Skip to main content

Armorlogic Profense WAF: multiple vulnerabilities

Published on May 13, 2009 in , , , ,

An advisory by EnableSecurity. Trustwave published a joint advisory named TWSL2009-001.

Description

Armorlogic Profense is a Web Application Firewall and load balancing solution.

From their website (armorlogic.com):

“Protecting and securing websites and web applications can be a complicated business. Profense web application firewall simplifies protection with an affordable and easy to use, feature rich, solution that gives you full PCI DSS 1.1 and 1.2 section 6.6 compliance.”

Credits

These vulnerabilities were discovered during WAF testing by Sandro Gauci of EnableSecurity and Wendel Guglielmetti Henrique of Trustwave’s SpiderLabs. We worked with the Armorlogic security team to have these security flaws reported and fixed. We would like to publicly thank the Armorlogic team for their prompt response!

Technical details

The following vulnerabilities were identified:

Major issues:

  • Whitelist / positive model bypass
  • Blacklist / negative model bypass

Other issues:

  • Static root password exposes administrative interface

Whitelist / positive model bypass

CVE: CVE-2009-1594

Profense Web Application Firewall configured in positive model can be evaded.

Profense Web Application Firewall configured to make use of the strong positive model (white-list approach) can be evaded to launch various attacks including XSS (Cross-Site Scripting), SQL Injection, remote command execution, and others.

The vulnerability can be reproduced by making use of a URL-encoded new line character. The pattern matching in multi line mode matches any non-hostile line and marks the whole request as legitimate, thus allowing the request. This results in a bypass in the positive model. An example is shown below:

http://testcases/phptest/xss.php?var=%3CEvil%20script%20goes%20here%3E=%0AByPass

Blacklist / negative model bypass

CVE: CVE-2009-1593

Profense Web Application Firewall with default configuration in negative model can be evaded to inject XSS.

Versions 2.4 and 2.2 of Profense Web Application Firewall with the default configuration in negative model (blacklist approach) can be evaded to inject XSS (Cross-Site Scripting). The problem is due to the built-in core rules that can be abused using the flexibility provided by HTML and JavaScript.

The vulnerability can be reproduced by injecting a common XSS attack in a vulnerable application protected by Profense Web Application Firewall. Inserting extra characters in the JavaScript close tag will bypass the XSS protection mechanisms. An example is shown below:

http://testcases/phptest/xss.php?var=%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E

Static root password exposes administrative interface

Versions 2.4 and 2.2 of Profense Web Application Firewall with the default configuration have a default password hash that is the same in all available products. The SSH server is enabled by default on the administrative interface and accepts root authentication using user and password credential. The hashing algorithm used is OpenBSD’s blowfish password hash which is known to be strong. However the existence of a static password means that if this password is leaked in some way or another, then the attacker potentially has access to all exposed administrative interfaces.

Timeline

  • Oct 10, 2008: Initial contact
  • Oct 10, 2008: Confirmation of the vulnerabilities
  • Oct 11, 2008: Discussion of possible fixes
  • Oct 13, 2008: Fix from Armorlogic complete
  • Oct 14, 2008: Fix issued to customers
  • May 13, 2009: Advisory public release

Solution

Upgrade to the latest version of Profense: http://www.armorlogic.com/

Exploit code available to organizations by contacting info@enablesecurity.com

Disclaimer

The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.