Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.
____________________________________________________________________________
Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.
____________________________________________________________________________
An advisory by EnableSecurity.
Trustwave published a joint advisory named TWSL2009-001
ID: ES-20090500
Advisory URL:
http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt
Affected Versions: versions prior to 2.4.4 and 2.2.22
Fixed versions: 2.4.4, 2.2.22 and later
Description:
Armorlogic Profense is a Web Application Firewall and load balancing solution.
>From their website (armorlogic.com):
"Protecting and securing websites and web applications can be a complicated
business. Profense web application firewall simplifies protection with an
affordable and easy to use, feature rich, solution that gives you full PCI DSS
1.1 and 1.2 section 6.6 compliance."
Credits:
These vulnerabilities were discovered during WAF testing by Sandro Gauci of
EnableSecurity and Wendel Guglielmetti Henrique of Trustwave's SpiderLabs.
We worked with the Armorlogic security team to have these security flaws
reported and fixed.
We would like to publicly thank the Armorlogic team for their prompt response!
__________________________________________________________________
Technical details:
The following vulnerabilities were identified:
Major issues:
- Whitelist / positive model bypass
- Blacklist / negative model bypass
Other issues:
- static root password exposes administrative interface
----------- Major issues -----------
::::: Whitelist / positive model bypass :::::
CVE: CVE-2009-1594
Description:
Profense Web Application Firewall configured in positive model can be evaded.
Technical details:
Profense Web Application Firewall configured to make use of the strong positive
model (white-list approach) can be evaded to launch various attacks including
XSS (Cross-Site Scripting), SQL Injection, remote command execution, and
others.
The vulnerability can be reproduced by making use of a URL-encoded new line
character. The pattern matching in multi line mode matches any non-hostile line
and marks the whole request as legitimate, thus allowing the request. This
results in a bypass in the positive model. An example is showed below:
http://testcases/phptest/xss.php?var=%3CEvil%20script%20goes%20here%3E=%0AByPass
::::: Blacklist / negative model bypass :::::
CVE: CVE-2009-1593
Description: Profense Web Application Firewall with default configuration in
negative model can be evaded to inject XSS.
Technical Description:
Versions 2.4 and 2.2 of Profense Web Application Firewall with the default
configuration in negative model (blacklist approach) can be evaded to inject
XSS (Cross-Site Scripting). The problem is due to the built-in core rules that
can be abused using the flexibility provided by HTML and JavaScript.
The vulnerability can be reproduced by injecting a common XSS attack in a
vulnerable application protected by Profense Web Application Firewall.
Inserting extra characters in the JavaScript close tag will bypass the XSS
protection mechanisms. An example is shown below:
http://testcases/phptest/xss.php?var=%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E
::::: Static root password exposes administrative interface :::::
Description: Profense Web Application Firewall with default configuration has a
default password hash.
Technical Description:
Versions 2.4 and 2.2 of Profense Web Application Firewall with the default
configuration the root password hash is the same default in all available
products. The SSH server is enabled by default on the administrative interface
and accepts root authentication using user and password credential. The hashing
algorithm used is OpenBSD's blowfish password hash which is known to be strong.
However the existence of a static password means that if this password is
leaked in some way or another, then the attacker potentially has access to all
exposed administrative interfaces.
__________________________________________________________________
Exploit code:
Available to organizations by contacting info@xxxxxxxxxxxxxxxxxx
Timeline:
Oct 10, 2008: Initial contact.
Oct 10, 2008: Confirmation of the vulnerabilities.
Oct 11, 2008: Discussion of possible fixes.
Oct 13, 2008: Fix from Armorlogic complete.
Oct 14, 2008: Fix issued to customers.
May 13, 2009: Advisory public release.
Solution:
Upgrade to the latest version of Profense:
http://www.armorlogic.com/
__________________________________________________________________
About EnableSecurity:
EnableSecurity is dedicated to providing high quality Information Security
Consultancy, Research and Development. EnableSecurity develops security tools
such as VOIPPACK (for Immunity CANVAS) and SIPVicious. EnableSecurity is
focused on analysis of security challenges and providing solutions to such
threats. EnableSecurity works on developing custom targeted security solutions,
as well as working with existing off the shelf security tools to provide the
best results for their customers. More info at enablesecurity.com
Disclaimer: The information in the advisory is believed to be accurate at the
time of publishing based on currently available information. Use of the
information constitutes acceptance for use in an AS IS condition. There are no
warranties with regard to this information. Neither the author nor the
publisher accepts any liability for any direct, indirect, or consequential loss
or damage arising from use of, or reliance on, this information.