SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Firewall)  >   Dell SonicWALL Vendors:   SonicWALL
SonicWALL SOHO/10 Firewall Input Validation Holes Let Remote Users Conduct Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1013638
SecurityTracker URL:  http://securitytracker.com/id/1013638
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 4 2005
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Exploit Included:  Yes  
Version(s): SOHO/10
Description:   A vulnerability was reported in the SonicWALL SOHO/10 firewall. A remote user can conduct cross-site scripting attacks.

The web interface does not properly validate user-supplied data contained in HTTP GET requests. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the firewall device and will run in the security context of the web interface. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the device, access data recently submitted by the target user via web form to the device, or take actions on the device acting as the target user.

A demonstration exploit URL is provided:

http://[target]/<script>alert("Its not magic... its a sonic")</script>

A remote user can also supply a specially crafted username at the login page, causing the login name to be entered into the log file. Then, when an administrator attempts to view the log file, the script will be executed by the administrator's browser.

Oliver Karow reported this vulnerability.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the the SonicWALL device, access data recently submitted by the target user via web form to the device, or take actions on the device acting as the target user.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.sonicwall.com/ (Links to External Site)
Cause:   Input validation error

Message History:   None.


 Source Message Contents

Subject:  SonicWALL SOHO/10 - XSS vulnerability


SonicWALL SOHO/10 - XSS and Code Injection vulnerability
========================================================

Product:
========

SonicWall SOHO/10 is the 2nd generation Internet Security Appliance from
Sonicwall, with firewall-, vpn-, contentfiltering- and other capabilities. 


Vulnerability:
==============

There is a Cross Site Scripting Vulnerability in the webroot. 
A HTTP-GET-request, containing script code will be executed
in the webbrowsers environment of the user:


	http://192.168.168.168/<script>alert("Its not magic... its a
sonic")</script>


There is a second vulnerability, which i consider as something between a XSS
and a code-injection vuln,
because the user does not have to follow an html-link to run into the
attack:

If an attacker supplies a username, containing scriptcode, at the login-page
of the device, an entry in the 
system logfile is done, containing the "username".

The system logfile is displayed in html-format. If the appliance admin is
viewing the logfile, the scriptcode
will be executed.

	Because length of input field is limited by the browser (client site), you
can insert a short script
	into the username field to do a quick verification of the existence of the
vuln:

		</TD><script>alert("!")</script>

	To supply longer scripts, you have to modify the request f.e. with a proxy,
or simply sent a modified 
	post request via netcat:

		
		POST http://192.168.168.168:80/auth.cgi HTTP/1.0
		Accept: */*
		Referer: http://192.168.168.168/auth.html
		Accept-Language: de
		Content-Type: application/x-www-form-urlencoded
		Proxy-Connection: Keep-Alive
		User-Agent: BadGuy
		Host: 192.168.168.168
		Content-Length: 160
		Pragma: no-cache

		uName=</TD><script>alert("Its not magic... its a
sonic")</script>&pass=NiceTry&Submit=Login&clientHash=bbe63bb858b02e741d2d12023ee350a1



Version:
========

I only tested the following version:

SonicWall SOHO/10
Firmware: 5.1.7.0
ROM-Version: 4.0.0

Other versions may also be affected.

Vendor:
=======

Website: http://www.sonicwall.com
Status: informed

Discovered by:
==============

Oliver Karow
Date: 29.03.2005
Website: http://www.oliverkarow.de/research/sonicwall.txt

-- 
Handyrechnung zu hoch? Tipp: SMS und MMS mit GMX
Seien Sie so frei: Alle Infos unter http://www.gmx.net/de/go/freesms

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC