Astaro Command Center 2.x Cross Site Scripting

`Title:  
======  
Astaro Command Center v2.x - Multiple Web Vulnerabilities  
  
  
Date:  
=====  
2012-04-03  
  
  
References:  
===========  
http://www.vulnerability-lab.com/get_content.php?id=4  
  
  
VL-ID:  
=====  
4  
  
  
Introduction:  
=============  
We are pleased to announce the General Availability of the Astaro Command Center Version 2.0. This new version introduces the major new ability   
to configure and manage IPSEC tunnels entirely within ACC itself. By providing a centralized location from which to work with and deploy VPN   
tunnels between Astaro installations, administrators can save management time and automate many of the tasks involved in successfully linking   
sites together with encrypted links. The Astaro Command Center is an entirely free product that allows you to centrally monitor and maintain   
multiple Astaro installations & devices. If you currently are responsible for more than one Astaro Gateway product, ACC is designed for you!   
Read on for more information. Starting with this release, it is now possible to setup site-to-site VPN tunnels with an amazing degree of ease   
from within Astaro Command Center itself. Simply indicate the devices to be joined together via VPN, select a few options, and the rest is   
automated with no need to login to each individual WebAdmin for the configuration. ACC is presented in the same administrative style as our AxG   
Version 7 WebAdmin, so that if you are new to ACC you will have no trouble getting started within a familiar looking environment.  
  
(Copy from vendors homepage: http://up2date.astaro.com/2009/03/astaro_comand_center_20_releas.html#more)  
  
  
Abstract:  
=========  
Vulnerability-Lab Team discovers multiple Input Validation Vulnerabilities on Astaros Command Center Application v2.x  
  
  
Report-Timeline:  
================  
2011-01-12: Verified by Vulnerability-Lab  
2011-06-15: Secure Vendor Notification  
2011-06-17: Vendor Reply/Feedback  
2012-03-22: Vendor Fix/Patch Disclosure by Check  
2012-04-03: Discovery by Vulnerability-Lab  
  
  
Status:  
========  
Published  
  
  
Affected Products:  
==================  
  
Exploitation-Technique:  
=======================  
Remote  
  
  
Severity:  
=========  
High  
  
  
Details:  
========  
Multiple persistent input validation vulnerabilities are detected in Astaro Command Center v2.x.  
The bugs allows an local privileged attackers to implement/inject malicious script code on the application side (persistent).  
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent)   
context manipulation. Exploitation requires user inter action & minimum restricted access to the panel.  
  
Vulnerable Module(s):  
[+] Configuration - Networks Definition  
[+] Deploy Function  
[+] Summary  
[+] VPN Information/ Configuration VPN Details  
[+] Management - Organizational Units  
  
  
Proof of Concept:  
=================  
This vulnerabilities can be exploited local(persistent) by low privileged user accounts or   
by user inter-action (remote) via request force ...  
  
  
Code Review: Networks Definition  
  
<tr><td style="width: 72px; vertical-align: top;" valign="top"><img class="TABLEOBJITEM_BUTTON_edit" src="core/img/blank1x1.gif"><span>  
</span><img class="TABLEOBJITEM_BUTTON_clone" src="core/img/blank1x1.gif"><img style="width: 72px; height: 1px;" src="core/img/blank1x1.gif">  
<img style="padding: 2px; cursor: pointer;" src="wfe/acc/img/buttons/button_custom_delete.png"><img style="padding: 2px; cursor: pointer;   
display: none;" src="wfe/acc/img/buttons/button_custom_info.png"></td><td style="vertical-align: top; padding: 2px;" valign="top"><table style=  
"width: 100%;" border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-top: 2px;" id="global_object_td_REF_ACC_GBL_  
16fe7d084bbe4b05b7f25b74e5d18aa98aa9"><table border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-right: 4px; width: 16px;">  
<input id="global_objects_cb_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9" class="registration_checkbox_style" type="checkbox"></td><td style="  
padding-right: 4px; width: 16px;"><img src="wfe/acc/img/icons/host.png"></td><td style="font-weight: bold; padding-right: 4px; width: 300px;">  
<span>>"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!></iframe></span></td><td style="padding-right: 4px; width: 185px;">  
<span>10.129.11.11</span></td><td style="padding-right: 4px;"><img class="img_button" src="wfe/acc/img/buttons/button_deploy_70.png" id="button_deploy  
_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9"></td></tr></tbody></table></td></tr><tr><td><table border="0" cellpadding="0" cellspacing="0">  
<tbody><tr><td style="padding-right: 4px; width: 16px;"><span></span></td><td style="padding-right: 4px; padding-top: 4px; width: 320px;"><span>  
</span></td><td style="padding-right: 4px; padding-top: 4px; width: 185px;"><span><img src="wfe/acc/img/icons/ldap-container.gif" style="float: left;   
padding-right: 4px;">Astaro AG</span></td><td style="padding-right: 4px; padding-top: 4px;"><img class="img_button_transparent" src="wfe/acc/img/buttons  
/button_undeploy_70.png" id="button_undeploy_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9"></td></tr></tbody></table></td></tr><tr><td><table   
border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-right: 4px; width: 16px;"><span></span></td><td style="padding-right: 1px;   
padding-top: 4px; width: 16px;"><img style="cursor: pointer;" src="wfe/acc/img/icons/check_14.png"></td><td style="font-weight: normal; padding-right:   
4px; padding-top: 4px; width: 40px;"><span>0</span></td><td style="padding-right: 1px; padding-top: 4px; width: 16px;"><img style="cursor: pointer;"   
src="wfe/acc/img/icons/cancel_14.png"></td><td style="font-weight: normal; padding-right: 4px; padding-top: 4px; width: 40px;"><span>0</span></td><td   
style="padding-right: 1px; padding-top: 4px; width: 16px;"><img style="cursor: pointer;" src="wfe/acc/img/icons/service-fail_14.png"></td><td style="  
font-weight: normal; padding-right: 4px; padding-top: 4px; width: 40px;"><span>0</span></td><td style="padding-right: 1px; padding-top: 4px; width:   
16px;"><img style="cursor: pointer;" src="wfe/acc/img/icons/icon_deploy_14.png"></td><td style="font-weight: normal; padding-right: 4px; padding-top:   
4px; width: 120px;"><span>0</span></td></tr></tbody></table></td></tr></tbody></table></td><td style="width: 40px; vertical-align: top;" valign="top">  
<img class="TABLEOBJITEM_BUTTON_usageinformation" src="core/img/blank1x1.gif"></td></tr>  
  
  
  
Code Review: Deploy Functions  
  
<tr><td><img src="core/img/icons/trash.png" style="margin-right: 6px; margin-left: 2px; cursor: pointer;" id="__DND__DROPPED_REF_ACC_GBL_  
16fe7d084bbe4b05b7f25b74e5d18aa98aa9_trash_icon"></td><td><div style="vertical-align: middle; overflow: hidden; cursor: pointer; white-space:   
nowrap;"><img src="wfe/acc/img/icons/host.png" style="display: inline; vertical-align: middle; padding: 2px;"><div style="display: inline;   
vertical-align: middle; white-space: nowrap; padding: 2px 2px 2px 0px;">>"<<INCLUDE PERSISTENT SCRIPTCODE HERE!!!>></div>  
<div style="position: relative; overflow: hidden; height: 0px; width: 0px; margin-left: 20px;"></div></div></td></tr>  
  
  
  
Code Review: Summery Repaste  
  
<form id="__FORM" style="width: 100%;"><div style="font-size: 14px; font-weight: bold;">Summary</div><br><div>This is a summary of the resulting   
VPN configuration. Please review it carefully and go back to the previous pages to perform any changes if needed. When finished, please press the   
<i>Next</i> button to start deploying the configuration to the respective devices.</div><br><div><b>General information</b></div><hr><div style=  
"font-style: normal; float: left; line-height: 20px;">Name: </div><div style="line-height: 20px; text-align:   
right;">>"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!"></iframe></div><div style="font-style: normal; clear:   
left; float: left; line-height: 20px;">Type: </div><div style="line-height: 20px; text-align: right;">Site-2-Site</div><div style="font-style:   
normal; clear: left; float: left; line-height: 20px;">Policy: </div><div style="line-height: 20px; text-align: right;">TripleDES PFS (ACC)</div>  
<div style="font-style: normal; clear: left; float: left; line-height: 20px;">Authentication: </div><div style="line-height: 20px; text-align:   
right;">RSA key</div><div style="width: 100%; clear: both; vertical-align: middle; line-height: 19px;"><label style="width: 170px; padding: 2px   
0px 0px; float: left; vertical-align: middle; font-style: normal;">Comment: </label><span style="border: 0px solid black; padding: 2px 0px;   
margin: 0px; float: right; vertical-align: middle;">>"<<INCLUDE PERSISTENT SCRIPTCODE HERE!!!>></span></div>  
<div style="width: 100%; height: 21px; clear: both; vertical-align: middle; line-height: 21px;"><span style="border: 0px solid black; padding:   
2px 0px; margin: 0px; float: right; vertical-align: middle;"><img id="ELEMENT_input_checkbox_auto_pf" style="padding-top: 2px;"   
src="core/img/icons/cancel.png" height="16px" width="16px"></span><label style="width: 250px; padding: 0px; vertical-align: middle; font-style:   
normal;">Auto packet filter:</label></div><div style="width: 100%; height: 21px; clear: both; vertical-align: middle; line-height: 21px;">  
<span style="border: 0px solid black; padding: 2px 0px; margin: 0px; float: right; vertical-align: middle;"><img id="  
ELEMENT_input_checkbox_strict_routing" style="padding-top: 2px;" src="core/img/icons/cancel.png" height="16px" width="16px"></span><label   
style="width: 250px; padding: 0px; vertical-align: middle; font-style: normal;">Strict routing:</label></div><br><div style="font-weight: bold;   
clear: left; float: left; line-height: 20px;"><b>asg220 (ASG 220A, Release 7.501)</b></div><div style="line-height: 20px; font-weight: bold;   
text-align: right;">(1 of 2)</div><hr><div style="font-style: normal; clear: left; float: left; line-height: 20px;">Local Networks: </div>  
<div style="line-height: 20px; text-align: right;">22 2 [192.168.22.128/25], Internal [10.1.22.0/24]</div><div style="font-style: normal; clear:   
left; float: left; line-height: 20px;">Tunnel Interface: </div><div style="line-height: 20px; text-align: right;">22 1 [192.168.22.1]</div>  
<div style="font-style: normal; clear: left; float: left; line-height: 20px;">Connection Mode: </div><div style="line-height: 20px; text-align:   
right;">Initiate Connection</div><br><div style="font-weight: bold; clear: left; float: left; line-height: 20px;"><b>asg525 (ASG 525A, Release   
7.501)</b></div><div style="line-height: 20px; font-weight: bold; text-align: right;">(2 of 2)</div><hr><div style="font-style: normal; clear:   
left; float: left; line-height: 20px;">Local Networks: </div><div style="line-height: 20px; text-align: right;">52 2 [192.168.52.128/25]</div>  
<div style="font-style: normal; clear: left; float: left; line-height: 20px;">Tunnel Interface: </div><div style="line-height: 20px; text-align:   
right;">52 1 [192.168.52.1]</div><div style="font-style: normal; clear: left; float: left; line-height: 20px;">Connection Mode: </div><div   
style="line-height: 20px; text-align: right;">Initiate Connection</div></form>  
  
  
  
Code Review: Configuration VPN Details  
  
<tbody><tr id="tr_head_0"><td class="details_outer_left1"><table class="leveltable"><tbody><tr><td class="levelleft"> <img src="wfe/acc/  
img/icons/arrow_down_trans.gif" id="tr_head_arrow_0" class="details_arrow"> <img src="wfe/acc/img/icons/ipsec-tunnel.png" class="  
details_arrow"> VPN Information</td><td class="levelright"></td></tr></tbody></table></td></tr><tr id="tr_data_0"><td class="details_outer_right1  
"><table id="acc_table_undefined_items" class="details_inner_table" cellspacing="0"><tbody><tr id="tr_caption"><td style="vertical-align: middle;"   
class="details_inner_left1_high">VPN Name</td><td class="details_inner_right1"><div>>\"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!"></></div></td></tr>  
<tr id="tr_caption"><td style="vertical-align: middle;" class="details_inner_left2_high">Comment</td><td class="  
details_inner_right2"><div>>\"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!"></iframe></div></td></tr><tr id="tr_caption"><td   
style="vertical-align: middle;" class="details_inner_left1_high">Type</td><td class="details_inner_right1"><div><table><tbody><tr><td><img src="core/  
img/icons/tunnel_32x16.gif"></td><td class="widget_font_size">site2site</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td style="vertical  
-align: middle;" class="details_inner_left2_high">Policy</td><td class="details_inner_right2"><div><table><tbody><tr><td><img src="wfe/acc/img/icons/  
ipsec-policy.png"></td><td class="widget_font_size">TripleDES PFS (ACC)</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td style="vertical  
-align: middle;" class="details_inner_left1_high">Auth</td><td class="details_inner_right1"><div><table><tbody><tr><td><img src="wfe/acc/img/icons/ipsec  
-rsa-key.gif"></td><td class="widget_font_size">RSA</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td style="vertical-align: middle;"   
class="details_inner_left2_high">Active</td><td class="details_inner_right2"><div><table class="traffic_table" cellpadding="0"><tbody><tr><td><img src="  
core/img/traffic_small_green.gif" id="todo_table_name_todo_id_img1"></td><td><img src="core/img/traffic_small_off.gif" id="todo_table_name_todo_id_img2">  
</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td style="vertical-align: middle;" class="details_inner_left1_high">Strict Routing</td>  
<td class="details_inner_right1"><div><img src="core/img/icons/cancel_small.png" class="details_arrow"></div></td></tr><tr id="tr_caption"><td style="  
vertical-align: middle;" class="details_inner_left2_high">Auto Packetfilter</td> ....  
  
  
  
Reference(s):  
../PoC/Gateway Manager - User - Device2.html  
../PoC/Gateway Manager - User - Device1.html  
  
  
Solution:  
=========  
Restrict the input fields by a specific char filter as mask like [a-z][A-Z][0-9] ...  
Implement a own secure exception-handling to prevent against persistent script-code injects.  
  
To patch the issues upgrade to astaro command center (now sophos 2012) version 3 and disallow the posts of low privileged user accounts.  
  
  
Risk:  
=====  
The security risk of the persistent vulnerabilities are estimated as medium(+) because they are all located in main areas of the application.  
  
  
Credits:  
========  
Vulnerability Research Laboratory Team - Benjamin Kunz Mejri (Rem0ve)  
  
  
Disclaimer:  
===========  
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,   
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business   
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some   
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation   
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-  
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of   
other media, are reserved by Vulnerability-Lab or its suppliers.  
  
Copyright © 2012|Vulnerability-Lab  
  
  
  
  
--   
VULNERABILITY RESEARCH LABORATORY TEAM  
Website: www.vulnerability-lab.com  
Mail: [email protected]  
  
`