full-disclosure - Websense/ISA "Via:" Bypass Redux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20100818101712.5e40dfa8b2f4f620cdf199af6efb8890.2fa5a08cb6.wbe@email02.secureserver.net>
Date: Wed, 18 Aug 2010 10:17:12 -0700
From: <dink@...inkydink.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Websense/ISA "Via:" Bypass Redux

discovered by mrhinkydink

PRODUCT: Websense Enterprise

EXPOSURE: Trivial Web Policy Bypass (III)

LINK:
http://mrhinkydink.blogspot.com/2010/08/websenseisa-via-bypass-redux.html

SYNOPSIS
========

On May 29, 2010 I demonstrated that by adding a "Via:" header to an HTTP
request it is possible for a user to completely bypass filtering and
monitoring in a Websense Enterprise 6.3.3/Microsoft ISA Server (2004 or
2006) proxy integration environment.  This was addressed in Websense
Knowledge Base article #5117.

However, anyone familiar with the Via bypass technique would have
noticed this remediation was insufficient.

PROOF OF CONCEPT
================

The following works in a Websense Enterprise system using the ISA Server
integration product in a Cache Array Routing Protocol (CARP, sometimes
referred to as "CRAP") configuration, which requires at least two ISA
servers.

Assuming there are two ISA servers configured as per Websense Knowledge
Base article #5117, one at IP address 10.10.0.1 and another at
10.10.0.2, perform the following:

I.   Install Firefox >= 3.5

II.  Configure Firefox to use one of the proxy servers in the CARP array
(10.10.0.1).  

III. Obtain and install the Modify Headers plug-in by Gareth Hunt

IV.  Configure the plug-in to add a valid "Via:" header pointing to the
other server in the array.

      Example: "Via: 1.0 10.10.0.2"

V.   Browse to a filtered Web site

VI.  All content is allowed without monitoring or filtering

PoC RESTRICTIONS
================

All restrictions noted in the original Via Bypass article apply.

See http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html

OTHER USES
==========

Limited only by your imagination!  You do have an imagination, don't
you?

See http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html

WORK-AROUNDS
============

Install Hotfix 17 provided by Websense.

HISTORY
=======

06/25/2010 - vendor notified

08/13/2010 - vendor releases Hotfix 17

08/18/2010 - PoC published

c. MMX mrhinkydink

http://mrhinkydink.blogspot.com
http://proxyobsession.net

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/