|
|
|
|
| |
Credit:
The information has been provided by Sandro Gauci and Wendel Guglielmetti.
The original article can be found at: http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt
|
| |
Vulnerable Systems:
* Armorlogic Profense versions prior to 2.4.4 and 2.2.22
Immune Systems:
* Armorlogic Profense versions 2.4.4 and 2.2.22 and later
Whitelist / positive model bypass
Profense Web Application Firewall configured to make use of the strong positive model (white-list approach) can be evaded to launch various attacks including XSS (Cross-Site Scripting), SQL Injection, remote command execution, and others.
The vulnerability can be reproduced by making use of a URL-encoded new line character. The pattern matching in multi line mode matches any non-hostile line and marks the whole request as legitimate, thus allowing the request. This results in a bypass in the positive model. An example is showed below:
http://testcases/phptest/xss.php?var=%3CEvil%20script%20goes%20here%3E=%0AByPass
Blacklist / negative model bypass
Versions 2.4 and 2.2 of Profense Web Application Firewall with the default configuration in negative model (blacklist approach) can be evaded to inject XSS (Cross-Site Scripting). The problem is due to the built-in core rules that can be abused using the flexibility provided by HTML and JavaScript.
The vulnerability can be reproduced by injecting a common XSS attack in a vulnerable application protected by Profense Web Application Firewall. Inserting extra characters in the JavaScript close tag will bypass the XSS protection mechanisms. An example is shown below: http://testcases/phptest/xss.php?var=%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E
Static root password exposes administrative interface
Versions 2.4 and 2.2 of Profense Web Application Firewall with the default configuration the root password hash is the same default in all available products. The SSH server is enabled by default on the administrative interface and accepts root authentication using user and password credential. The hashing algorithm used is OpenBSD's blowfish password hash which is known to be strong. However the existence of a static password means that if this password is leaked in some way or another, then the attacker potentially has access to all exposed administrative interfaces.
CVE Information:
CVE-2009-1594
CVE-2009-1593
Disclosure Timeline:
Oct 10, 2008: Initial contact.
Oct 10, 2008: Confirmation of the vulnerabilities.
Oct 11, 2008: Discussion of possible fixes.
Oct 13, 2008: Fix from Armorlogic complete.
Oct 14, 2008: Fix issued to customers.
May 13, 2009: Advisory public release.
|
|
|
|
|
