F5 FirePass SSL VPN Open URL Redirection

`1. OVERVIEW  
  
F5 FirePass SSL VPN is vulnerable to Open URL Redirection.  
  
  
2. BACKGROUND  
  
F5 FirePass SSL VPN provides secure remote access to enterprise  
applications and data for users over any device or network while  
protecting your corporate. (See  
http://www.f5.com/pdf/products/firepass-overview.pdf)  
  
  
3. VULNERABILITY DESCRIPTION  
  
F5 FirePass SSL VPN contains a flaw that allows a remote cross site  
redirection attack. This flaw exists because the application does not  
validate the "refreshURL" parameter upon submission to the  
"my.activation.cns.php3" script. This could allow a user to create a  
specially crafted URL, that if clicked, would redirect a victim from  
the intended legitimate web site to an arbitrary web site of the  
attacker's choosing.  
  
  
4. VERSIONS AFFECTED  
  
4xxx Series  
  
  
5. PROOF-OF-CONCEPT/EXPLOIT  
  
https://[VPN_HOST]/my.activation.cns.php3?langchar=&ui_translation=&refreshURL=http://yehg.net/  
  
  
6. SOLUTION  
  
We have not been informed of the fix.  
We believe this issue should be fixed by the time of releasing our advisory.  
  
  
7. VENDOR  
  
F5 Networks, Inc.  
  
  
8. CREDIT  
  
This vulnerability was discovered by Aung Khant, http://yehg.net, YGN  
Ethical Hacker Group, Myanmar.  
  
  
9. DISCLOSURE TIME-LINE  
  
2012-03-31: notified vendor  
2012-04-04: vendor acknowledged  
2012-10-20: vulnerability disclosed  
  
  
10. REFERENCES  
  
Original Advisory URL:  
http://yehg.net/lab/pr0js/advisories/%5BF5_firepass4x%5D_url_redirection  
OWASP Top 10 2010 - A 10:  
http://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards  
SANS Top 25 - Rank 23: http://cwe.mitre.org/top25/#CWE-601  
CWE-601: http://cwe.mitre.org/data/definitions/601.html  
  
#yehg [2012-10-20]  
  
  
---------------------------------  
Best regards,  
YGN Ethical Hacker Group  
Yangon, Myanmar  
http://yehg.net  
Our Lab | http://yehg.net/lab  
Our Directory | http://yehg.net/hwd  
`