SecurityvulnsSECURITYVULNS:DOC:21855Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.
Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.
An advisory by EnableSecurity.
Trustwave published a joint advisory named TWSL2009-001
ID: ES-20090500
Advisory URL:
http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt
Affected Versions: versions prior to 2.4.4 and 2.2.22
Fixed versions: 2.4.4, 2.2.22 and later
Description:
Armorlogic Profense is a Web Application Firewall and load balancing solution.
From their website (armorlogic.com):
"Protecting and securing websites and web applications can be a complicated business. Profense
web application firewall simplifies protection with an affordable and easy to use, feature rich,
solution that gives you full PCI DSS 1.1 and 1.2 section 6.6 compliance."
Credits:
These vulnerabilities were discovered during WAF testing by Sandro Gauci of EnableSecurity and
Wendel Guglielmetti Henrique of Trustwave's SpiderLabs.
We worked with the Armorlogic security team to have these security flaws reported and fixed.
We would like to publicly thank the Armorlogic team for their prompt response!
Technical details:
The following vulnerabilities were identified:
Major issues:
- Whitelist / positive model bypass
- Blacklist / negative model bypass
Other issues:
- static root password exposes administrative interface
----------- Major issues -----------
::::: Whitelist / positive model bypass :::::
CVE: CVE-2009-1594
Description:
Profense Web Application Firewall configured in positive model can be evaded.
Technical details:
Profense Web Application Firewall configured to make use of the strong positive model
(white-list approach) can be evaded to launch various attacks including XSS (Cross-Site
Scripting), SQL Injection, remote command execution, and others.
The vulnerability can be reproduced by making use of a URL-encoded new line character. The
pattern matching in multi line mode matches any non-hostile line and marks the whole request as
legitimate, thus allowing the request. This results in a bypass in the positive model. An example
is showed below:
::::: Blacklist / negative model bypass :::::
CVE: CVE-2009-1593
Description: Profense Web Application Firewall with default configuration in negative model can
be evaded to inject XSS.
Technical Description:
Versions 2.4 and 2.2 of Profense Web Application Firewall with the default configuration in
negative model (blacklist approach) can be evaded to inject XSS (Cross-Site Scripting). The
problem is due to the built-in core rules that can be abused using the flexibility provided by
HTML and JavaScript.
The vulnerability can be reproduced by injecting a common XSS attack in a vulnerable application
protected by Profense Web Application Firewall. Inserting extra characters in the JavaScript
close tag will bypass the XSS protection mechanisms. An example is shown below:
::::: Static root password exposes administrative interface :::::
Description: Profense Web Application Firewall with default configuration has a default password
hash.
Technical Description:
Versions 2.4 and 2.2 of Profense Web Application Firewall with the default configuration the
root password hash is the same default in all available products. The SSH server is enabled by
default on the administrative interface and accepts root authentication using user and password
credential. The hashing algorithm used is OpenBSD's blowfish password hash which is known to be
strong. However the existence of a static password means that if this password is leaked in some
way or another, then the attacker potentially has access to all exposed administrative
interfaces.
Exploit code:
Available to organizations by contacting [email protected]
Timeline:
Oct 10, 2008: Initial contact.
Oct 10, 2008: Confirmation of the vulnerabilities.
Oct 11, 2008: Discussion of possible fixes.
Oct 13, 2008: Fix from Armorlogic complete.
Oct 14, 2008: Fix issued to customers.
May 13, 2009: Advisory public release.
Solution:
Upgrade to the latest version of Profense:
http://www.armorlogic.com/
About EnableSecurity:
EnableSecurity is dedicated to providing high quality Information Security Consultancy, Research
and Development. EnableSecurity develops security tools such as VOIPPACK (for Immunity CANVAS)
and SIPVicious. EnableSecurity is focused on analysis of security challenges and providing
solutions to such threats. EnableSecurity works on developing custom targeted security solutions,
as well as working with existing off the shelf security tools to provide the best results for
their customers. More info at enablesecurity.com
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing
based on currently available information. Use of the information constitutes acceptance for use
in an AS IS condition. There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect, or consequential loss or
damage arising from use of, or reliance on, this information.
Related
