Fortigate UTM WAF Appliance Cross Site Scripting

`Title:  
======  
Fortigate UTM WAF Appliance - Cross Site Vulnerabilities  
  
  
Date:  
=====  
2012-09-07  
  
  
References:  
===========  
http://www.vulnerability-lab.com/get_content.php?id=559  
  
  
VL-ID:  
=====  
559  
  
  
Common Vulnerability Scoring System:  
====================================  
3.5  
  
  
Introduction:  
=============  
The FortiGate series of multi-threat security systems detect and eliminate the most damaging, content-based threats from email   
and Web traffic such as viruses, worms, intrusions, inappropriate Web content and more in real time - without degrading   
network performance.  
  
Ranging from the FortiGate-30 series for small offices to the FortiGate-5000 series for large enterprises, service providers and   
carriers, the FortiGate line combines the FortiOS™ security operating system with FortiASIC processors and other hardware to provide   
a comprehensive and high-performance array of security and networking functions including:  
  
* Firewall, VPN, and Traffic Shaping  
* Intrusion Prevention System (IPS)  
* Antivirus/Antispyware/Antimalware  
* Web Filtering  
* Antispam  
* Application Control (e.g., IM and P2P)  
* VoIP Support (H.323. and SCCP)  
* Layer 2/3 routing  
* Multiple WAN interface options  
  
FortiGate appliances provide cost-effective, comprehensive protection against network, content, and application-level threats - including   
complex attacks favored by cybercriminals - without degrading network availability and uptime. FortiGate platforms incorporate sophisticated   
networking features, such as high availability (active/active, active/passive) for maximum network uptime, and virtual domain (VDOM)   
capabilities to separate various networks requiring different security policies.  
  
Fortigate applainces are Pentagon & US Military certified.   
The military provides high security standards & save outdoor camps, air base, offices with fortigate hardware.  
  
(Copy from the Vendor Homepage: http://www.fortinet.com/products/fortigate )  
  
  
Abstract:  
=========  
Vulnerability-Lab Research Team discovered multiple non-persistent Web Vulnerabilities in the FortiGates UTM Appliance Application.  
  
  
Report-Timeline:  
================  
2012-05-07: Researcher Notification & Coordination  
2012-05-10: Vendor Notification  
2012-06-08: Vendor Response/Feedback  
2012-08-30: Vendor Fix/Patch ( FortiOS v4.3.8 B0630 & FortiOS v5.0 B064 )  
2012-09-07: Public or Non-Public Disclosure  
  
  
Status:  
========  
Published  
  
  
Affected Products:  
==================  
Fortigate  
Product: UTM Firewall Appliance Application vFortiGate-5000 Series;FortiGate-3950 Series;FortiGate-3810A;  
  
  
Exploitation-Technique:  
=======================  
Remote  
  
  
Severity:  
=========  
Medium  
  
  
Details:  
========  
Multiple input validation vulnerabilities (non-persistent) are detected in the FortiGates UTM Appliance Application.   
The vulnerability allows remote attackers to hijack admin/customer sessions with required user inter action (client-side).   
Successful exploitation allows to phish user accounts, hijacking sessions, redirect over client side requests or manipulate   
website context on client-side browser requests.  
  
  
Vulnerable Module(s): (Non-Persistent)  
[+] Exception Handling - objusagedlg  
[+] WiFi-controller SSID - Topic  
[+] Display Message - Title & Message  
  
Picture(s):  
../1.png  
../2.png  
  
  
Interface - UTM WAF Web Application [Appliance]  
FortiGate-5000 Series;FortiGate-3950 Series;FortiGate-3810A;FortiGate-3600A;FortiGate-3016B;FortiGate-1240B  
FortiGate-800;FortiGate-620B;FortiGate-311B;FortiGate-310B;FortiGate-300A;FortiGate-224B;FortiGate-200B Series  
  
  
Proof of Concept:  
=================  
The non-persistent vulnerability can be exploited by remote attackers with medium or high required user inter action.   
For demonstration or reproduce ...  
  
  
Code Review: Exception Handling - objusagedlg  
URL: http://appliance.127.0.0.1:137/objusagedlg?type=220&mkey=  
  
<div style="text-align: center;"><h2>WiFi-controller SSID "<span class="emphasized_msg">"><[EXECUTES NON-PERSISTENT SCRIPTCODE HERE!] <  
</span>" is used by:</h2><div>Total References: <span id="total_refcount"></span></div><div class="info_msg"><span id="total_unused">  
</span> object types that may be configured to use this object have no references (<span id="unused_toggle"></span>)</div>  
<form name="search_params"><input name="type" value="220" type="hidden"><input name="mkey" value="" type="hidden">  
<iframe src="objusagedlg-Dateien/hack.htm" [EXECUTES NON-PERSISTENT SCRIPTCODE HERE!]>' <"=""><input  
type="hidden" name="mkey_display" value="" /></form><div   
id="reftable-container"></div>&  
  
  
Code Review: Display Message - Title & Message  
URL: https://appliance.127.0.0.1:137/displaymessage?url=/webfilter/profile/dlg&title=  
  
<td>">[EXECUTES NON-PERSISTENT SCRIPTCODE HERE!]' <<="" td="">  
</tr>  
</table></td>  
</tr>  
<tr>  
<td class="body" height=100><table class="body"><tr><td align="center">  
Notice: This is a hack by BKM<br>  
</td></tr></table></td>  
</tr>  
<tr><td>  
<table class="footer" cellpadding="0" cellspacing="0">  
<tr><td>  
<input class="button" type="button" value="OK" onclick="if (window.opener) { window.close(); } else if   
(parent && parent.wij_in_modal_op && parent.wij_in_modal_op()) { if (0 &&   
parent.callback_handlers) parent.callback_handlers.should_call = true; parent.wij_end_modal_dialog(); }   
else { document.location='/webfilter/profile/dlg'; }">  
</td></tr>  
</table>  
</td></tr>  
</table>  
</body>  
</html>  
</iframe></td>  
  
  
PoC:  
http://appliance.127.0.0.1:137/objusagedlg?type=220&mkey=<INCLUDE NON-PERSISTENT SCRIPTCODE HERE!>  
https://appliance.127.0.0.1:137/displaymessage?url=/webfilter/profile/dlg&title=<INCLUDE NON-PERSISTENT SCRIPTCODE HERE!>&msg=Notice:hacking firewall 6am  
  
  
Reference(s):  
../objusagedlg.htm  
../displaymessage.htm  
  
  
Solution:  
=========  
Restrict the mkey, context, title and msg parameter. Parse the client side input & output listings on requests to fix   
the issue stable. Filter & restrict the input request of the exception-handling. Validate the output listing to   
patch/fix the stable client side cross site scripting vulnerability.  
  
* FortiOS v4.3.8 B0630  
* FortiOS v5.0 B064  
  
  
Risk:  
=====  
The security risk of the non-persistent cross site scripting vulnerabilities are estimated as medium(-).  
  
  
Credits:  
========  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected])  
  
  
Disclaimer:  
===========  
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,   
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business   
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some   
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation   
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases   
or trade with fraud/stolen material.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register  
Contact: [email protected] - [email protected] - [email protected]  
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com  
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.   
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other   
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and   
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),   
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.  
  
Copyright © 2012 | Vulnerability Laboratory  
  
  
  
--   
VULNERABILITY RESEARCH LABORATORY  
LABORATORY RESEARCH TEAM  
CONTACT: [email protected]  
  
`