what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

SecurePoint UTM 12.x Session ID Leak

SecurePoint UTM 12.x Session ID Leak
Posted Apr 18, 2023
Authored by Julien Ahrens | Site rcesecurity.com

SecurePoint UTM versions 12.x suffers from a session identifier leak vulnerability via the spcgi.cgi endpoint.

tags | exploit, cgi, info disclosure
advisories | CVE-2023-22620
SHA-256 | 1d4cd9e39a6938ba5bad5e9bd158f7895198cb30170e4a59be88883cdba0cd69

SecurePoint UTM 12.x Session ID Leak

Change Mirror Download
RCE Security Advisory
https://www.rcesecurity.com


1. ADVISORY INFORMATION
=======================
Product: SecurePoint UTM
Vendor URL: https://www.securepoint.de/en/for-companies/firewall-vpn
Type: Exposure of Sensitive Information to an Unauthorized Actor [CWE-200]
Date found: 2023-01-05
Date published: 2023-04-11
CVSSv3 Score: 9.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
CVE: CVE-2023-22620


2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.


3. VERSIONS AFFECTED
====================
SecurePoint UTM 12.2.5
SecurePoint UTM 12.2.5
SecurePoint UTM 12.2.4.1
SecurePoint UTM 12.2.4
SecurePoint UTM 12.2.3.4
SecurePoint UTM 12.2.3.3
SecurePoint UTM 12.2.3.2 Reseller Preview
SecurePoint UTM 12.2.3.1 Reseller Preview


4. INTRODUCTION
===============
With secure networks, home office, site connectivity and the protection of your
data are easy to implement. UTM firewalls and VPN gateways from Securepoint secure
your networks - with suitable IT security solutions for small and medium-sized
businesses for rent, purchase or as a complete service.

(from the vendor's homepage)


5. VULNERABILITY DETAILS
========================
The firewall offers an administrative web panel on port 11115 and a user login panel
on port 443. Both offer the endpoint at "/spcgi.cgi" which leaks the "sessionid" of
the last active authenticated user to any unauthenticated user when the application
processes an invalid authentication attempt.

However, the attacker needs two more authentication attributes to be able to successfully
authenticate using the leaked sessionid:

1. The attacker must have the same REMOTE_ADDR as the user whose sessionid is leaked.
This isn't trivial to achieve, but exploitation is easy in configurations where any of the
two panels are NAT'ed.

2. The attacker needs to know the User-Agent of the user whose sessionid is leaked.
However, since the application does not enforce a rate limit on the authentication
endpoint, it is trivially easy to brute-force the User-Agent belonging to the leaked
session and then authenticate to the device. As the linked blog post describes, the
number of possible User-Agents can be further reduced.

Interestingly this exploit works across both authentication panels, so an attacker
can also leak the sessionId of an administrator using the user login interface and vice
versa.

Successful exploits can allow an unauthenticated attacker to authenticate against
the administrative interface without knowing the user's password. If the last
authenticated user has administrative privileges, this means a complete compromise
of the device since it is trivially easy to escalate from admin to root using legitimate
features.


6. PROOF OF CONCEPT
===================
Wait until a user successfully authenticates against the device and then issue an
invalid authentication attempt like:

POST /spcgi.cgi HTTP/1.1
Host: 192.168.175.1:11115
Content-Length: 86
Accept: */*
Content-Type: application/json; charset=UTF-8
Connection: close

{"module":"auth","command":["login"],"sessionid":"","arguments":{"user":"","pass":""}}

The application then returns the last active user's sessionid:

{
"sessionid": "8d4602543120a48a4ec30762c5cad3fa",
"mode": "w",
"result": {
"module": "server",
"code": 401,
"status": "Unauthorized",
"message": "failure: access denied"
},
"version": "11.6"
}

This is also exploitable against the user interface on port 443.


7. SOLUTION
===========
Upgrade to version 12.2.5.1 or newer


8. REPORT TIMELINE
==================
2023-01-04: Discovery of the vulnerability
2023-01-04: MITRE assigns CVE-2023-22620
2023-01-05: Contacted vendor via their security@
2023-01-05: Vendor response
2023-01-05: Sent full vulnerability details to vendor
2023-01-06: Vendor acknowledged the vulnerability
2023-01-06: Vendor asks to set the disclosure date to 2023-04-11 due to the # of affected customers
2023-01-06: RCE Security agrees to the proposed disclosure date
2023-01-06: Vendor publishes hotfix 12.2.5.1 which fixes the vulnerability
2023-04-11: Public disclosure


9. REFERENCES
==============
https://www.rcesecurity.com/2023/04/securepwn-part-1-bypassing-securepoint-utms-authentication-cve-2023-22620/
https://github.com/MrTuxracer/advisories

Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    6 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close