Date: Sun, 08 Apr 2012 05:08:50 +0200
From: Research <research@...nerability-lab.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Astaro Command Center v2.x - Multiple Web
	Vulnerabilities

Title:
======
Astaro Command Center v2.x - Multiple Web Vulnerabilities


Date:
=====
2012-04-03


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=4


VL-ID:
=====
4


Introduction:
=============
We are pleased to announce the General Availability of the Astaro Command Center Version 2.0. This new version introduces the major new ability 
to configure and manage IPSEC tunnels entirely within ACC itself. By providing a centralized location from which to work with and deploy VPN 
tunnels between Astaro installations, administrators can save management time and automate many of the tasks involved in successfully linking 
sites together with encrypted links. The Astaro Command Center is an entirely free product that allows you to centrally monitor and maintain 
multiple Astaro installations & devices. If you currently are responsible for more than one Astaro Gateway product, ACC is designed for you! 
Read on for more information. Starting with this release, it is now possible to setup site-to-site VPN tunnels with an amazing degree of ease 
from within Astaro Command Center itself. Simply indicate the devices to be joined together via VPN, select a few options, and the rest is 
automated with no need to login to each individual WebAdmin for the configuration. ACC is presented in the same administrative style as our AxG 
Version 7 WebAdmin, so that if you are new to ACC you will have no trouble getting started within a familiar looking environment.

(Copy from vendors homepage: http://up2date.astaro.com/2009/03/astaro_comand_center_20_releas.html#more)


Abstract:
=========
Vulnerability-Lab Team discovers multiple Input Validation Vulnerabilities on Astaros Command Center Application v2.x


Report-Timeline:
================
2011-01-12: Verified by Vulnerability-Lab
2011-06-15: Secure Vendor Notification
2011-06-17: Vendor Reply/Feedback
2012-03-22: Vendor Fix/Patch Disclosure by Check
2012-04-03: Discovery by Vulnerability-Lab


Status:
========
Published


Affected Products:
==================

Exploitation-Technique:
=======================
Remote


Severity:
=========
High


Details:
========
Multiple  persistent input validation vulnerabilities are detected in Astaro Command Center v2.x.
The bugs allows an local privileged attackers to implement/inject malicious script code on the application side (persistent).
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) 
context manipulation. Exploitation requires user inter action & minimum restricted access to the panel.

Vulnerable Module(s):
						[+] Configuration - Networks Definition
						[+] Deploy Function
						[+] Summary
						[+] VPN Information/ Configuration VPN Details
						[+] Management - Organizational Units


Proof of Concept:
=================
This vulnerabilities can be exploited local(persistent) by low privileged user accounts or 
by user inter-action (remote) via request force  ...


Code Review: Networks Definition

<tr><td style="width: 72px; vertical-align: top;" valign="top"><img class="TABLEOBJITEM_BUTTON_edit" src="core/img/blank1x1.gif"><span>
</span><img class="TABLEOBJITEM_BUTTON_clone" src="core/img/blank1x1.gif"><img style="width: 72px; height: 1px;" src="core/img/blank1x1.gif">
<img style="padding: 2px; cursor: pointer;" src="wfe/acc/img/buttons/button_custom_delete.png"><img style="padding: 2px; cursor: pointer; 
display: none;" src="wfe/acc/img/buttons/button_custom_info.png"></td><td style="vertical-align: top; padding: 2px;" valign="top"><table style=
"width: 100%;" border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-top: 2px;" id="global_object_td_REF_ACC_GBL_
16fe7d084bbe4b05b7f25b74e5d18aa98aa9"><table border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-right: 4px; width: 16px;">
<input id="global_objects_cb_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9" class="registration_checkbox_style" type="checkbox"></td><td style="
padding-right: 4px; width: 16px;"><img src="wfe/acc/img/icons/host.png"></td><td style="font-weight: bold; padding-right: 4px; width: 300px;">
<span>>"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!></iframe></span></td><td style="padding-right: 4px; width: 185px;">
<span>10.129.11.11</span></td><td style="padding-right: 4px;"><img class="img_button" src="wfe/acc/img/buttons/button_deploy_70.png" id="button_deploy
_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9"></td></tr></tbody></table></td></tr><tr><td><table border="0" cellpadding="0" cellspacing="0">
<tbody><tr><td style="padding-right: 4px; width: 16px;"><span></span></td><td style="padding-right: 4px; padding-top: 4px; width: 320px;"><span>
</span></td><td style="padding-right: 4px; padding-top: 4px; width: 185px;"><span><img src="wfe/acc/img/icons/ldap-container.gif" style="float: left; 
padding-right: 4px;">Astaro AG</span></td><td style="padding-right: 4px; padding-top: 4px;"><img class="img_button_transparent" src="wfe/acc/img/buttons
/button_undeploy_70.png" id="button_undeploy_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9"></td></tr></tbody></table></td></tr><tr><td><table 
border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-right: 4px; width: 16px;"><span></span></td><td style="padding-right: 1px; 
padding-top: 4px; width: 16px;"><img style="cursor: pointer;" src="wfe/acc/img/icons/check_14.png"></td><td style="font-weight: normal; padding-right: 
4px; padding-top: 4px; width: 40px;"><span>0</span></td><td style="padding-right: 1px; padding-top: 4px; width: 16px;"><img style="cursor: pointer;" 
src="wfe/acc/img/icons/cancel_14.png"></td><td style="font-weight: normal; padding-right: 4px; padding-top: 4px; width: 40px;"><span>0</span></td><td 
style="padding-right: 1px; padding-top: 4px; width: 16px;"><img style="cursor: pointer;" src="wfe/acc/img/icons/service-fail_14.png"></td><td style="
font-weight: normal; padding-right: 4px; padding-top: 4px; width: 40px;"><span>0</span></td><td style="padding-right: 1px; padding-top: 4px; width: 
16px;"><img style="cursor: pointer;" src="wfe/acc/img/icons/icon_deploy_14.png"></td><td style="font-weight: normal; padding-right: 4px; padding-top: 
4px; width: 120px;"><span>0</span></td></tr></tbody></table></td></tr></tbody></table></td><td style="width: 40px; vertical-align: top;" valign="top">
<img class="TABLEOBJITEM_BUTTON_usageinformation" src="core/img/blank1x1.gif"></td></tr>



Code Review: Deploy Functions

<tr><td><img src="core/img/icons/trash.png" style="margin-right: 6px; margin-left: 2px; cursor: pointer;" id="__DND__DROPPED_REF_ACC_GBL_
16fe7d084bbe4b05b7f25b74e5d18aa98aa9_trash_icon"></td><td><div style="vertical-align: middle; overflow: hidden; cursor: pointer; white-space: 
nowrap;"><img src="wfe/acc/img/icons/host.png" style="display: inline; vertical-align: middle; padding: 2px;"><div style="display: inline; 
vertical-align: middle; white-space: nowrap; padding: 2px 2px 2px 0px;">>"<<INCLUDE PERSISTENT SCRIPTCODE HERE!!!>></div>
<div style="position: relative; overflow: hidden; height: 0px; width: 0px; margin-left: 20px;"></div></div></td></tr>



Code Review: Summery Repaste

<form id="__FORM" style="width: 100%;"><div style="font-size: 14px; font-weight: bold;">Summary</div><br><div>This is a summary of the resulting 
VPN configuration. Please review it carefully and go back to the previous pages to perform any changes if needed. When finished, please press the 
<i>Next</i> button to start deploying the configuration to the respective devices.</div><br><div><b>General information</b></div><hr><div style=
"font-style: normal; float: left; line-height: 20px;">Name: </div><div style="line-height: 20px; text-align: 
right;">>"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!"></iframe></div><div style="font-style: normal; clear: 
left; float: left; line-height: 20px;">Type: </div><div style="line-height: 20px; text-align: right;">Site-2-Site</div><div style="font-style: 
normal; clear: left; float: left; line-height: 20px;">Policy: </div><div style="line-height: 20px; text-align: right;">TripleDES PFS (ACC)</div>
<div style="font-style: normal; clear: left; float: left; line-height: 20px;">Authentication: </div><div style="line-height: 20px; text-align: 
right;">RSA key</div><div style="width: 100%; clear: both; vertical-align: middle; line-height: 19px;"><label style="width: 170px; padding: 2px 
0px 0px; float: left; vertical-align: middle; font-style: normal;">Comment: </label><span style="border: 0px solid black; padding: 2px 0px; 
margin: 0px; float: right; vertical-align: middle;">>"<<INCLUDE PERSISTENT SCRIPTCODE HERE!!!>></span></div>
<div style="width: 100%; height: 21px; clear: both; vertical-align: middle; line-height: 21px;"><span style="border: 0px solid black; padding: 
2px 0px; margin: 0px; float: right; vertical-align: middle;"><img id="ELEMENT_input_checkbox_auto_pf" style="padding-top: 2px;" 
src="core/img/icons/cancel.png" height="16px" width="16px"></span><label style="width: 250px; padding: 0px; vertical-align: middle; font-style: 
normal;">Auto packet filter:</label></div><div style="width: 100%; height: 21px; clear: both; vertical-align: middle; line-height: 21px;">
<span style="border: 0px solid black; padding: 2px 0px; margin: 0px; float: right; vertical-align: middle;"><img id="
ELEMENT_input_checkbox_strict_routing" style="padding-top: 2px;" src="core/img/icons/cancel.png" height="16px" width="16px"></span><label 
style="width: 250px; padding: 0px; vertical-align: middle; font-style: normal;">Strict routing:</label></div><br><div style="font-weight: bold; 
clear: left; float: left; line-height: 20px;"><b>asg220 (ASG 220A, Release 7.501)</b></div><div style="line-height: 20px; font-weight: bold; 
text-align: right;">(1 of 2)</div><hr><div style="font-style: normal; clear: left; float: left; line-height: 20px;">Local Networks: </div>
<div style="line-height: 20px; text-align: right;">22 2  [192.168.22.128/25], Internal  [10.1.22.0/24]</div><div style="font-style: normal; clear: 
left; float: left; line-height: 20px;">Tunnel Interface: </div><div style="line-height: 20px; text-align: right;">22 1  [192.168.22.1]</div>
<div style="font-style: normal; clear: left; float: left; line-height: 20px;">Connection Mode: </div><div style="line-height: 20px; text-align: 
right;">Initiate Connection</div><br><div style="font-weight: bold; clear: left; float: left; line-height: 20px;"><b>asg525 (ASG 525A, Release 
7.501)</b></div><div style="line-height: 20px; font-weight: bold; text-align: right;">(2 of 2)</div><hr><div style="font-style: normal; clear: 
left; float: left; line-height: 20px;">Local Networks: </div><div style="line-height: 20px; text-align: right;">52 2  [192.168.52.128/25]</div>
<div style="font-style: normal; clear: left; float: left; line-height: 20px;">Tunnel Interface: </div><div style="line-height: 20px; text-align: 
right;">52 1  [192.168.52.1]</div><div style="font-style: normal; clear: left; float: left; line-height: 20px;">Connection Mode: </div><div 
style="line-height: 20px; text-align: right;">Initiate Connection</div></form>



Code Review: Configuration VPN Details

<tbody><tr id="tr_head_0"><td class="details_outer_left1"><table class="leveltable"><tbody><tr><td class="levelleft">  <img src="wfe/acc/
img/icons/arrow_down_trans.gif" id="tr_head_arrow_0" class="details_arrow">   <img src="wfe/acc/img/icons/ipsec-tunnel.png" class="
details_arrow"> VPN Information</td><td class="levelright"></td></tr></tbody></table></td></tr><tr id="tr_data_0"><td class="details_outer_right1
"><table id="acc_table_undefined_items" class="details_inner_table" cellspacing="0"><tbody><tr id="tr_caption"><td style="vertical-align: middle;" 
class="details_inner_left1_high">VPN Name</td><td class="details_inner_right1"><div>>\"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!"></></div></td></tr>
<tr id="tr_caption"><td style="vertical-align: middle;" class="details_inner_left2_high">Comment</td><td class="
details_inner_right2"><div>>\"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!"></iframe></div></td></tr><tr id="tr_caption"><td 
style="vertical-align: middle;" class="details_inner_left1_high">Type</td><td class="details_inner_right1"><div><table><tbody><tr><td><img src="core/
img/icons/tunnel_32x16.gif"></td><td class="widget_font_size">site2site</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td style="vertical
-align: middle;" class="details_inner_left2_high">Policy</td><td class="details_inner_right2"><div><table><tbody><tr><td><img src="wfe/acc/img/icons/
ipsec-policy.png"></td><td class="widget_font_size">TripleDES PFS (ACC)</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td style="vertical
-align: middle;" class="details_inner_left1_high">Auth</td><td class="details_inner_right1"><div><table><tbody><tr><td><img src="wfe/acc/img/icons/ipsec
-rsa-key.gif"></td><td class="widget_font_size">RSA</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td style="vertical-align: middle;" 
class="details_inner_left2_high">Active</td><td class="details_inner_right2"><div><table class="traffic_table" cellpadding="0"><tbody><tr><td><img src="
core/img/traffic_small_green.gif" id="todo_table_name_todo_id_img1"></td><td><img src="core/img/traffic_small_off.gif" id="todo_table_name_todo_id_img2">
</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td style="vertical-align: middle;" class="details_inner_left1_high">Strict Routing</td>
<td class="details_inner_right1"><div><img src="core/img/icons/cancel_small.png" class="details_arrow"></div></td></tr><tr id="tr_caption"><td style="
vertical-align: middle;" class="details_inner_left2_high">Auto Packetfilter</td> ....



Reference(s):
		../PoC/Gateway Manager - User - Device2.html
		../PoC/Gateway Manager - User   - Device1.html


Solution:
=========
Restrict the input fields by a specific char filter as mask like [a-z][A-Z][0-9]  ...
Implement a own secure exception-handling to prevent against persistent script-code injects.

To patch the issues upgrade to astaro command center (now sophos 2012) version 3 and disallow the posts of low privileged user accounts.


Risk:
=====
The security risk of the persistent vulnerabilities are estimated as medium(+) because they are all located in main areas of the application.


Credits:
========
Vulnerability Research Laboratory Team - Benjamin Kunz Mejri (Rem0ve)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of 
other media, are reserved by Vulnerability-Lab or its suppliers.

    						Copyright © 2012|Vulnerability-Lab




-- 
VULNERABILITY RESEARCH LABORATORY TEAM
Website: www.vulnerability-lab.com
Mail: research@...nerability-lab.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists