SonicWall UTM ES WAF - Input Filter Bypass Vulnerability

Document Title:
===============
SonicWall UTM ES WAF - Input Filter Bypass Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=545


Release Date:
=============
2012-08-12


Vulnerability Laboratory ID (VL-ID):
====================================
545


Common Vulnerability Scoring System:
====================================
3.2


Product & Service Introduction:
===============================
SonicWALL is a private company headquartered in San Jose, CA. It sells a range of internet appliances primarily directed 
at content control and network security. These include devices providing services for network firewalls, UTMs 
(Unified Threat Management), VPNs (Virtual Private Network), backup and recovery, and anti-spam for email. The company 
also markets information subscription services related to their products. The company solutions also serve to solve 
issues surrounding HIPAA and PCI compliance issues. On March 13, 2012, USA Today said that Dell announced its intent to 
acquire SonicWall, a company with 130 patents and 950 employees. The transaction is expected to close in May 2012. 

(Copy of the Vendor Homepage: http://en.wikipedia.org/wiki/SonicWALL )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a  input filter restrictions bypass in Sonicwalls UTM, ES & WAF applications.


Vulnerability Disclosure Timeline:
==================================
2012-05-02:	Researcher Notification & Coordination
2012-05-03:	Vendor Notification
2012-05-12:	Vendor Response/Feedback
2012-08-14:	Public Disclosure
2012-09-01:	Vendor Fix/Patch


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Local


Severity Level:
===============
Low


Technical Details & Description:
================================
A filter weakness & bypass vulnerability is detected in Sonicwalls UTM, ES & WAF applications.
& security appliance products. The vulnerability allows an remote attacker to bypass the input 
validation on input fields for configuration settings. The filter bypass vulnerability is located 
in the exception handling of the input filter validation when processing to parse malicious script 
code context. Successful exploitation can lead to persistent script code injection & persistent code 
exection out of the appliance context. The result is session hijacking, persistent context manipulation 
or phishing & account steal.

Vulnerable Module(s):
				[+] Input Validation - Exception Filter Restriction


Proof of Concept (PoC):
=======================
The restriction bypass vulnerability can be exploited by privileged user accounts to execute persistent context. 
For demonstration or reproduce ...

To explain how we detected the problem we are using the example of the discovered vulnerabilities with the issue.
URL: http://www.vulnerability-lab.com/get_content.php?id=543


1. Login & switch over to the Virenschutzverfahren module of the appliance
2. Go to the vulnerable Input Field value > `floodMsgThreshold` 
Note: The floodMsgThreshold value & requests with listing are restricted [save function parse] (tags like double quote & standard script alerts/frames)
3. Include a obfuscated script code string without double quote via onload to bypass the restricted function
4. Result: Persistent web context will be executed out of  listing module.


PoC:
>>><iFrAmE sRc=A oNlOaD=aLeRt(dOcUmEnT.cOoKiE) <

... or Hex

%3E%3E%3E%3C%69%46%72%41%6D%45%20%73%52%63%3D%41%20%6F%4E%6C%4F%61%44%3D%61%4C%65%52%74%28%64%4F%63%55%6D%45%6E%54%2E%63%4F%6F%4B%69%45%29%20%3C


Solution - Fix & Patch:
=======================
Update to firmware version is 6.0.0.5-23sv for the SRA 1200, SRA 4200 and SRA Virtual Appliance. 


Security Risk:
==============
The security risk of the restriction filter bypass vulnerability is estimated as medium(+)|(-)high.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected])


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2012 | Vulnerability Laboratory