The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction
None
UI
The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
Low
C
There is some impact on confidentiality, but the attacker either does not gain control of any data, or the information obtained does not have a significant impact on the system or its operations.
Integrity
Low
I
Modification of data is possible, but the attacker does not have control over what can be modified, or the extent of what the attacker can affect is limited. The data modified does not have a direct, serious impact on the system.
Availability
None
A
There is no impact on the availability of the system; the attacker does not have the ability to disrupt access to or use of the system.
Title:
======
Fortigate UTM WAF Appliance - Cross Site Vulnerabilities
Date:
=====
2012-09-07
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=559
VL-ID:
=====
559
Common Vulnerability Scoring System:
====================================
3.5
Introduction:
=============
The FortiGate series of multi-threat security systems detect and eliminate the most damaging, content-based threats
from email
and Web traffic such as viruses, worms, intrusions, inappropriate Web content and more in real time - without degrading
network performance.
Ranging from the FortiGate-30 series for small offices to the FortiGate-5000 series for large enterprises, service
providers and
carriers, the FortiGate line combines the FortiOS™ security operating system with FortiASIC processors and other
hardware to provide
a comprehensive and high-performance array of security and networking functions including:
* Firewall, VPN, and Traffic Shaping
* Intrusion Prevention System (IPS)
* Antivirus/Antispyware/Antimalware
* Web Filtering
* Antispam
* Application Control (e.g., IM and P2P)
* VoIP Support (H.323. and SCCP)
* Layer 2/3 routing
* Multiple WAN interface options
FortiGate appliances provide cost-effective, comprehensive protection against network, content, and application-level
threats - including
complex attacks favored by cybercriminals - without degrading network availability and uptime. FortiGate platforms
incorporate sophisticated
networking features, such as high availability (active/active, active/passive) for maximum network uptime, and virtual
domain (VDOM)
capabilities to separate various networks requiring different security policies.
Fortigate applainces are Pentagon & US Military certified.
The military provides high security standards & save outdoor camps, air base, offices with fortigate hardware.
(Copy from the Vendor Homepage: http://www.fortinet.com/products/fortigate )
Abstract:
=========
Vulnerability-Lab Research Team discovered multiple non-persistent Web Vulnerabilities in the FortiGates UTM Appliance
Application.
Report-Timeline:
================
2012-05-07: Researcher Notification & Coordination
2012-05-10: Vendor Notification
2012-06-08: Vendor Response/Feedback
2012-08-30: Vendor Fix/Patch ( FortiOS v4.3.8 B0630 & FortiOS v5.0 B064 )
2012-09-07: Public or Non-Public Disclosure
Status:
========
Published
Affected Products:
==================
Fortigate
Product: UTM Firewall Appliance Application vFortiGate-5000 Series;FortiGate-3950 Series;FortiGate-3810A;
Exploitation-Technique:
=======================
Remote
Severity:
=========
Medium
Details:
========
Multiple input validation vulnerabilities (non-persistent) are detected in the FortiGates UTM Appliance Application.
The vulnerability allows remote attackers to hijack admin/customer sessions with required user inter action
(client-side).
Successful exploitation allows to phish user accounts, hijacking sessions, redirect over client side requests or
manipulate
website context on client-side browser requests.
Vulnerable Module(s): (Non-Persistent)
[+] Exception Handling - objusagedlg
[+] WiFi-controller SSID - Topic
[+] Display Message - Title & Message
Picture(s):
../1.png
../2.png
Interface - UTM WAF Web Application [Appliance]
FortiGate-5000 Series;FortiGate-3950 Series;FortiGate-3810A;FortiGate-3600A;FortiGate-3016B;FortiGate-1240B
FortiGate-800;FortiGate-620B;FortiGate-311B;FortiGate-310B;FortiGate-300A;FortiGate-224B;FortiGate-200B Series
Proof of Concept:
=================
The non-persistent vulnerability can be exploited by remote attackers with medium or high required user inter action.
For demonstration or reproduce ...
Code Review: Exception Handling - objusagedlg
URL: http://appliance.127.0.0.1:137/objusagedlg?type=220&mkey=
<div style="text-align: center;"><h2>WiFi-controller SSID "<span class="emphasized_msg">"><[EXECUTES NON-PERSISTENT
SCRIPTCODE HERE!] <
</span>" is used by:</h2><div>Total References: <span id="total_refcount"></span></div><div class="info_msg"><span
id="total_unused">
</span> object types that may be configured to use this object have no references (<span
id="unused_toggle"></span>)</div>
<form name="search_params"><input name="type" value="220" type="hidden"><input name="mkey" value="" type="hidden">
<iframe src="objusagedlg-Dateien/hack.htm" [EXECUTES NON-PERSISTENT SCRIPTCODE HERE!]>' <"=""><input
type="hidden" name="mkey_display" value="" /></form><div
id="reftable-container"></div>&
Code Review: Display Message - Title & Message
URL: https://appliance.127.0.0.1:137/displaymessage?url=/webfilter/profile/dlg&title=
<td>">[EXECUTES NON-PERSISTENT SCRIPTCODE HERE!]' <<="" td="">
</tr>
</table></td>
</tr>
<tr>
<td class="body" height=100><table class="body"><tr><td align="center">
Notice: This is a hack by BKM<br>
</td></tr></table></td>
</tr>
<tr><td>
<table class="footer" cellpadding="0" cellspacing="0">
<tr><td>
<input class="button" type="button" value="OK" onclick="if (window.opener) { window.close(); } else if
(parent && parent.wij_in_modal_op && parent.wij_in_modal_op()) { if (0 &&
parent.callback_handlers) parent.callback_handlers.should_call = true; parent.wij_end_modal_dialog(); }
else { document.location='/webfilter/profile/dlg'; }">
</td></tr>
</table>
</td></tr>
</table>
</body>
</html>
</iframe></td>
PoC:
http://appliance.127.0.0.1:137/objusagedlg?type=220&mkey=<INCLUDE NON-PERSISTENT SCRIPTCODE HERE!>
https://appliance.127.0.0.1:137/displaymessage?url=/webfilter/profile/dlg&title=<INCLUDE NON-PERSISTENT SCRIPTCODE
HERE!>&msg=Notice:hacking firewall 6am
Reference(s):
../objusagedlg.htm
../displaymessage.htm
Solution:
=========
Restrict the mkey, context, title and msg parameter. Parse the client side input & output listings on requests to fix
the issue stable. Filter & restrict the input request of the exception-handling. Validate the output listing to
patch/fix the stable client side cross site scripting vulnerability.
* FortiOS v4.3.8 B0630
* FortiOS v5.0 B064
Risk:
=====
The security risk of the non-persistent cross site scripting vulnerabilities are estimated as medium(-).
Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm () vulnerability-lab com)
Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all
warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose.
Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss
of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such
damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing
limitation
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack
into databases
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com -
www.vulnerability-lab.com/register
Contact: admin () vulnerability-lab com - support () vulnerability-lab com - research ()
vulnerability-lab com
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com -
news.vulnerability-lab.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab -
youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php -
vulnerability-lab.com/rss/rss_news.php
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability
Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the
use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode,
videos and
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record,
list (feed),
modify, use or edit our material contact (admin () vulnerability-lab com or support () vulnerability-lab com) to get a
permission.
Copyright 2012 | Vulnerability Laboratory
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum