Document Title: =============== Igaware UTM WAF v9.2.0-2 - Multiple Vulnerabilities References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=569 Release Date: ============= 2012-05-17 Vulnerability Laboratory ID (VL-ID): ==================================== 569 Common Vulnerability Scoring System: ==================================== 5.5 Product & Service Introduction: =============================== The Igaware UTM appliance delivers a full set of defences, which together, protect your entire network. Continuous automatic updates ensure defences are always optimised against new threats as they emerge. The Igaware UTM appliance keeps your inboxes free from spam, viruses and other malicious content. Enterprise class firewall protects against unauthorised access, inbound and outbound. Supports VPN for site to site connectivity and remote working. Web Filtering allows you to implement web access policies and to monitor staff Internet usage. Integrates with Active Directory for single sign on authentication. Network monitoring tools provide a heads up to issues with your network, helping you avoid potential downtime. (Copy of the Vendor Homepage: http://www.igaware.com/products/netprotect.php ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered multiple Web Vulnerabilities in Igaware WAF v9.2.0-2 appliance application. Vulnerability Disclosure Timeline: ================================== 2012-05-18: Public or Non-Public Disclosure Discovery Status: ================= Published Affected Product(s): ==================== Igaware Product: UTM Firewall Appliance Application 9.2.0-2 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ Multiple persistent input validation vulnerabilities are detected in Igaware WAF v9.2.0-2 appliance application. The bugs allow remote attackers to implement/inject malicious script code on the application-side (persistent). Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context manipulation. Exploitation requires low user inter action or low privileged appliance user account. Vulnerable Module(s): [+] administration > servers > email > internal accounts > add an account > (account name) [+] administration > servers > email > local mailbox > add a new user > (email name - surname - comment- first name) [+] servers > email > aliasse > (alias name - alias description) [+] administration > servers > ftp server > check on allow ftp server > (folder name) [+] administration > servers > printers > add a printer > (printer name - Alias) [+] administration > users > add a new user > (email name - surname - comment- first name) [+] administration > groups-> add a new group > (group name - description) [+] administration > access control > outbound firewall > individual computers >add a new lan machine > (machine name - machine description) [+] administration > access control > lan access policy > add a new policy > (name - description) [+] administration > access control > service port list > add a new service port list > (Name- description) [+] system > tools > host/network monitoring > devices > add a device > (server host) Proof of Concept (PoC): ======================= The persistent input validation vulnerabilities can be exploited by remote attacker with low required user inter action or low privileged user account. For demonstration or reproduce ... Review: Aliases Name - Listing sales

aliasname

>``<[PERSISTENT SCRIPT CODE EXECUTION!]<' <=```` td=````><TD class=``text``></TD> </TR> </TBODY> </TABLE><!-- URL: https://igaware.127.0.0.1:8080/config/SERVERS/EMAIL/aliases.php?menureferer=Aliases&helpfile=SERVERS/EMAIL/aliases Review: FTP Server - Fileserver Share access Foldername >``<[PERSISTENT SCRIPT CODE EXECUTION!]<' <=```` td=````> <TD class=``text``> >``<[PERSISTENT SCRIPT CODE EXECUTION!]< </TD> <TD class=``text``> URL: https://igaware.127.0.0.1:8080/config/SERVERS/ftp.php?menureferer=FTP+Server Review: User Configuration - Name & Surname (Exception Handling!) <[PERSISTENT SCRIPT CODE EXECUTION!]' <``=````> <img src=``/config/images/help-small.png`` alt=``Help`` border=``0`` onClick=``return overlib('<li class=\'helptext\'><STRONG>First Name</STRONG><BR>The users\'s given name.</LI>', CAPTION,'Help', FGCLASS,'popupfg', BGCLASS,'popupbg', CLOSEFONTCLASS, 'popupclose', CGCLASS, 'popupcg', BORDER, 2, WIDTH, 300, STICKY, CLOSECLICK); `` onMouseOut=``return nd(); `` style=``cursor:pointer;``></TD> </TR> <TR> URL: https://igaware.127.0.0.1:8080/config/USERS/users.php Review: Internet Email Account Configuration & Listing