Title: ====== Astaro Command Center v2.x - Multiple Web Vulnerabilities Date: ===== 2012-04-03 References: =========== http://www.vulnerability-lab.com/get_content.php?id=4 VL-ID: ===== 4 Introduction: ============= We are pleased to announce the General Availability of the Astaro Command Center Version 2.0. This new version introduces the major new ability to configure and manage IPSEC tunnels entirely within ACC itself. By providing a centralized location from which to work with and deploy VPN tunnels between Astaro installations, administrators can save management time and automate many of the tasks involved in successfully linking sites together with encrypted links. The Astaro Command Center is an entirely free product that allows you to centrally monitor and maintain multiple Astaro installations & devices. If you currently are responsible for more than one Astaro Gateway product, ACC is designed for you! Read on for more information. Starting with this release, it is now possible to setup site-to-site VPN tunnels with an amazing degree of ease from within Astaro Command Center itself. Simply indicate the devices to be joined together via VPN, select a few options, and the rest is automated with no need to login to each individual WebAdmin for the configuration. ACC is presented in the same administrative style as our AxG Version 7 WebAdmin, so that if you are new to ACC you will have no trouble getting started within a familiar looking environment. (Copy from vendors homepage: http://up2date.astaro.com/2009/03/astaro_comand_center_20_releas.html#more) Abstract: ========= Vulnerability-Lab Team discovers multiple Input Validation Vulnerabilities on Astaros Command Center Application v2.x Report-Timeline: ================ 2011-01-12: Verified by Vulnerability-Lab 2011-06-15: Secure Vendor Notification 2011-06-17: Vendor Reply/Feedback 2012-03-22: Vendor Fix/Patch Disclosure by Check 2012-04-03: Discovery by Vulnerability-Lab Status: ======== Published Affected Products: ================== Exploitation-Technique: ======================= Remote Severity: ========= High Details: ======== Multiple persistent input validation vulnerabilities are detected in Astaro Command Center v2.x. The bugs allows an local privileged attackers to implement/inject malicious script code on the application side (persistent). Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context manipulation. Exploitation requires user inter action & minimum restricted access to the panel. Vulnerable Module(s): [+] Configuration - Networks Definition [+] Deploy Function [+] Summary [+] VPN Information/ Configuration VPN Details [+] Management - Organizational Units Proof of Concept: ================= This vulnerabilities can be exploited local(persistent) by low privileged user accounts or by user inter-action (remote) via request force ... Code Review: Networks Definition
>" 10.129.11.11
Astaro AG
0000
Code Review: Deploy Functions
>"<>
Code Review: Summery Repaste
Summary

This is a summary of the resulting VPN configuration. Please review it carefully and go back to the previous pages to perform any changes if needed. When finished, please press the Next button to start deploying the configuration to the respective devices.

General information
Name:
>"
Type:
Site-2-Site
Policy:
TripleDES PFS (ACC)
Authentication:
RSA key
>"<>

asg220 (ASG 220A, Release 7.501)
(1 of 2)
Local Networks:
22 2 [192.168.22.128/25], Internal [10.1.22.0/24]
Tunnel Interface:
22 1 [192.168.22.1]
Connection Mode:
Initiate Connection

asg525 (ASG 525A, Release 7.501)
(2 of 2)
Local Networks:
52 2 [192.168.52.128/25]
Tunnel Interface:
52 1 [192.168.52.1]
Connection Mode:
Initiate Connection
Code Review: Configuration VPN Details
VPN Information
.... Reference(s): ../PoC/Gateway Manager - User - Device2.html ../PoC/Gateway Manager - User - Device1.html Solution: ========= Restrict the input fields by a specific char filter as mask like [a-z][A-Z][0-9] ... Implement a own secure exception-handling to prevent against persistent script-code injects. To patch the issues upgrade to astaro command center (now sophos 2012) version 3 and disallow the posts of low privileged user accounts. Risk: ===== The security risk of the persistent vulnerabilities are estimated as medium(+) because they are all located in main areas of the application. Credits: ======== Vulnerability Research Laboratory Team - Benjamin Kunz Mejri (Rem0ve) Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability- Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab or its suppliers. Copyright © 2012|Vulnerability-Lab -- VULNERABILITY RESEARCH LABORATORY TEAM Website: www.vulnerability-lab.com Mail: research@vulnerability-lab.com
VPN Name
>\"
Comment
>\"
Type
site2site
Policy
TripleDES PFS (ACC)
Auth
RSA
Active
Strict Routing
Auto Packetfilter