Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities.
An advisory by EnableSecurity. Trustwave published a joint advisory named TWSL2009-001
Advisory URL: http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt
Affected Versions: versions prior to 2.4.4 and 2.2.22
Fixed versions: 2.4.4, 2.2.22 and later
Armorlogic Profense is a Web Application Firewall and load balancing solution.
From their website (armorlogic.com): "Protecting and securing websites and web applications can be a complicated business. Profense web application firewall simplifies protection with an affordable and easy to use, feature rich, solution that gives you full PCI DSS 1.1 and 1.2 section 6.6 compliance."
These vulnerabilities were discovered during WAF testing by Sandro Gauci of EnableSecurity and Wendel Guglielmetti Henrique of Trustwave's SpiderLabs. We worked with the Armorlogic security team to have these security flaws reported and fixed. We would like to publicly thank the Armorlogic team for their prompt response!
The following vulnerabilities were identified:
Major issues: - Whitelist / positive model bypass - Blacklist / negative model bypass
Other issues: - static root password exposes administrative interface
----------- Major issues -----------
::::: Whitelist / positive model bypass :::::
Description: Profense Web Application Firewall configured in positive model can be evaded.
Technical details: Profense Web Application Firewall configured to make use of the strong positive model (white-list approach) can be evaded to launch various attacks including XSS (Cross-Site Scripting), SQL Injection, remote command execution, and others.
The vulnerability can be reproduced by making use of a URL-encoded new line character. The pattern matching in multi line mode matches any non-hostile line and marks the whole request as legitimate, thus allowing the request. This results in a bypass in the positive model. An example is showed below:
::::: Blacklist / negative model bypass :::::
Description: Profense Web Application Firewall with default configuration in negative model can be evaded to inject XSS.
::::: Static root password exposes administrative interface :::::
Description: Profense Web Application Firewall with default configuration has a default password hash.
Versions 2.4 and 2.2 of Profense Web Application Firewall with the default configuration the root password hash is the same default in all available products. The SSH server is enabled by default on the administrative interface and accepts root authentication using user and password credential. The hashing algorithm used is OpenBSD's blowfish password hash which is known to be strong. However the existence of a static password means that if this password is leaked in some way or another, then the attacker potentially has access to all exposed administrative interfaces.
Exploit code: Available to organizations by contacting email@example.com
Oct 10, 2008: Initial contact. Oct 10, 2008: Confirmation of the vulnerabilities. Oct 11, 2008: Discussion of possible fixes. Oct 13, 2008: Fix from Armorlogic complete. Oct 14, 2008: Fix issued to customers. May 13, 2009: Advisory public release.
Upgrade to the latest version of Profense: http://www.armorlogic.com/
EnableSecurity is dedicated to providing high quality Information Security Consultancy, Research and Development. EnableSecurity develops security tools such as VOIPPACK (for Immunity CANVAS) and SIPVicious. EnableSecurity is focused on analysis of security challenges and providing solutions to such threats. EnableSecurity works on developing custom targeted security solutions, as well as working with existing off the shelf security tools to provide the best results for their customers. More info at enablesecurity.com
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.