SonicWall SOHO3 Content Blocking Script Injection Vulnerability
BID:4755
Info
SonicWall SOHO3 Content Blocking Script Injection Vulnerability
| Bugtraq ID: | 4755 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 17 2002 12:00AM |
| Updated: | May 17 2002 12:00AM |
| Credit: | Credited to "E M" <[email protected]>. |
| Vulnerable: |
SonicWALL SOHO 6.3 .0.0 |
| Not Vulnerable: | |
Discussion
SonicWall SOHO3 Content Blocking Script Injection Vulnerability
The Sonicwall SOHO3 is an Internet security appliance that provides firewall security solutions.
Reportedly, a vulnerability exists in the product that allows for a script injection attack to be launched from a malicious user within the internal LAN.
It is possible to configure Sonicwall to block domains from a list of user entered domains. Sonicwall will deny local users access to the websites that have been blocked. A malicious user may be able to inject script code as part of a URL of a blocked domain. Attempts to access blocked domains will be entered into the log files of Sonicwall. An administrator viewing the log files will automatically cause the malicious script code execute.
If the attacker's script code is injected into the logfile then the administrator will not be able to access the log normally. To regain access to the logs the appliance will need to be rebooted. It should be noted that rebooting the appliance will cause the logs to be cleared and will effectively eliminate any indication in the logs of which user initiated the attack.
It is possible for a malicious remote user to exploit this issue by crafting a URL of a known blocked domain that includes script code, and enticing a local user into following the link.
The Sonicwall SOHO3 is an Internet security appliance that provides firewall security solutions.
Reportedly, a vulnerability exists in the product that allows for a script injection attack to be launched from a malicious user within the internal LAN.
It is possible to configure Sonicwall to block domains from a list of user entered domains. Sonicwall will deny local users access to the websites that have been blocked. A malicious user may be able to inject script code as part of a URL of a blocked domain. Attempts to access blocked domains will be entered into the log files of Sonicwall. An administrator viewing the log files will automatically cause the malicious script code execute.
If the attacker's script code is injected into the logfile then the administrator will not be able to access the log normally. To regain access to the logs the appliance will need to be rebooted. It should be noted that rebooting the appliance will cause the logs to be cleared and will effectively eliminate any indication in the logs of which user initiated the attack.
It is possible for a malicious remote user to exploit this issue by crafting a URL of a known blocked domain that includes script code, and enticing a local user into following the link.
Exploit / POC
SonicWall SOHO3 Content Blocking Script Injection Vulnerability
The following proof of concept has been provided:
bannerserver.gator.com/<SCRIPT>window.location.href="http://www.offroadwarehouse.com";</SCRIPT>
The script code will redirect a user to a different site.
The following proof of concept has been provided:
bannerserver.gator.com/<SCRIPT>window.location.href="http://www.offroadwarehouse.com";</SCRIPT>
The script code will redirect a user to a different site.
Solution / Fix
SonicWall SOHO3 Content Blocking Script Injection Vulnerability
Solution:
Resolution
The work-arounds described above will resolve the vulnerability until a permanent resolution is developed. Sonicwall is working on a fix for this issue that will be available with the release of the next version of SonicWALL firmware. If you require additional assistance with this vulnerability, please visit SonicWALL's Technical Support site at: http://www.customer.mysonicwall.com/ecustomer/start.swe?SWECmd=Login.
Solution:
Resolution
The work-arounds described above will resolve the vulnerability until a permanent resolution is developed. Sonicwall is working on a fix for this issue that will be available with the release of the next version of SonicWALL firmware. If you require additional assistance with this vulnerability, please visit SonicWALL's Technical Support site at: http://www.customer.mysonicwall.com/ecustomer/start.swe?SWECmd=Login.
References
SonicWall SOHO3 Content Blocking Script Injection Vulnerability
References:
References:
- ViewPoint Homepage (SonicWALL)