CSNC-2012-004 Generic XSS in AdNovum nevisProxy

2012-06-17T00:00:00
ID SECURITYVULNS:DOC:28160
Type securityvulns
Reporter Securityvulns
Modified 2012-06-17T00:00:00

Description

COMPASS SECURITY ADVISORY

http://www.csnc.ch/en/downloads/advisories.html

Product: NevisProxy

Vendor: AdNovum

CVD ID: CSNC-2012-004

Subject: Cross-site scripting (XSS) within 302 Redirections

Risk: High

Effect: Remotely exploitable

Author: Alexandre Herzog <alexandre.herzog@csnc.ch>

Date: 02/23/2012

Introduction:

nevisProxy is a secure reverse proxy with integrated web application firewall (WAF). It acts as a central upstream entry point for web traffic to integrated online applications. nevisProxy controls user access and protects sensitive data, applications, services, and systems from internal and external threats. nevisProxy is a component of AdNovum's security framework Nevis. [1]

Affected:

Vulnerable: * nevisProxy <= 3.10.2.0

Technical Description - HTTP to HTTPS redirection

Nevis provides several security features as a Web Application firewall, such as HTTP to HTTPS redirections and authorization checks.

A typical HTTP request to http://victim/ will trigger a redirection to https://victim/. HTML characters injected in the URL (payload /'+"<em>test) are all encoded in the body, but to the exception of one character.

Injecting CR/LF characters (%0d %0a) doesn't yield any useable results, aside the fact that the Location header is not sent.

Remains the issue of the unencoded character. As one tag's attributes are enclosed with single quotes, and we can inject this character without being encoded, we can terminate the href attribute and start another attribute. But the HTML part of the answer never gets xecuted when a Location header is present in a 302 redirect. On the other hand, we can get rid of this header by injecting LF/CR characters. This means we're able to execute arbitrary JavaScript in the context of the user as soon as he clicks on the generated link.

Despite being not entirely HTML conform, the injected JavaScript code gets executed in at least the following browsers: - Firefox 10.0.1 & 10.0.2 - Chrome 17.0.963.56

The XSS protection of Internet Explorer 9.0.5 prevents execution of the injected JavaScript with the default security zone settings.

Technical Description - Nevis Authentication Redirection

The same issue exists when a client tries, without having an adequate cookie or a registered SSL ID, to access a page requiring a Nevis authentication check, e.g. https://victim/webapp/protected.html

Workaround / Fix:

See AdNovum Security Bulletin 2012-03.

Timeline:

2012-02-15: Discovery by Alexandre Herzog 2012-02-22: Confirmation of the flaw on the system of a second customer 2012-02-23: Contacted the vendor, which answered quickly and professionally 2012-02-23: Added second issue when a Nevis Authentication is required 2012-02-24: Vendor informs that their customers will be notified about the flaw on the same day, including a mitigation proposal. A new, fixed version of the software will be available by March 14, 2012. Reference: AdNovum Security Bulletin 2012-03 2012-02-28: Vendor notifies its customers a second time as reminder 2012-03-01: Compass Security informs the vendor that the advisory will be published 2 months after the release of the fixed nevisProxy. Update of the advisory to reflect the content of the AdNovum Security Bulletin. 2021-06-14: Public release of the advisory

References:

[1] http://www.adnovum.ch/en/products/index.php?page=secprod&subpage=nevis&s ubsubpage=nevisproxy [2] http://blog.csnc.ch/2012/06/nevisproxy-advisory-release/