lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 15 Feb 2018 22:03:58 +0100
From: Oscar Hjelm <contact@...arhjelm.com>
To: fulldisclosure@...lists.org
Subject: [FD] F-Secure Radar Login Page Unvalidated Redirect Vulnerability

F-Secure Radar Login Page Unvalidated Redirect Vulnerability

CVE-2018-6324
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-6324

# Summary
The application will upon successfully logging in redirect the user to a user-controlled destination. A victim user may not recognise that a redirection takes place as they expect to be sent to a new page.

# Vendor Description
F-Secure Radar is a turnkey vulnerability scanning and management platform. It allows you to identify and manage both internal and external threats, report risks, and be compliant with current and future regulations (such as PCI and GDPR compliance). It gives you visibility into shadow IT - to map your full attack surface and respond to critical vulnerabilities associated with cyber threats.
Source: https://www.f-secure.com/en/web/business_global/radar

# Remediation
F-Secure has remediated this issue; no action required for cloud users or on-premise users receiving updates.

# Technical Details

Navigating to the Radar application at https://portal.radar.f-secure.com/ will result in the user being sent to https://portal.radar.f-secure.com/login?ReturnUrl=~2Fdashboard.

Upon successful authentication, the value of the ReturnURL query parameter will be used to determine the redirect destination. It is possible to set this to any arbitrary domain as the value is neither validated nor forced to be a relative path.

The following URL would redirect the user to example.com after logging in:
https://portal.radar.f-secure.com/login?ReturnUrl=~2F~2Fexample.com

This could be used to send the user to a phishing site, prompting them to re-authenticate (e.g. "Wrong password or username, please try again").

# Vulnerability Disclosure Timeline
2018-02-05 - Vulnerability discovered
2018-02-05 - Vendor contact & response
2018-02-09 - Vendor confirms fix
2018-02-15 - Public disclosure

This post is also available at http://oscarhjelm.com/blag/2018/02/f-secure-radar-login-page-unvalidated-redirect-vulnerability/


Best regards,
Oscar Hjelm


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists