Profense Web Application Firewall Security Bypass Vulnerabilities

Bugtraq ID:	35053
Class:	Input Validation Error
CVE:	CVE-2009-1594 CVE-2009-1593
Remote:	Yes
Local:	No
Published:	May 20 2009 12:00AM
Updated:	May 21 2009 08:50PM
Credit:	EnableSecurity
Vulnerable:	Armorlogic Profense 2.4.2 Armorlogic Profense 2.2.20
Not Vulnerable:	Armorlogic Profense 2.4.4 Armorlogic Profense 2.2.22

Profense Web Application Firewall Security Bypass Vulnerabilities

Profense Web Application Firewall is prone to multiple security-bypass vulnerabilities.

An attacker can exploit these issues to bypass certain security restrictions and perform various web-application attacks.

Versions *prior to* the following are vulnerable:

Profense 2.4.4
Profense 2.2.22

Profense Web Application Firewall Security Bypass Vulnerabilities

Attackers can exploit the issue via a browser.

The following example URIs are available:

http://www.example.com/phptest/xss.php?var=%3CEvil%20script%20goes%20here%3E=%0AByPass
http://www.example.com/phptest/xss.php?var=%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E

Profense Web Application Firewall Security Bypass Vulnerabilities

Solution:
The vendor has released updates. Please see the references for details.

Profense Web Application Firewall Security Bypass Vulnerabilities

References:

• Profense Homepage (Amorlogic)
  
• Armorlogic Profense Web Application Firewall 2.4 multiple vulnerabilities. (EnableSecurity)