Date: Fri, 17 Jun 2016 01:09:26 +0200
From: Remco Sprooten <remco@...ooten.org>
To: fulldisclosure@...lists.org, bugtraq@...urityfocus.com
Subject: [FD] Multiple vulnerabilities in squid 0.4.16_2 running on pfSense

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

I. VULNERABILITY
- -------------------------
Multiple vulnerabilities in squid 0.4.16_2 running on pfSense
Version 2.3.1-RELEASE-p1

II. BACKGROUND
- -------------------------
The pfSense project is a free network firewall distribution, based on the
FreeBSD operating system, with a custom kernel and an array of third-party
free software packages that can be installed for additional functionality.
Through this package system pfSense software is able to provide most of
the functionality of common commercial firewalls, and many times more.

III. DESCRIPTION
- -------------------------
In pfSense, it is possible to configure a third-party package, Squid, to
act as a transparent HTTP proxy. This package uses clamd as an AV
solution.

If clamd detects a piece of malware in one of the proxied requests, the
request is blocked and the user is redirected to the following URL
instead:

https://10.10.10.1/squid_clwarn.php?url=http://www.eicar.org/download/eicar.com&source=10.10.10.100&user=-&virus=stream:%20Eicar-TestSignature%20FOUND

Upon inspection of the source code of the Squid package, the file
"squid_clwarn.php" appears to contain several vulnerabilities.
At the start of the file we see that various HTTP GET parameters are
loaded into local variables through the $_REQUEST superglobal:

==========================================================================
$url = $_REQUEST['url'];
$virus = ($_REQUEST['virus'] ? $_REQUEST['virus'] : $_REQUEST['malware']);
$source = preg_replace("@/-@", "", $_REQUEST['source']);
$user = $_REQUEST['user'];
==========================================================================

These variables are later rendered directly into HTML output, without any
form of escaping, thus resulting in a reflected XSS vulnerability.

Proof of Concept:
https://10.10.10.1/squid_clwarn.php?url=xyz&source=xyz&user=&virus=stream:<script>alert('xss')</script>

The information sent in this HTTP GET request is also saved to a log file:
==========================================================================
error_log(date("Y-m-d H:i:s") . " | VIRUS FOUND | " . $virus . " | " .
$url . " | " . $source . " | " . $user . "\n", 3,
"/var/log/c-icap/virus.log");
==========================================================================

An administrator who looks at the logs through the pfSense web-GUI, at
"squid-monitor.php", will be open to a stored XSS vulnerability, because
the variables are rendered directly into HTML output, without proper
escaping:

Finally, there is no authentication present in the "squid_clwarn.php"
file, resulting in possible log manipulation attacks. For example,
requesting the following URL will result in an empty log entry being
added.

Proof of Concept:
https://10.10.10.1/squid_clwarn.php?url=%0A|||||

IV. BUSINESS IMPACT
- -------------------------
An attacker can execute arbitrary JavaScript code in a targeted
user's browser, as well as any administrators viewing the log files
through the pfSense web-GUI.

V. SYSTEMS AFFECTED
- -------------------------
Tested on:
2.3.1-RELEASE-p1 (amd64)
built on Wed May 25 14:53:06 CDT 2016
FreeBSD 10.3-RELEASE-p3

With:
squid 0.4.16_2

VI. SOLUTION
- -------------------------
Upgrade squid to version 0.4.18.

VII. REVISION HISTORY
- -------------------------
June 10, 2016: Initial release

VIII. DISCLOSURE TIMELINE
- -------------------------
June 7, 2016: Vulnerability discovered by Remco Sprooten
June 7, 2016: Contacted vendor
June 7, 2016: Vendor confirmed the vulnerability
June 7, 2016: Vendor fixed the XSS vulnerabilities
June 8, 2016: Vendor updated to fix to prevent false log entries
June 16, 2016: Vendor released a SA:
https://www.pfsense.org/security/advisories/pfSense-SA-16_06.squid.asc
June 17, 2016: Sent to lists

IX. REFERENCES
- -------------------------
Devel (pfSense 2.4 packages):
https://github.com/pfsense/FreeBSD-ports/commit/e99ba5ea416690285a4ab3e094c4b2c0fb20c735
https://github.com/pfsense/FreeBSD-ports/commit/442b7dd6b6e3ff8976f88ab1f168d365cdebe520

RELENG_2_3_1 (pfSense 2.3.1_x packages):
https://github.com/pfsense/FreeBSD-ports/commit/e2a02e3773f33d0bd9f450ffb0d9cfd7215791b8
https://github.com/pfsense/FreeBSD-ports/commit/408eb385c5696a271945226bb10c77dc2231793c

RELENG_2_3 (pfsense 2.3.2 packages):
https://github.com/pfsense/FreeBSD-ports/commit/90bcaee8d8315e4026e2afed2ea7c6fdd55ffd20
https://github.com/pfsense/FreeBSD-ports/commit/d581d14a7a88027655719c8ad3f9bed7c2f7585f

RELENG_2_3_0 (pfSense 2.3_x packages):
https://github.com/pfsense/FreeBSD-ports/commit/e82ef1c5b43ab4fd1117966d0de881655958f1f3
https://github.com/pfsense/FreeBSD-ports/commit/b301844cadcb2887c788be38eadc9b50ea5b8d52

X. LEGAL NOTICES
- -------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XI. ABOUT
- -------------------------
Remco Sprooten
Security Consultant


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXYzAjAAoJEMAbBFdxLTwF2jUQAKAtkzMaeK0svql8mWx4dcyC
CJaNe1tiYfjl9tIv7ywSFzGh3Bq7WdcxiOVgDEj+0Co5+H8B2+EslezJg6636BMP
svOq57xpEo7qMqnnRGpJAI1Ytyky+nUI+aSr472vuuwEFiXg7rmJx2UsfFPcoQDG
YgfUtLwrYdkLatq5RBX38Q3I6KWHFNgflcp7RHvbi+3/CcOYzBkYhoQRm7faZIgN
n74ymI2+PFq3pvhLnOLRtKLftVro5n0XmK/ADFVIcC7Mw1gOalvREkCi0He8dYoE
mdr9oPNESKFcVadFgrJiO/KTdcc+DwYuU+p+yYF7pMGvLLEGUQJPdIcfd2n5AS1D
4Y8kdmIOJPmzCWsWJ8LZRu/kLy3H/jaDZlBkhOElbQk2Z+h0KxeCNDeatxtopGpn
jizuDqrhTrBw3prQRWn/zvCeuuA/EFtVrMFcL0k04ilHa+543m9abXshKQss8S89
eUvsDQNgz4hWPw46Ptp2NBpUwyrci2QW8mZG1iKvjrycW7GVN80dfs+sdf5EcJuX
DYJQ7qAyIDnUBOQgcEvzRnn+oD7JlvCqFhKfASlK8S9BlzSD9qAJydh8sfliaH0r
LnUOJd3ucBqM5OrscHPnrMD7siXsy54ZEMiAVZP/D6H29uNL1QmEN/fr4uUjpaZC
N1qM2bqWy4u471A2GKN8
=ih9y
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists