Dell SonicWall GMS 7.2.x Script Insertion

2014-10-23T00:00:00
ID PACKETSTORM:128817
Type packetstorm
Reporter Benjamin Kunz Mejri
Modified 2014-10-23T00:00:00

Description

                                        
                                            `Document Title:  
===============  
Dell SonicWall GMS v7.2.x - Persistent Web Vulnerability  
  
  
References (Source):  
====================  
http://www.vulnerability-lab.com/get_content.php?id=1222  
  
  
Release Date:  
=============  
2014-10-21  
  
  
Vulnerability Laboratory ID (VL-ID):  
====================================  
1222  
  
  
Common Vulnerability Scoring System:  
====================================  
3  
  
  
Product & Service Introduction:  
===============================  
Dell SonicWALL`s management and reporting solutions provide a comprehensive architecture for centrally creating and managing   
security policies, providing real-time monitoring and alerts, and delivering intuitive compliance and usage reports, all from   
a single management interface. Whether your organization is a small- or medium-sized business, a distributed enterprise or a   
managed service provider, Dell™ SonicWALL™ offers software and appliance solutions to meet its needs.  
  
The award-winning Dell SonicWALL Global Management System (GMS) provides organizations, distributed enterprises and service   
providers with a flexible, powerful and intuitive solution to centrally manage and rapidly deploy SonicWALL firewall, anti-spam,   
backup and recovery, and secure remote access solutions. Flexibly deployed as software, hardware—in the form of the Universal   
Management Appliance (UMA)—or a virtual appliance, SonicWALL GMS also provides centralized real-time monitoring and comprehensive   
policy and compliance reporting to drive down the cost of owning and managing SonicWALL security appliances. Multiple GMS   
software, hardware, and virtual appliance agents, when deployed in a cluster, can scale to manage thousands of SonicWALL   
security appliances. This makes GMS an ideal solution for small- to medium-sized businesses, enterprises and managed service   
providers that have either single-site or distributed multi-site environments.  
  
(Copy of the Vendor Homepage: http://www.sonicwall.com/emea/en/products/Centralized_Management_Reporting.html )  
  
  
Abstract Advisory Information:  
==============================  
The Vulnerability Laboratory Research Team discovered a persistent validation vulnerability in the official DELL SonicWall GMS v7.2.x appliance web-application.  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2014-10-21: Public Disclosure (Vulnerability Laboratory)  
  
  
Discovery Status:  
=================  
Published  
  
  
Affected Product(s):  
====================  
DELL  
Product: SonicWall GMS Networks Appliance Application 7.2  
  
  
Exploitation Technique:  
=======================  
Local  
  
  
Severity Level:  
===============  
Medium  
  
  
Technical Details & Description:  
================================  
A persistent mail encoding web vulnerability has been discovered in the official DELL SonicWall GMS v7.2.x appliance web-application.  
The security issue allows remote attackers with low privileged user account to inject own malicious script codes to the application-side   
of the vulnerable service module.  
  
The vulnerability is located in the `Console > Management > Settings > GMS Settings` module. Remote attackers and low privileged web-application   
user accounts are able to inject own malicious script code context as notification value. The vulnerable user context with log files or information   
notification messages (input) will be send to the internal web-server through the firewall. The data of the POST method request in the input, executes   
without a secure encoding or a restriction on the input in the web-application appliance. The persistent execution of the script code occurs in the mail   
notification that gets send by the appliances directly to users or via the interval count. In case of the second provided scenario the application generated   
a pdf report with malicious script code in the mail body message.  
  
The issue impact a risk to the full appliance web-application get compromised beause the send mail notifications is wrong encoded and the internal encode is   
broken too. Regular the stored values must be secure encoded and parsed to prevent persistent executions in the appliance mails. The attack vector is persistent   
on the application-side of the vulnerable service and the request method to inject the payload is POST.  
  
The security risk of the persistent input validation web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.0.  
Exploitation of the vulnerability requires a low privileged application user account and low user interaction. Successful exploitation of the vulnerability results   
in session hijacking, persistent phishing attacks, persistent external redirect via mail and persistent manipulation of affected or connected module context.  
  
  
Vulnerable Module(s):  
[+] Console > Management > Settings > GMS Settings  
  
Vulnerable Parameter(s):  
[+] message body > table  
  
Affected Service(s):  
[+] admin@sonicwall.com (test > livedemo-admin@sonicwall.com)  
  
  
Note: All other modules sending user values of non restricted input throught the appliance back. (logs, updates ...)  
  
  
Proof of Concept (PoC):  
=======================  
The persistent mail encoding web vulnerability can be exploited by remote attackers with low privileged application user account and low user interaction.  
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.  
  
Information of requirements:  
- The template to send notification alerts needs to be send to the  
Default html (example: http://gms.demo.sonicwall.com/sgms/auth > )  
- The Console > Management > Settings section needs to be linked to the  
appliance demo email address (example: livedemo-admin@sonicwall.com)  
- The Alert of the notification with the pdf summery report of the  
archiv needs to be redirected to the testmail like in our case  
(bkm@evolution-sec.com)  
  
  
PoC: message body > table  
  
<html>  
<head>  
<title><iframe src=a>%20<iframe> <iframe src=a>%20<iframe></title>  
<link rel="important stylesheet" href="chrome://messagebody/skin/messageBody.css">  
</head>  
<body>  
<table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part1"><tr><td><b>Betreff: </b><a>%20<x>   
<a>%20<x></td></tr><tr><td><b>Von: </b>x@sonicwall.com</td></tr><tr><td><b>Datum: </b>07.03.2014 00:15</td></tr></table>  
<table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part2"><tr><td><b>An: </b>bkm@evolution-sec.com</td></tr></table><br>  
<[PERSISTENT INJECTED SCRIPT CODE!]>%20<iframe><br>  
<br>  
<br>  
<br>  
Powered by Dell SonicWALL GMS</body>  
</html>  
  
  
Reference(s):  
http://gms.localhost:4872/sgms/  
http://gms.localhost:4872/sgms/panelManager  
http://gms.localhost:4872/sgms/panelManager?panelidz=1  
http://gms.localhost:4872/sgms/panelManager?panelidz=1&level=1&typeOfUnits=0#  
  
  
Solution - Fix & Patch:  
=======================  
The vulnerability can be patched by a secure encode and parse of the input values in the message body context  
Filter and restrict context of send mails through the application and the web-server of the sonicwall gms appliance.  
The issue has already been patched by the dell security team in cooperation with the vulnerability-lab during the year 2014.  
  
  
Security Risk:  
==============  
The security risk of the persistent mail encoding and validation web vulnerability is estimated as medium. (CVSS 3.0)  
  
  
Credits & Authors:  
==================  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]  
  
  
Disclaimer & Information:  
=========================  
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,   
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-  
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business   
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some   
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation   
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases   
or trade with fraud/stolen material.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com  
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com  
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com  
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.   
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other   
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and   
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),   
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.  
  
Copyright © 2014 | Vulnerability Laboratory [Evolution Security]  
  
  
  
--   
VULNERABILITY LABORATORY RESEARCH TEAM  
DOMAIN: www.vulnerability-lab.com  
CONTACT: research@vulnerability-lab.com  
  
  
  
  
`