FirePass SSL VPN 'refreshURL' Parameter URI Redirection Vulnerability
BID:56156
Info
FirePass SSL VPN 'refreshURL' Parameter URI Redirection Vulnerability
| Bugtraq ID: | 56156 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 21 2012 12:00AM |
| Updated: | Mar 19 2015 08:38AM |
| Credit: | Aung Khant of YGN Ethical Hacker Group |
| Vulnerable: |
F5 FirePass 6.0.3 F5 FirePass 6.0.2 F5 FirePass 6.0.1 F5 FirePass 7.0 F5 FirePass 6.1 F5 FirePass 6.0.2.3 F5 FirePass 6.0 |
| Not Vulnerable: | |
Discussion
FirePass SSL VPN 'refreshURL' Parameter URI Redirection Vulnerability
FirePass SSL VPN is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
Versions prior to FirePass 7.0.0 HF-70-7 and 6.1.0 HF-610-9 are vulnerable.
FirePass SSL VPN is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
Versions prior to FirePass 7.0.0 HF-70-7 and 6.1.0 HF-610-9 are vulnerable.
Exploit / POC
FirePass SSL VPN 'refreshURL' Parameter URI Redirection Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URI is available:
http://www.example.com/my.activation.cns.php3?langchar=&ui_translation=&refreshURL==http://attacker
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
The following example URI is available:
http://www.example.com/my.activation.cns.php3?langchar=&ui_translation=&refreshURL==http://attacker
References
FirePass SSL VPN 'refreshURL' Parameter URI Redirection Vulnerability
References:
References: