Exploit-DB #27136
Description: Symantec Web Gateway 5.1.0.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-07-27
Author: SEC Consult

Exploit:
SEC Consult Vulnerability Lab Security Advisory < 20130726-0 >
=======================================================================
              title: Multiple vulnerabilities - Surveillance via Symantec Web
                     Gateway 
            product: Symantec Web Gateway
 vulnerable version: <= 5.1.0.*
      fixed version: 5.1.1
         CVE number: CVE-2013-1616, CVE-2013-1617, CVE-2013-4670, 
                     CVE-2013-4671, CVE-2013-4672
             impact: Critical
           homepage: https://www.symantec.com/
              found: 2012-12-18
                 by: Wolfgang Ettlinger
                     SEC Consult Vulnerability Lab 
                     https://www.sec-consult.com
=======================================================================

Vendor/product description:
-----------------------------
"Symantec Web Gateway protects organizations against multiple types of Web-borne
malware and gives organizations the flexibility of deploying it as either a 
virtual appliance or on physical hardware. Powered by Insight, Symantec’s 
innovative reputation based malware filtering technology, Web Gateway relies on 
a global network of greater than 210 million systems to identify new threats 
before they cause disruption in organizations."

URL: https://www.symantec.com/web-gateway


Business recommendation:
------------------------
SEC Consult has identified several vulnerabilities within the components of
Symantec Web Gateway in the course of a short crash test. Some components have
been spot-checked, while others have not been tested at all.

Several of the discovered vulnerabilities below can be chained together in
order to run arbitrary commands with the privileges of the "root" user on the
appliance.

An attacker can get unauthorized access to the appliance and plant backdoors or
access configuration files containing credentials for other systems (eg. Active
Directory/LDAP credentials) which can be used in further attacks.
Since all web traffic passes through the appliance, interception of HTTP as
well as the plaintext form of HTTPS traffic (if SSL Deep Inspection feature in
use), including sensitive information like passwords and session cookies is
possible.

If SSL Deep Inspection is enabled, the appliance holds a private key for a
Certificate Authority (CA) certificate that is installed/trusted on all
workstations in the company. If this private key is compromised by an attacker,
arbitrary certificates can be signed. These certificates will then pass
validation on the client machines, enabling in various attacks targeting
clients (further MITM attacks, phishing, evilgrade, ...).

The recommendation of SEC Consult is to switch off the product until a
comprehensive security audit based on a security source code review has been
performed and all identified security deficiencies have been resolved by the
vendor.


Vulnerability overview/description:
-----------------------------------
1) Reflected Cross Site Scripting (XSS) (CVE-2013-4670)
A reflected cross site scripting vulnerability was found. This allows
effective session hijacking attacks of administrator session cookies. 


2) Persistent Cross Site Scripting (XSS) (CVE-2013-4670)
Moreover a persistent cross site scripting vulnerability allows an 
unauthenticated user to inject script code into the administration interface.
This script code will be executed once an administrator visits the
administration interface.


3) OS Command Injection (CVE-2013-1616)
Multiple OS command injection vulnerabilities were discovered. Authenticated
users can execute arbitrary commands on the underlying operating system with
the privileges of the "apache" operating system user.

This can be used to get persistent access to the affected system (eg. by
planting backdoors), accessing all kinds of locally stored information or
interception of web traffic that passes through the appliance.


4) Security Misconfiguration (CVE-2013-4672)
Unprivileged operating system users (eg. apache) can gain root privileges
due to a misconfiguration of the sudo program.


5) SQL Injection (CVE-2013-1617)
Several SQL injection vulnerabilities were identified that allow an 
authenticated administrator to issue manipulated SQL commands.


6) Cross Site Request Forgery (CVE-2013-4671)
The cross site request forgery protection implemented can be bypassed easily.
Using this vulnerability, an attacker can issue requests in the context of
administrative user sessions.


Several of the vulnerabilities above can be chained together by an
unauthenticated attacker in order to run arbitrary commands with the
privileges of the "root" operating system user on the appliance.


Proof of concept:
-----------------
1) Reflected Cross Site Scripting (XSS) (CVE-2013-4670)
The following URL demonstrates a reflected cross site scripting vulnerability:

https://<host>/spywall/feedback_report.php?rpp=0%27%20onfocus=%22alert%28%27xss%27%29%22%20autofocus/%3E


2) Persistent Cross Site Scripting (XSS) (CVE-2013-4670)
The "blocked.php" page which is accessible without authentication allows to
inject script code to the "Blocking Feedback" functionality on the 
administration interface. The following URL demonstrates this issue. The
payload of the parameter "u" will be stored permanently:

https://<host>/spywall/blocked.php?id=1&history=-2&u=%27/%3E%3Cscript%3Ealert%28%27xss%27%29;%3C/script%3E


3) OS Command Injection (CVE-2013-1616)
The functionality to change the hostname as well as the "Test Ping" 
functionality allow to inject commands enclosed in backticks (`). These commands
are run as the system user "apache".
Affected scripts: /spywall/nameConfig.php
                  /spywall/networkConfig.php

Detailed proof of concept exploits have beem removed for this vulnerability.


4) Security Misconfiguration (CVE-2013-4672)
The /etc/sudoers