Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Security App Flaws :: bx2245.htm

Checkpoint VPN-1 UTM Edge cross-site scripting



Checkpoint VPN-1 UTM Edge cross-site scripting
Checkpoint VPN-1 UTM Edge cross-site scripting



                           Louhi Networks
                          Security Advisory


      Advisory: Checkpoint VPN-1 UTM Edge cross-site scripting
  Release Date: 2008/03/06
Last Modified: 2008/03/06
       Authors: Henri Lindberg, Associate of (ISC)=B2
[henri.lindberg@louhi.fi] 

   Application: Checkpoint VPN-1 Edge W Embedded NGX 7.0.48x
                (patched in version 7.5.48)
       Devices: Checkpoint VPN-1 UTM Edge
   Attack type: Cross site scripting (non-persistent)
          Risk: Low
Vendor Status: Vendor has released an updated version
References: http://www.louhi.fi/advisory/checkpoint_080306.txt 


Overview:

Quote from http://www.checkpoint.com/ 
    "VPN-1 UTM Edge appliances deliver unified threat management to
     enterprises with branch offices and simplify security deployments
     and manageability. VPN-1 UTM Edge appliances consolidate proven
     enterprise-class technology into a single branch office solution
     that does not compromise the corporate network and eliminates the
     branch office as your weakest link. As part of Check Point's Unified
     Security Architecture, VPN-1 UTM Edge can enforce a global security
     policy and allows administrators to manage and update thousands of
     appliances as easily as managing one."

    Insufficient input validation and output encoding on the login page
    allows attacker to perform html-injection by posting suitable string
    to the login form handler. The injection leads to reflected
    pre-authentication cross site scripting.


Details:
    Form based authentication is used only when device is accessed using
    HTTP. Authentication over HTTPS uses HTTP basic authentication.

    The device does not accept the parameters in a GET request, POST
    request has to be used instead - exploiting the XSS vulnerability
    requires therefore a bit more effort compared to ordinary GET based
    reflected cross site scripting vulnerability.

    The current version can be checked from
http://xxx.xxx.xxx.xxx/pub/test.html where xxx.xxx.xxx.xxx is LAN IP 
    address of the device. The page also displays current product key.

Vendor response:

    "Once users register the appliance and connect to the service center
    (Safe@Office appliances), the latest firmware is automatically
    downloaded to their appliance. For UTM-1 Edge appliances, the latest
    firmware version can be downloaded from the Check Point download
    center. Currently, this is version 7.5.48 that does not contain the
    reported issue. We believe that customers are not exposed to this
    issue."

Proof of Concept:



action="http://192.168.10.1" style="display:none">
Solution: Update to version 7.5.48 Disclosure Timeline: 19. February 2008 - Contacted Checkpoint by email 20. February 2008 - Vendor response. 6. March 2008 - Advisory was released Copyright 2008 Louhi Networks Oy. All rights reserved.


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH