#############################################################
#
# COMPASS SECURITY ADVISORY
# http://www.csnc.ch/en/downloads/advisories.html
#
#############################################################
#
# Product:  NevisProxy
# Vendor:   AdNovum
# CVD ID:   CSNC-2012-004
# Subject:  Cross-site scripting (XSS) within 302 Redirections
# Risk:     High
# Effect:   Remotely exploitable
# Author:   Alexandre Herzog <alexandre.herzog@csnc.ch>
# Date:     02/23/2012
#
#############################################################

Introduction:
-------------
nevisProxy is a secure reverse proxy with integrated web application
firewall (WAF). It acts as a central upstream entry point for web 
traffic to integrated online applications. nevisProxy controls user
access and protects sensitive data, applications, services, and systems
from internal and external threats. nevisProxy is a component of
AdNovum's security framework Nevis. [1] 

Affected:
---------
Vulnerable:
 * nevisProxy <= 3.10.2.0

Technical Description - HTTP to HTTPS redirection
-------------------------------------------------
Nevis provides several security features as a Web Application firewall,
such as HTTP to HTTPS redirections and authorization checks. 

A typical HTTP request to http://victim/ will trigger a redirection to
https://victim/. HTML characters injected in the URL (payload
/'+"<em>test) are all encoded in the body, but to the exception of one
character. 

Injecting CR/LF characters (%0d %0a) doesn't yield any useable results,
aside the fact that the Location header is not sent.

Remains the issue of the unencoded character. As one tag's attributes
are enclosed with single quotes, and we can inject this character
without being encoded, we can terminate the href attribute and start
another attribute. But the HTML part of the answer never gets xecuted
when a Location header is present in a 302 redirect. On the other hand,
we can get rid of this header by injecting LF/CR characters. This means
we're able to execute arbitrary JavaScript in the context of the user as
soon as he clicks on the generated link.

Despite being not entirely HTML conform, the injected JavaScript code
gets executed in at least the following browsers:
- Firefox 10.0.1 & 10.0.2
- Chrome 17.0.963.56

The XSS protection of Internet Explorer 9.0.5 prevents execution of the
injected JavaScript with the default security zone settings. 


Technical Description - Nevis Authentication Redirection
-------------------------------------------------------
The same issue exists when a client tries, without having an adequate
cookie or a registered SSL ID, to access a page requiring a Nevis
authentication check, e.g. https://victim/webapp/protected.html


Workaround / Fix:
-----------------
See AdNovum Security Bulletin 2012-03.


Timeline:
---------
2012-02-15:     Discovery by Alexandre Herzog
2012-02-22:     Confirmation of the flaw on the system of a second
                customer
2012-02-23:     Contacted the vendor, which answered quickly and 
                professionally
2012-02-23:     Added second issue when a Nevis Authentication is
                required
2012-02-24:     Vendor informs that their customers will be notified
                about the flaw on the same day, including a mitigation
                proposal. A new, fixed version of the software will
                be available by March 14, 2012. Reference: AdNovum
                Security Bulletin 2012-03
2012-02-28:     Vendor notifies its customers a second time as reminder
2012-03-01:     Compass Security informs the vendor that the advisory
                will be published 2 months after the release of the 
                fixed nevisProxy. Update of the advisory to reflect 
                the content of the AdNovum Security Bulletin.
2021-06-14:     Public release of the advisory


References:
-----------
[1]
http://www.adnovum.ch/en/products/index.php?page=secprod&subpage=nevis&s
ubsubpage=nevisproxy
[2] http://blog.csnc.ch/2012/06/nevisproxy-advisory-release/