[Suspected Spam] Astaro Command Center v2.x - Multiple Web Vulnerabilities

[Research <research () vulnerability-lab com>]

Title:
======
Astaro Command Center v2.x - Multiple Web Vulnerabilities


Date:
=====
2012-04-03


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=4


VL-ID:
=====
4


Introduction:
=============
We are pleased to announce the General Availability of the Astaro Command Center Version 2.0. This new version 
introduces the major new ability 
to configure and manage IPSEC tunnels entirely within ACC itself. By providing a centralized location from which to 
work with and deploy VPN 
tunnels between Astaro installations, administrators can save management time and automate many of the tasks involved 
in successfully linking 
sites together with encrypted links. The Astaro Command Center is an entirely free product that allows you to centrally 
monitor and maintain 
multiple Astaro installations & devices. If you currently are responsible for more than one Astaro Gateway product, ACC 
is designed for you! 
Read on for more information. Starting with this release, it is now possible to setup site-to-site VPN tunnels with an 
amazing degree of ease 
from within Astaro Command Center itself. Simply indicate the devices to be joined together via VPN, select a few 
options, and the rest is 
automated with no need to login to each individual WebAdmin for the configuration. ACC is presented in the same 
administrative style as our AxG 
Version 7 WebAdmin, so that if you are new to ACC you will have no trouble getting started within a familiar looking 
environment.

(Copy from vendors homepage: http://up2date.astaro.com/2009/03/astaro_comand_center_20_releas.html#more)


Abstract:
=========
Vulnerability-Lab Team discovers multiple Input Validation Vulnerabilities on Astaros Command Center Application v2.x


Report-Timeline:
================
2011-01-12: Verified by Vulnerability-Lab
2011-06-15: Secure Vendor Notification
2011-06-17: Vendor Reply/Feedback
2012-03-22: Vendor Fix/Patch Disclosure by Check
2012-04-03: Discovery by Vulnerability-Lab


Status:
========
Published


Affected Products:
==================

Exploitation-Technique:
=======================
Remote


Severity:
=========
High


Details:
========
Multiple  persistent input validation vulnerabilities are detected in Astaro Command Center v2.x.
The bugs allows an local privileged attackers to implement/inject malicious script code on the application side 
(persistent).
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) 
context manipulation. Exploitation requires user inter action & minimum restricted access to the panel.

Vulnerable Module(s):
                                                [+] Configuration - Networks Definition
                                                [+] Deploy Function
                                                [+] Summary
                                                [+] VPN Information/ Configuration VPN Details
                                                [+] Management - Organizational Units


Proof of Concept:
=================
This vulnerabilities can be exploited local(persistent) by low privileged user accounts or 
by user inter-action (remote) via request force  ...


Code Review: Networks Definition

<tr><td style="width: 72px; vertical-align: top;" valign="top"><img class="TABLEOBJITEM_BUTTON_edit" 
src="core/img/blank1x1.gif"><span>
</span><img class="TABLEOBJITEM_BUTTON_clone" src="core/img/blank1x1.gif"><img style="width: 72px; height: 1px;" 
src="core/img/blank1x1.gif">
<img style="padding: 2px; cursor: pointer;" src="wfe/acc/img/buttons/button_custom_delete.png"><img style="padding: 
2px; cursor: pointer; 
display: none;" src="wfe/acc/img/buttons/button_custom_info.png"></td><td style="vertical-align: top; padding: 2px;" 
valign="top"><table style=
"width: 100%;" border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-top: 2px;" 
id="global_object_td_REF_ACC_GBL_
16fe7d084bbe4b05b7f25b74e5d18aa98aa9"><table border="0" cellpadding="0" cellspacing="0"><tbody><tr><td 
style="padding-right: 4px; width: 16px;">
<input id="global_objects_cb_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9" class="registration_checkbox_style" 
type="checkbox"></td><td style="
padding-right: 4px; width: 16px;"><img src="wfe/acc/img/icons/host.png"></td><td style="font-weight: bold; 
padding-right: 4px; width: 300px;">
<span>>"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!></iframe></span></td><td style="padding-right: 4px; width: 185px;">
<span>10.129.11.11</span></td><td style="padding-right: 4px;"><img class="img_button" 
src="wfe/acc/img/buttons/button_deploy_70.png" id="button_deploy
_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9"></td></tr></tbody></table></td></tr><tr><td><table border="0" 
cellpadding="0" cellspacing="0">
<tbody><tr><td style="padding-right: 4px; width: 16px;"><span></span></td><td style="padding-right: 4px; padding-top: 
4px; width: 320px;"><span>
</span></td><td style="padding-right: 4px; padding-top: 4px; width: 185px;"><span><img 
src="wfe/acc/img/icons/ldap-container.gif" style="float: left; 
padding-right: 4px;">Astaro AG</span></td><td style="padding-right: 4px; padding-top: 4px;"><img 
class="img_button_transparent" src="wfe/acc/img/buttons
/button_undeploy_70.png" 
id="button_undeploy_REF_ACC_GBL_16fe7d084bbe4b05b7f25b74e5d18aa98aa9"></td></tr></tbody></table></td></tr><tr><td><table
 
border="0" cellpadding="0" cellspacing="0"><tbody><tr><td style="padding-right: 4px; width: 
16px;"><span></span></td><td style="padding-right: 1px; 
padding-top: 4px; width: 16px;"><img style="cursor: pointer;" src="wfe/acc/img/icons/check_14.png"></td><td 
style="font-weight: normal; padding-right: 
4px; padding-top: 4px; width: 40px;"><span>0</span></td><td style="padding-right: 1px; padding-top: 4px; width: 
16px;"><img style="cursor: pointer;" 
src="wfe/acc/img/icons/cancel_14.png"></td><td style="font-weight: normal; padding-right: 4px; padding-top: 4px; width: 
40px;"><span>0</span></td><td 
style="padding-right: 1px; padding-top: 4px; width: 16px;"><img style="cursor: pointer;" 
src="wfe/acc/img/icons/service-fail_14.png"></td><td style="
font-weight: normal; padding-right: 4px; padding-top: 4px; width: 40px;"><span>0</span></td><td style="padding-right: 
1px; padding-top: 4px; width: 
16px;"><img style="cursor: pointer;" src="wfe/acc/img/icons/icon_deploy_14.png"></td><td style="font-weight: normal; 
padding-right: 4px; padding-top: 
4px; width: 120px;"><span>0</span></td></tr></tbody></table></td></tr></tbody></table></td><td style="width: 40px; 
vertical-align: top;" valign="top">
<img class="TABLEOBJITEM_BUTTON_usageinformation" src="core/img/blank1x1.gif"></td></tr>



Code Review: Deploy Functions

<tr><td><img src="core/img/icons/trash.png" style="margin-right: 6px; margin-left: 2px; cursor: pointer;" 
id="__DND__DROPPED_REF_ACC_GBL_
16fe7d084bbe4b05b7f25b74e5d18aa98aa9_trash_icon"></td><td><div style="vertical-align: middle; overflow: hidden; cursor: 
pointer; white-space: 
nowrap;"><img src="wfe/acc/img/icons/host.png" style="display: inline; vertical-align: middle; padding: 2px;"><div 
style="display: inline; 
vertical-align: middle; white-space: nowrap; padding: 2px 2px 2px 0px;">>"<<INCLUDE PERSISTENT SCRIPTCODE 
HERE!!!>></div>
<div style="position: relative; overflow: hidden; height: 0px; width: 0px; margin-left: 20px;"></div></div></td></tr>



Code Review: Summery Repaste

<form id="__FORM" style="width: 100%;"><div style="font-size: 14px; font-weight: bold;">Summary</div><br><div>This is a 
summary of the resulting 
VPN configuration. Please review it carefully and go back to the previous pages to perform any changes if needed. When 
finished, please press the 
<i>Next</i> button to start deploying the configuration to the respective devices.</div><br><div><b>General 
information</b></div><hr><div style=
"font-style: normal; float: left; line-height: 20px;">Name: </div><div style="line-height: 20px; text-align: 
right;">>"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!"></iframe></div><div style="font-style: normal; clear: 
left; float: left; line-height: 20px;">Type: </div><div style="line-height: 20px; text-align: 
right;">Site-2-Site</div><div style="font-style: 
normal; clear: left; float: left; line-height: 20px;">Policy: </div><div style="line-height: 20px; text-align: 
right;">TripleDES PFS (ACC)</div>
<div style="font-style: normal; clear: left; float: left; line-height: 20px;">Authentication: </div><div 
style="line-height: 20px; text-align: 
right;">RSA key</div><div style="width: 100%; clear: both; vertical-align: middle; line-height: 19px;"><label 
style="width: 170px; padding: 2px 
0px 0px; float: left; vertical-align: middle; font-style: normal;">Comment: </label><span style="border: 0px solid 
black; padding: 2px 0px; 
margin: 0px; float: right; vertical-align: middle;">>"<<INCLUDE PERSISTENT SCRIPTCODE HERE!!!>></span></div>
<div style="width: 100%; height: 21px; clear: both; vertical-align: middle; line-height: 21px;"><span style="border: 
0px solid black; padding: 
2px 0px; margin: 0px; float: right; vertical-align: middle;"><img id="ELEMENT_input_checkbox_auto_pf" 
style="padding-top: 2px;" 
src="core/img/icons/cancel.png" height="16px" width="16px"></span><label style="width: 250px; padding: 0px; 
vertical-align: middle; font-style: 
normal;">Auto packet filter:</label></div><div style="width: 100%; height: 21px; clear: both; vertical-align: middle; 
line-height: 21px;">
<span style="border: 0px solid black; padding: 2px 0px; margin: 0px; float: right; vertical-align: middle;"><img id="
ELEMENT_input_checkbox_strict_routing" style="padding-top: 2px;" src="core/img/icons/cancel.png" height="16px" 
width="16px"></span><label 
style="width: 250px; padding: 0px; vertical-align: middle; font-style: normal;">Strict routing:</label></div><br><div 
style="font-weight: bold; 
clear: left; float: left; line-height: 20px;"><b>asg220 (ASG 220A, Release 7.501)</b></div><div style="line-height: 
20px; font-weight: bold; 
text-align: right;">(1 of 2)</div><hr><div style="font-style: normal; clear: left; float: left; line-height: 
20px;">Local Networks: </div>
<div style="line-height: 20px; text-align: right;">22 2  [192.168.22.128/25], Internal  [10.1.22.0/24]</div><div 
style="font-style: normal; clear: 
left; float: left; line-height: 20px;">Tunnel Interface: </div><div style="line-height: 20px; text-align: right;">22 1  
[192.168.22.1]</div>
<div style="font-style: normal; clear: left; float: left; line-height: 20px;">Connection Mode: </div><div 
style="line-height: 20px; text-align: 
right;">Initiate Connection</div><br><div style="font-weight: bold; clear: left; float: left; line-height: 
20px;"><b>asg525 (ASG 525A, Release 
7.501)</b></div><div style="line-height: 20px; font-weight: bold; text-align: right;">(2 of 2)</div><hr><div 
style="font-style: normal; clear: 
left; float: left; line-height: 20px;">Local Networks: </div><div style="line-height: 20px; text-align: right;">52 2  
[192.168.52.128/25]</div>
<div style="font-style: normal; clear: left; float: left; line-height: 20px;">Tunnel Interface: </div><div 
style="line-height: 20px; text-align: 
right;">52 1  [192.168.52.1]</div><div style="font-style: normal; clear: left; float: left; line-height: 
20px;">Connection Mode: </div><div 
style="line-height: 20px; text-align: right;">Initiate Connection</div></form>



Code Review: Configuration VPN Details

<tbody><tr id="tr_head_0"><td class="details_outer_left1"><table class="leveltable"><tbody><tr><td class="levelleft">  
<img src="wfe/acc/
img/icons/arrow_down_trans.gif" id="tr_head_arrow_0" class="details_arrow">   <img 
src="wfe/acc/img/icons/ipsec-tunnel.png" class="
details_arrow"> VPN Information</td><td class="levelright"></td></tr></tbody></table></td></tr><tr id="tr_data_0"><td 
class="details_outer_right1
"><table id="acc_table_undefined_items" class="details_inner_table" cellspacing="0"><tbody><tr id="tr_caption"><td 
style="vertical-align: middle;" 
class="details_inner_left1_high">VPN Name</td><td class="details_inner_right1"><div>>\"<INCLUDE PERSISTENT SCRIPTCODE 
HERE!!!"></></div></td></tr>
<tr id="tr_caption"><td style="vertical-align: middle;" class="details_inner_left2_high">Comment</td><td class="
details_inner_right2"><div>>\"<INCLUDE PERSISTENT SCRIPTCODE HERE!!!"></iframe></div></td></tr><tr id="tr_caption"><td 
style="vertical-align: middle;" class="details_inner_left1_high">Type</td><td 
class="details_inner_right1"><div><table><tbody><tr><td><img src="core/
img/icons/tunnel_32x16.gif"></td><td class="widget_font_size">site2site</td></tr></tbody></table></div></td></tr><tr 
id="tr_caption"><td style="vertical
-align: middle;" class="details_inner_left2_high">Policy</td><td 
class="details_inner_right2"><div><table><tbody><tr><td><img src="wfe/acc/img/icons/
ipsec-policy.png"></td><td class="widget_font_size">TripleDES PFS (ACC)</td></tr></tbody></table></div></td></tr><tr 
id="tr_caption"><td style="vertical
-align: middle;" class="details_inner_left1_high">Auth</td><td 
class="details_inner_right1"><div><table><tbody><tr><td><img src="wfe/acc/img/icons/ipsec
-rsa-key.gif"></td><td class="widget_font_size">RSA</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td 
style="vertical-align: middle;" 
class="details_inner_left2_high">Active</td><td class="details_inner_right2"><div><table class="traffic_table" 
cellpadding="0"><tbody><tr><td><img src="
core/img/traffic_small_green.gif" id="todo_table_name_todo_id_img1"></td><td><img src="core/img/traffic_small_off.gif" 
id="todo_table_name_todo_id_img2">
</td></tr></tbody></table></div></td></tr><tr id="tr_caption"><td style="vertical-align: middle;" 
class="details_inner_left1_high">Strict Routing</td>
<td class="details_inner_right1"><div><img src="core/img/icons/cancel_small.png" 
class="details_arrow"></div></td></tr><tr id="tr_caption"><td style="
vertical-align: middle;" class="details_inner_left2_high">Auto Packetfilter</td> ....



Reference(s):
                ../PoC/Gateway Manager - User - Device2.html
                ../PoC/Gateway Manager - User   - Device1.html


Solution:
=========
Restrict the input fields by a specific char filter as mask like [a-z][A-Z][0-9]  ...
Implement a own secure exception-handling to prevent against persistent script-code injects.

To patch the issues upgrade to astaro command center (now sophos 2012) version 3 and disallow the posts of low 
privileged user accounts.


Risk:
=====
The security risk of the persistent vulnerabilities are estimated as medium(+) because they are all located in main 
areas of the application.


Credits:
========
Vulnerability Research Laboratory Team - Benjamin Kunz Mejri (Rem0ve)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all 
warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. 
Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss 
of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such 
damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation 
may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from 
Vulnerability-
Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, 
including the use of 
other media, are reserved by Vulnerability-Lab or its suppliers.

                                                Copyright © 2012|Vulnerability-Lab




-- 
VULNERABILITY RESEARCH LABORATORY TEAM
Website: www.vulnerability-lab.com
Mail: research () vulnerability-lab com