Check Point Software Firewall-1 3.0 Script Tag Checking Bypass Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Check Point Software Firewall-1 3.0 Script Tag Checking Bypass Vulnerability. Firewall-1 allows script tag alteration in HTML pages, but version 3 can be bypassed, enabling execution of hostile scripts, leading to remote compromise of client systems. Version 4 fixes this issue


                                                source: http://www.securityfocus.com/bid/954/info

Firewall-1 includes the ability to alter script tags in HTML pages before passing them to the client&#39;s browser. This alteration invalidates the tag, rendering the script unexecutable by the browser. In version 3, this function can be bypassed by adding an extra opening angle bracket. The tag will be left unmodified, and the browser will be able to execute the contained script. Hostile script could lead to a remote compromise of the client system.

Firewall-1 version 4 will alter the tag as expected. 

&#60;html&#62;
&#60;&#60;script language=&#34;javascript&#34;&#62;
alert(&#34;&#60;&#60;script&#62; tag succesfully passed!&#34;)
&#60;/script&#62;
Click &#60;A HREF=&#34;/vdb/bottom.html?section=exploit&vid=954&#34;&#62;here&#60;/A&#62; to return to vulnerability listing.
&#60;/html&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1