seeing is believing

Websense Enterprise 6.3.3 Via: Bypass Still Exists

Websense Enterprise 6.3.3 Via: Bypass Still Exists
Posted Aug 19, 2010
Authored by mrhinkydink

Websense Enterprise version 6.3.3 suffers from a bypass vulnerability using the Via: header. This was believed to be addressed but the remediation was insufficient.

tags | exploit, bypass
MD5 | e47cc78195b40a9b1e7454fd630a7ba5

Websense Enterprise 6.3.3 Via: Bypass Still Exists

Change Mirror Download
discovered by mrhinkydink

PRODUCT: Websense Enterprise

EXPOSURE: Trivial Web Policy Bypass (III)

LINK:
http://mrhinkydink.blogspot.com/2010/08/websenseisa-via-bypass-redux.html


SYNOPSIS
========

On May 29, 2010 I demonstrated that by adding a "Via:" header to an HTTP
request it is possible for a user to completely bypass filtering and
monitoring in a Websense Enterprise 6.3.3/Microsoft ISA Server (2004 or
2006) proxy integration environment. This was addressed in Websense
Knowledge Base article #5117.

However, anyone familiar with the Via bypass technique would have
noticed this remediation was insufficient.


PROOF OF CONCEPT
================

The following works in a Websense Enterprise system using the ISA Server
integration product in a Cache Array Routing Protocol (CARP, sometimes
referred to as "CRAP") configuration, which requires at least two ISA
servers.

Assuming there are two ISA servers configured as per Websense Knowledge
Base article #5117, one at IP address 10.10.0.1 and another at
10.10.0.2, perform the following:

I. Install Firefox >= 3.5

II. Configure Firefox to use one of the proxy servers in the CARP array
(10.10.0.1).

III. Obtain and install the Modify Headers plug-in by Gareth Hunt

IV. Configure the plug-in to add a valid "Via:" header pointing to the
other server in the array.

Example: "Via: 1.0 10.10.0.2"

V. Browse to a filtered Web site

VI. All content is allowed without monitoring or filtering


PoC RESTRICTIONS
================

All restrictions noted in the original Via Bypass article apply.

See http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html


OTHER USES
==========

Limited only by your imagination! You do have an imagination, don't
you?

See http://mrhinkydink.blogspot.com/2010/05/websense-633-via-bypass.html


WORK-AROUNDS
============

Install Hotfix 17 provided by Websense.


HISTORY
=======

06/25/2010 - vendor notified

08/13/2010 - vendor releases Hotfix 17

08/18/2010 - PoC published



c. MMX mrhinkydink

http://mrhinkydink.blogspot.com
http://proxyobsession.net


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    2 Files
  • 24
    Jul 24th
    19 Files
  • 25
    Jul 25th
    28 Files
  • 26
    Jul 26th
    2 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close