SonicWall NSA 4500 HTML Injection and Session Hijacking Vulnerabilities

Bugtraq ID:	49930
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 04 2011 12:00AM
Updated:	Nov 23 2011 10:35PM
Credit:	Hugo Vazquez Caramas
Vulnerable:	SonicWALL Sonicpoints 0 SonicWALL NSA 4500 0
Not Vulnerable:

SonicWall NSA 4500 HTML Injection and Session Hijacking Vulnerabilities

SonicWall NSA 4500 is prone to an HTML-injection vulnerability and a session-hijacking vulnerability.

Exploiting these issues can allow an attacker to hijack a user's session and gain unauthorized access to the affected application, or run malicious HTML or JavaScript code, potentially allowing the attacker to steal cookie-based authentication credentials, and control how the site is rendered to the user; other attacks are also possible.

SonicWall NSA 4500 HTML Injection and Session Hijacking Vulnerabilities

An attacker can exploit these issues through a browser:

The following sample cookie request for the session-hijacking vulnerability is available:

GET /log.wri HTTP/1.0
Host: 123.123.123.123
Connection: close
User-Agent: brute-forcing
Cookie: SessId=111111111

SonicWall NSA 4500 HTML Injection and Session Hijacking Vulnerabilities

Solution:
The vendor released an update to address this issue. Please see the references for more information.

SonicWall NSA 4500 HTML Injection and Session Hijacking Vulnerabilities

References:

• SonicWALL Analysis of PenTest Vulnerability Reports (SonicWALL)
  
• Vendor Homepage (SonicWALL)
  
• Multiple vulnerabilities in SonicWall ([email protected])