what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

NevisProxy 3.10.2.0 Cross Site Scripting

NevisProxy 3.10.2.0 Cross Site Scripting
Posted Jun 15, 2012
Authored by Alexandre Herzog | Site csnc.ch

NevisProxy versions 3.10.2.0 and below suffer from a cross site scripting vulnerability in 302 redirects.

tags | advisory, xss
SHA-256 | dae923dd2b60f5df5d2fa5557c848a9059c8eafb1786b0a7d5788e2666f9b0db

NevisProxy 3.10.2.0 Cross Site Scripting

Change Mirror Download
#############################################################
#
# COMPASS SECURITY ADVISORY
# http://www.csnc.ch/en/downloads/advisories.html
#
#############################################################
#
# Product: NevisProxy
# Vendor: AdNovum
# CVD ID: CSNC-2012-004
# Subject: Cross-site scripting (XSS) within 302 Redirections
# Risk: High
# Effect: Remotely exploitable
# Author: Alexandre Herzog <alexandre.herzog@csnc.ch>
# Date: 02/23/2012
#
#############################################################

Introduction:
-------------
nevisProxy is a secure reverse proxy with integrated web application
firewall (WAF). It acts as a central upstream entry point for web
traffic to integrated online applications. nevisProxy controls user
access and protects sensitive data, applications, services, and systems
from internal and external threats. nevisProxy is a component of
AdNovum's security framework Nevis. [1]

Affected:
---------
Vulnerable:
* nevisProxy <= 3.10.2.0

Technical Description - HTTP to HTTPS redirection
-------------------------------------------------
Nevis provides several security features as a Web Application firewall,
such as HTTP to HTTPS redirections and authorization checks.

A typical HTTP request to http://victim/ will trigger a redirection to
https://victim/. HTML characters injected in the URL (payload
/'+"<em>test) are all encoded in the body, but to the exception of one
character.

Injecting CR/LF characters (%0d %0a) doesn't yield any useable results,
aside the fact that the Location header is not sent.

Remains the issue of the unencoded character. As one tag's attributes
are enclosed with single quotes, and we can inject this character
without being encoded, we can terminate the href attribute and start
another attribute. But the HTML part of the answer never gets xecuted
when a Location header is present in a 302 redirect. On the other hand,
we can get rid of this header by injecting LF/CR characters. This means
we're able to execute arbitrary JavaScript in the context of the user as
soon as he clicks on the generated link.

Despite being not entirely HTML conform, the injected JavaScript code
gets executed in at least the following browsers:
- Firefox 10.0.1 & 10.0.2
- Chrome 17.0.963.56

The XSS protection of Internet Explorer 9.0.5 prevents execution of the
injected JavaScript with the default security zone settings.


Technical Description - Nevis Authentication Redirection
-------------------------------------------------------
The same issue exists when a client tries, without having an adequate
cookie or a registered SSL ID, to access a page requiring a Nevis
authentication check, e.g. https://victim/webapp/protected.html


Workaround / Fix:
-----------------
See AdNovum Security Bulletin 2012-03.


Timeline:
---------
2012-02-15: Discovery by Alexandre Herzog
2012-02-22: Confirmation of the flaw on the system of a second
customer
2012-02-23: Contacted the vendor, which answered quickly and
professionally
2012-02-23: Added second issue when a Nevis Authentication is
required
2012-02-24: Vendor informs that their customers will be notified
about the flaw on the same day, including a mitigation
proposal. A new, fixed version of the software will
be available by March 14, 2012. Reference: AdNovum
Security Bulletin 2012-03
2012-02-28: Vendor notifies its customers a second time as reminder
2012-03-01: Compass Security informs the vendor that the advisory
will be published 2 months after the release of the
fixed nevisProxy. Update of the advisory to reflect
the content of the AdNovum Security Bulletin.
2021-06-14: Public release of the advisory


References:
-----------
[1]
http://www.adnovum.ch/en/products/index.php?page=secprod&subpage=nevis&s
ubsubpage=nevisproxy
[2] http://blog.csnc.ch/2012/06/nevisproxy-advisory-release/
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close