Again, Cisco released security advisories for their software-defined networking
(SDN) solution called Application Centric Infrastructure (ACI). As before (see
blog post
here),
the published advisories originated from research performed in our ACI lab.
Recently, we identified security issues in the Nexus Repository Manager software
developed by Sonatype. The tested versions were OSS 3.12.1-01 and OSS 3.13.1-01.
We identified a Java Expression Language Injection in the role and user creation
function. In order to exploit this issue, the attacker needs to be authenticated
with high privileges, the standard anonymous user is not sufficient.
IoT is everywhere right now and there are a lot of products out there. I have
been looking at an IP Gateway lately and found some serious issues. The
Busch-Welcome IP-Gateway from Busch-Jaeger
is one of the devices that bridges the gap between sensors and actors in your
smart home and the network/Internet. It enables the communication to a door
control system that implements various smart home functions. The device itself
is offering an HTTP service to configure it, which is protected by a username
and password. Some folks even actually expose the device and its login to the
Internet. I tried to configure one of these lately and stumbled upon some
security issues that I would like to discuss in this blog post.
During a recent customer project we identified several vulnerabilities in the
VMware vRealize Automation Center such as a DOM-based cross-site scripting and a
missing renewal of session tokens during the login. The vulnerabilities have
been disclosed to VMware on November 20th, 2017. A security advisory for the
vulnerabilities has been made available
here on April
12th, 2018.
Just a few words regarding the cross-site scripting vulnerability. This
vulnerability is present within a GET request to the URL /vcac/gadgets/ifr
because of certain URL parameters whose values are directly passed to an eval
function call. The vulnerable parameters are gwt:onLoadErrorFn and
gwt:onPropertyErrorFn. It seems that these parameters are actually never used
by the application and we only found them by looking at the source code.
After seeing
Christopher’s post I
decided to create a proof using GNS3 and Virtualbox.
The aim is to perform the exact attacking using Antonios Atlasis’
Chiron tools and run a Wireshark packet
capture to prove the hop limit drops below 255.
The following topology is used in GNS3:
The
routers used are Cisco C372 and the machine labled Ubuntu is running 14.04 LTS
Ubuntu Desktop, default installation. F0/0 is on the right and F0/1 is on the
left.
Jenkins is a continuous integration server, widely
used in Java environments for building automation and deployment. The project
recently disclosed an unauthenticated remote code execution vulnerability
discovered by Moritz Bechler. Depending on the development environment, a
Jenkins server can be a critical part of the infrastructure: It often creates
the application packages that later will be deployed on production application
servers. If an attacker can execute arbitrary code, s/he can easily manipulate
those packages and inject additional code. Another scenario would be that the
attacker stealing credentials, like passwords, private keys that are used for
authentication in the deployment process or similar.
On the 8th of March SAP released the security note for a vulnerability we
reported during an assessment of a SAP landscape. The issue affects the SAP
NetWeaver Web Administration Interface. By knowing a special URL a malicious
user can acquire version information about the services enabled in the SAP
system as well as the operating system used. We wanted to share some details on
the issue.
The vulnerability is a bypass of the HTTP Basic Authorization for the
SAP Web Administration Interface.
It discloses version information about the system respectively operating system,
a brief SAP patch level overview and running services including their
corresponding ports.
As you may have already noticed, Cisco released an urgent
security advisory
describing an IPv6 Neighbor Discovery DoS Vulnerability in several flavors of
Cisco’s operating systems. Currently IOS-XR, XE and NX-OS are affected while ASA
and “classic” IOS are under investigation. At first glance, it might look like
yet another IPv6 DoS vulnerability. Looking closer, Cisco is mentioning an
unauthenticated, remote attacker due to insufficient processing logic for
crafted IPv6 NDP packets that are sent to an affected device. Following the
public discussion about the vulnerability, it seems that these packets will
reach the, probably low rate-limited,
LPTS filter/queue
on IOS XR devices “crowding” out legitimate NDP packets resulting in a DoS for
IPv6 traffic, or in general a high CPU load as these packets will be processed
by the CPU. More details are currently not available, but this might indicate
the affected systems aren’t doing proper message validation checks on NDP
packets (in addition to the LPTS filter/queue problem).
Yesterday the US-CERT released a
Technical Alert (TA16-144A)
about the recently found WPAD Name Collision Vulnerability. We will give you a
summary about the vulnerability as well as the basic mechanisms here.
WPAD
The Web Proxy Auto-Discovery Protocol is used to auto-configure the proxy for
web browsers. So when joining the according network the browser can use DHCP and
DNS methods to find a specific configuration file (typically named wpad.dat),
which is loaded and applied to the browser’s settings. Therefore, there is no
need to configure each browser in your environment individually/manually.
The
routers used are Cisco C372 and the machine labled Ubuntu is running 14.04 LTS
Ubuntu Desktop, default installation. F0/0 is on the right and F0/1 is on the
left.