object have no 
references (<span id="unused_toggle"></span>)</div>
<form name="search_params"><input name="type" value="220" type="hidden"><input 
name="mkey" value="" type="hidden">
<iframe src="objusagedlg-Dateien/hack.htm" [EXECUTES NON-PERSISTENT SCRIPTCODE 
HERE!]>' <"=""><input
 type="hidden" name="mkey_display" value="" /></form><div 
id="reftable-container"></div>&


Code Review:    Display Message - Title & Message
URL:            
https://appliance.127.0.0.1:137/displaymessage?url=/webfilter/profile/dlg&title=

<td>">[EXECUTES NON-PERSISTENT SCRIPTCODE HERE!]' <<="" td="">
</tr>
</table></td>
</tr>
<tr>
<td class="body" height=100><table class="body"><tr><td align="center">
Notice: This is a hack by BKM<br>
</td></tr></table></td>
</tr>
<tr><td>
<table class="footer" cellpadding="0" cellspacing="0">
<tr><td>
<input class="button" type="button" value="OK" onclick="if (window.opener) { 
window.close(); } else if 
(parent && parent.wij_in_modal_op && parent.wij_in_modal_op()) { if (0 && 
parent.callback_handlers) parent.callback_handlers.should_call = true; 
parent.wij_end_modal_dialog(); } 
else { document.location='/webfilter/profile/dlg'; }">
</td></tr>
</table>
</td></tr>
</table>
</body>
</html>
</iframe></td>


PoC:
http://appliance.127.0.0.1:137/objusagedlg?type=220&mkey=<INCLUDE 
NON-PERSISTENT SCRIPTCODE HERE!>
https://appliance.127.0.0.1:137/displaymessage?url=/webfilter/profile/dlg&title=<INCLUDE
 NON-PERSISTENT SCRIPTCODE HERE!>&msg=Notice:hacking firewall 6am


Reference(s):
                        ../objusagedlg.htm
                        ../displaymessage.htm


Solution:
=========
Restrict the mkey, context, title and msg parameter. Parse the client side 
input & output listings on requests to fix 
the issue stable. Filter & restrict the input request of the 
exception-handling. Validate the output listing to 
patch/fix the stable client side cross site scripting vulnerability.

   * FortiOS v4.3.8 B0630
   * FortiOS v5.0 B064


Risk:
=====
The security risk of the non-persistent cross site scripting vulnerabilities 
are estimated as medium(-).


Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri 
(bkm@xxxxxxxxxxxxxxxxxxxxx)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, 
indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have 
been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential 
or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor 
licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com              
               - www.vulnerability-lab.com/register
Contact:    admin@xxxxxxxxxxxxxxxxxxxxx         - support@xxxxxxxxxxxxxxxxxxxxx 
               - research@xxxxxxxxxxxxxxxxxxxxx
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com   
               - news.vulnerability-lab.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab 
               - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - 
vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file 
requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is 
granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All 
pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the 
specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or 
support@xxxxxxxxxxxxxxxxxxxxx) to get a permission.

                                        Copyright © 2012 | Vulnerability 
Laboratory



-- 
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/