SonicWALL SOHO/10 Firewall Input Validation Holes Let Remote Users Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID: 1013638|
SecurityTracker URL: http://securitytracker.com/id/1013638
(Links to External Site)
Date: Apr 4 2005
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information|
Exploit Included: Yes |
A vulnerability was reported in the SonicWALL SOHO/10 firewall. A remote user can conduct cross-site scripting attacks.|
The web interface does not properly validate user-supplied data contained in HTTP GET requests. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the firewall device and will run in the security context of the web interface. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the device, access data recently submitted by the target user via web form to the device, or take actions on the device acting as the target user.
A demonstration exploit URL is provided:
http://[target]/<script>alert("Its not magic... its a sonic")</script>
A remote user can also supply a specially crafted username at the login page, causing the login name to be entered into the log file. Then, when an administrator attempts to view the log file, the script will be executed by the administrator's browser.
Oliver Karow reported this vulnerability.
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the the SonicWALL device, access data recently submitted by the target user via web form to the device, or take actions on the device acting as the target user.|
No solution was available at the time of this entry.|
Vendor URL: www.sonicwall.com/ (Links to External Site)
Input validation error|
Source Message Contents
Subject: SonicWALL SOHO/10 - XSS vulnerability|
SonicWALL SOHO/10 - XSS and Code Injection vulnerability
SonicWall SOHO/10 is the 2nd generation Internet Security Appliance from
Sonicwall, with firewall-, vpn-, contentfiltering- and other capabilities.
There is a Cross Site Scripting Vulnerability in the webroot.
A HTTP-GET-request, containing script code will be executed
in the webbrowsers environment of the user:
http://192.168.168.168/<script>alert("Its not magic... its a
There is a second vulnerability, which i consider as something between a XSS
and a code-injection vuln,
because the user does not have to follow an html-link to run into the
If an attacker supplies a username, containing scriptcode, at the login-page
of the device, an entry in the
system logfile is done, containing the "username".
The system logfile is displayed in html-format. If the appliance admin is
viewing the logfile, the scriptcode
will be executed.
Because length of input field is limited by the browser (client site), you
can insert a short script
into the username field to do a quick verification of the existence of the
To supply longer scripts, you have to modify the request f.e. with a proxy,
or simply sent a modified
post request via netcat:
POST http://192.168.168.168:80/auth.cgi HTTP/1.0
uName=</TD><script>alert("Its not magic... its a
I only tested the following version:
Other versions may also be affected.
Handyrechnung zu hoch? Tipp: SMS und MMS mit GMX
Seien Sie so frei: Alle Infos unter http://www.gmx.net/de/go/freesms
Go to the Top of This SecurityTracker Archive Page