Profense Web Application Firewall and Load Balancer multiple vulnerabilities

By YGN Ethical Hacker Group - 
Advisory

Joint Trustwave's SpiderLabs Security Advisory TWSL2009-001 and
EnableSecurity Advisory ES-20090500: Profense Web Application Firewall
and Load Balancer multiple vulnerabilities
Published: 2009-05-19 Version: 1.0


https://www.trustwave.com/spiderlabs/advisories/TWSL2009-001.txt




Analysis


We noted that researchers from Trustwave and EnableSecurity were able to bypass the protection of 
Profense Web Application Firewall.
The following words caught our attention:
  1. "Inserting extra characters in the JavaScript close tag" </script ByPass>)
  2. "pattern matching in multi line mode matches any non-hostile line and marks the whole request as legitimate. by making use of a URL-encoded new line character" (Logic Flaw)
Sample exploits that bypass the defense:


xss.php?var=abcdef%3Cembed%3Eaaaaaaa%3Cscript%3Ealert(document.cookie)%3C/script%20ByPass%3E
xss.php?var=%3CEvil%20script%20goes%20here%3E=%0AByPass
 
 
Check
  
It's necessary to test web application firewalls with various payloads by transforming existing known attack vectors into various encoding formats and forms.
It's not enough to try payloads straightly from available XSS Cheatsheets:
- http://ha.ckers.org/xss.html#XSS_Extraneous open brackets
- http://ha.ckers.org/xss.html#XSS_Embeded_newline
 


 

Comments

Post a Comment

Popular posts from this blog

Bypassing referrer check with no script involved

By YGN Ethical Hacker Group -
No more to use scripting approach like https://github.com/knu/noreferrer This useful meta tag helps for CSRF POC preparation when you come across an application that checks referrer header: <meta name="referrer" content="no-referrer"> https://caniuse.com/#feat=referrer-policy
Read more

Jumping out of Touch Screen Kiosks

By YGN Ethical Hacker Group -
Image
Background: Nowadays, the use of large touch screen kiosks has been prevalent.  They are to replace tradition paper-based brochures and to provide more interactive means to consumers. In restaurants, you can see a variety of food menu that can be accessible in large touch screen LCD monitor.  In your local Telcos, you can see a variety of mobile and Internet subscriptions plans.   Behind these touch screen menus are running standalone or browser-mode Adobe Flash applications which are second-to-none for interactivity and scalablity and ease of update. Data could be pulled from somewhere round their centralized web severs. Weakness: Jumping out We cannot use  iKat  at first as we do not have access to any keyboard facility. However, the trick is no-brainer. Do long press on any locations and relieve.  You should see the usual Flash context menu like: Touch "Global Settings".  A web browser window will pop up and redirect to the Adobe ...
Read more