what you don't know can hurt you

OX Guard 2.10.3 Cross Site Scripting / Server-Side Request Forgery

OX Guard 2.10.3 Cross Site Scripting / Server-Side Request Forgery
Posted Jun 12, 2020
Authored by Martin Heiland

OX Guard version 2.10.3 suffers from server-side request forgery and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss
advisories | CVE-2020-9426, CVE-2020-9427
MD5 | fbb358adaf8635397a48eb79a5b0cf1a

OX Guard 2.10.3 Cross Site Scripting / Server-Side Request Forgery

Change Mirror Download
Product: OX Guard
Vendor: OX Software GmbH



Internal reference: GUARD-179
Vulnerability type: Cross-Site Scripting (CWE-80)
Vulnerable version: 2.10.3
Vulnerable component: guard
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.10.2-rev9, 2.10.3-rev4
Vendor notification: 2020-02-04
Solution date: 2020-03-06
Public disclosure: 2020-06-12
CVE reference: CVE-2020-9426
CVSS: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

Vulnerability Details:
Comments within forged malicious public-keys could contain HTML and Javascript that was not properly sanitized before displaying at Guard settings. Through autocrypt and other mechanisms such keys could get imported without noticing their malicious content.

Risk:
Users can trigger API calls that invoke local URLs, if a host can be accessed a different error will be returned compared to unavailable hosts. This can be used to discover an internal network topology and services.

Steps to reproduce:
1. Create a PGP keypair
2. Use HTML and JS as part of the public keys comment section
3. Distribute this key through mail attachments, autocrypt or HKP

Solution:
We improved our sanitizing and ensure that external content such as comments are handled safely.



---



Internal reference: GUARD-182
Vulnerability type: Server-Side Request Forgery (CWE-918)
Vulnerable version: 2.10.3
Vulnerable component: guard
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.10.2-rev9, 2.10.3-rev4
Vendor notification: 2020-02-11
Solution date: 2020-03-06
Public disclosure: 2020-06-12
CVE reference: CVE-2020-9427
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

Vulnerability Details:
HKP/HKPS key discovery mechanisms are based on DNS service records. Those are probed to look up unknown public-keys but were insufficiently checked for sensitive resource locations.

Risk:
In case of a malicious DNS server or domain, an attacker could use this technique to redirect HTTP requests to internal networks. Taking timing and response codes into consideration this can be used to determine if a specific port at a internal system is open or not, leading to basic network discovery capabilities for the attacker.

Steps to reproduce:
1. Setup a malicious domain with HKP/HKPS service records, point them to a malicious HKP responder
2. At the malicious HKP responder, issue HTTP redirects targetting internal hosts like 127.0.0.1

Solution:
We now run HKP responses through existing blacklist mechanisms to avoid accessing internal network resources.



---



Internal reference: GUARD-183
Vulnerability type: Server-Side Request Forgery (CWE-918)
Vulnerable version: 2.10.3
Vulnerable component: guard
Report confidence: Confirmed
Solution status: Fixed by Vendor
Fixed version: 2.10.2-rev9, 2.10.3-rev4
Vendor notification: 2020-02-11
Solution date: 2020-03-06
Public disclosure: 2020-06-12
CVE reference: CVE-2020-9427
CVSS: 5.0 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)

Vulnerability Details:
WKS/Webkey services discovery mechanisms are based on DNS service records. Those are probed to look up unknown public-keys but were insufficiently checked for sensitive resource locations.

Risk:
In case of a malicious DNS server or domain, an attacker could use this technique to redirect HTTP requests to internal networks. Taking timing and response codes into consideration this can be used to determine if a specific port at a internal system is open or not, leading to basic network discovery capabilities for the attacker. Mind that this attack gets mitigated when using DNSSEC, but depending on configuration this might get bypassed or not used.

Steps to reproduce:
1. Setup a malicious domain with WKS/Webkey service records, point them to a malicious WKS responder
2. At the malicious WKS responder, issue HTTP redirects targetting internal hosts like 127.0.0.1

Solution:
We now run WKS responses through existing blacklist mechanisms to avoid accessing internal network resources.

Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    19 Files
  • 3
    Jul 3rd
    11 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close