full-disclosure - [FD] [KIS-2016-12] Magento <= 1.9.2.2 (RSS Feed) Information Disclosure Vulnerability

Open Source and information security mailing list archives

Message-ID: <17a4a29b-42ab-aad6-c99f-dd0e66588e43@karmainsecurity.com>
Date: Thu, 6 Oct 2016 21:18:48 +0200
From: Egidio Romano <research@...mainsecurity.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [FD] [KIS-2016-12] Magento <= 1.9.2.2 (RSS Feed) Information
 Disclosure Vulnerability

------------------------------------------------------------------------------------
Symantec Web Gateway <= 5.2.2 (new_whitelist.php) OS Command Injection 
Vulnerability
------------------------------------------------------------------------------------

[-] Software Link:

https://www.symantec.com/

[-] Affected Versions:

Version 5.1.1.24, 5.2.1.80 and 5.2.2.118. Other versions might be affected.

[-] Vulnerability Description:

The vulnerable code is located in the /spywall/new_whitelist.php script:

141.    $isNew = $_POST['isNew'];
142.    $sid   = $_POST['sid'];
143.    $exceptions = array();
144.    $last_modified = time();
145.    /* validate input */
146.
147.    if (!$sid && !isValidWhiteDomain($white_ip) && 
!isIpSubnet($white_ip)) {
148.        $errors['white_ip'] = 'Please enter a valid domain or IP 
address or IP/mask.';
149.    }

The vulnerability exists because the validation checks may be bypassed 
by setting the "sid" POST parameter to a
value different from zero. In this way, even though the "white_ip" POST 
parameter (assigned to the $white_ip variable)
is not a valid domain or IP address, it will be passed to the 
add_whitelist() function as its $url parameter:

329.    function add_whitelist ($signature, $url, $whitelist, 
$ignore_auth, $restoreConfig = 0) {
330.        [...]
331.        if (!isCiu()){
332.            if ($restoreConfig) {
333.                syscall("sudo /usr/local/bin/updateDB 2 1 $url 
$whitelist $ignore_auth [...]
334.            } else {
335.                syscall("sudo /usr/local/bin/updateDB 2 1 $url 
$whitelist $ignore_auth [...]
336.            }
337.        }

This can be exploited to inject and execute arbitrary OS commands with 
the privileges of the "root" user on the appliance.
Successful exploitation of this vulnerability requires an user account 
with read-write permissions (POLICY_LEVEL).

[-] Solution:

Update to version 5.2.5.

[-] Disclosure Timeline:

[09/07/2016] - Vendor notified
[11/07/2016] - Vendor response
[09/09/2016] - Vendor asks to confirm this is fixed in version 5.2.5
[15/09/2016] - Feedback sent to the vendor
[05/10/2016] - Publication of vendor"s advisory: https://goo.gl/aOJq5A
[06/10/2016] - Publication of this advisory

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2016-5313 to this vulnerability.

[-] Credits:

Vulnerability discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2016-12

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives