________________________________________________________________________ ____ Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities. ________________________________________________________________________ ____ An advisory by EnableSecurity. Trustwave published a joint advisory named TWSL2009-001 ID: ES-20090500 Advisory URL: http://resources.enablesecurity.com/advisories/ES-20090500-profense.txt Affected Versions: versions prior to 2.4.4 and 2.2.22 Fixed versions: 2.4.4, 2.2.22 and later Description: Armorlogic Profense is a Web Application Firewall and load balancing solution. From their website (armorlogic.com): "Protecting and securing websites and web applications can be a complicated business. Profense web application firewall simplifies protection with an affordable and easy to use, feature rich, solution that gives you full PCI DSS 1.1 and 1.2 section 6.6 compliance." Credits: These vulnerabilities were discovered during WAF testing by Sandro Gauci of EnableSecurity and Wendel Guglielmetti Henrique of Trustwave's SpiderLabs. We worked with the Armorlogic security team to have these security flaws reported and fixed. We would like to publicly thank the Armorlogic team for their prompt response! __________________________________________________________________ Technical details: The following vulnerabilities were identified: Major issues: - Whitelist / positive model bypass - Blacklist / negative model bypass Other issues: - static root password exposes administrative interface ----------- Major issues ----------- ::::: Whitelist / positive model bypass ::::: CVE: CVE-2009-1594 Description: Profense Web Application Firewall configured in positive model can be evaded. Technical details: Profense Web Application Firewall configured to make use of the strong positive model (white-list approach) can be evaded to launch various attacks including XSS (Cross-Site Scripting), SQL Injection, remote command execution, and others. The vulnerability can be reproduced by making use of a URL-encoded new line character. The pattern matching in multi line mode matches any non-hostile line and marks the whole request as legitimate, thus allowing the request. This results in a bypass in the positive model. An example is showed below: http://testcases/phptest/xss.php?var=%3CEvil%20script%20goes%20here%3E=% 0AByPass ::::: Blacklist / negative model bypass ::::: CVE: CVE-2009-1593 Description: Profense Web Application Firewall with default configuration in negative model can be evaded to inject XSS. Technical Description: Versions 2.4 and 2.2 of Profense Web Application Firewall with the default configuration in negative model (blacklist approach) can be evaded to inject XSS (Cross-Site Scripting). The problem is due to the built-in core rules that can be abused using the flexibility provided by HTML and JavaScript. The vulnerability can be reproduced by injecting a common XSS attack in a vulnerable application protected by Profense Web Application Firewall. Inserting extra characters in the JavaScript close tag will bypass the XSS protection mechanisms. An example is shown below: http://testcases/phptest/xss.php?var=%3Cscript%3Ealert(document.cookie)% 3C/script%20ByPass%3E ::::: Static root password exposes administrative interface ::::: Description: Profense Web Application Firewall with default configuration has a default password hash. Technical Description: Versions 2.4 and 2.2 of Profense Web Application Firewall with the default configuration the root password hash is the same default in all available products. The SSH server is enabled by default on the administrative interface and accepts root authentication using user and password credential. The hashing algorithm used is OpenBSD's blowfish password hash which is known to be strong. However the existence of a static password means that if this password is leaked in some way or another, then the attacker potentially has access to all exposed administrative interfaces. __________________________________________________________________ Exploit code: Available to organizations by contacting info (at) enablesecurity (dot) com [email concealed] Timeline: Oct 10, 2008: Initial contact. Oct 10, 2008: Confirmation of the vulnerabilities. Oct 11, 2008: Discussion of possible fixes. Oct 13, 2008: Fix from Armorlogic complete. Oct 14, 2008: Fix issued to customers. May 13, 2009: Advisory public release. Solution: Upgrade to the latest version of Profense: http://www.armorlogic.com/ __________________________________________________________________ About EnableSecurity: EnableSecurity is dedicated to providing high quality Information Security Consultancy, Research and Development. EnableSecurity develops security tools such as VOIPPACK (for Immunity CANVAS) and SIPVicious. EnableSecurity is focused on analysis of security challenges and providing solutions to such threats. EnableSecurity works on developing custom targeted security solutions, as well as working with existing off the shelf security tools to provide the best results for their customers. More info at enablesecurity.com Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.