Exploit-DB #30054
Description: SonicWALL Gms 7.x - Filter Bypass / Persistent
Type: webapps
Platform: jsp
Date: 2013-12-05
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1099

Bulletin: Dell SonicWALL GMS Service Bulletin for Cross-Site Scripting Vulnerability
http://www.sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_Hotfix_134235.pdf


Release Date:
=============
2013-12-05


Vulnerability Laboratory ID (VL-ID):
====================================
1099


Common Vulnerability Scoring System:
====================================
4.1


Product & Service Introduction:
===============================
Dell SonicWALL`s management and reporting solutions provide a comprehensive architecture for centrally creating and managing 
security policies, providing real-time monitoring and alerts, and delivering intuitive compliance and usage reports, all from 
a single management interface. Whether your organization is a small- or medium-sized business, a distributed enterprise or a 
managed service provider, Dell™ SonicWALL™ offers software and appliance solutions to meet its needs.

The award-winning Dell SonicWALL Global Management System (GMS®) provides organizations, distributed enterprises and service 
providers with a flexible, powerful and intuitive solution to centrally manage and rapidly deploy SonicWALL firewall, anti-spam, 
backup and recovery, and secure remote access solutions. Flexibly deployed as software, hardware—in the form of the Universal 
Management Appliance (UMA)—or a virtual appliance, SonicWALL GMS also provides centralized real-time monitoring and comprehensive 
policy and compliance reporting to drive down the cost of owning and managing SonicWALL security appliances.  Multiple GMS 
software, hardware, and virtual appliance agents, when deployed in a cluster, can scale to manage thousands of SonicWALL 
security appliances. This makes GMS an ideal solution for small- to medium-sized businesses, enterprises and managed service 
providers that have either single-site or distributed multi-site environments.

(Copy of the Vendor Homepage: http://www.sonicwall.com/emea/en/products/Centralized_Management_Reporting.html )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a persistent validation vulnerability in the DELL SonicWall GMS v7.1.x Appliance Web-Application.


Vulnerability Disclosure Timeline:
==================================
2013-09-26:	Researcher Notification & Coordination (Benjamin Kunz Mejri)
2013-09-27:	Vendor Notification (DELL SonicWall Security Team)
2013-10-09:	Vendor Response/Feedback (DELL SonicWall Security Team)
2013-12-04:	Vendor Fix/Patch ( DELL SonicWall Developer Team)
2013-12-05:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
DELL SonicWall
Product: GMS Networks Appliance Application 7.1


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
A persistent input validation web vulnerability has been discovered in the official DELL SonicWall GMS v7.1.x Appliance Web-Application.
The bug allows an attacker (remote) to implement/inject own malicious malicious script codes on the application-side (persistent).

The persistent vulnerability is located in the `valfield_1` & `value_1` value parameters of the `Alert Settings` module POST method request.
Remote attackers with low privileged application user account can inject own script codes to the POST method request of the createNewThreshold.jsp 
appliance application file. After the inject the attacker is able to update and save the values to continue with the execute the main alert 
settings module. The execute of the script code occurs in the ematStaticAlertTypes.jsp file context by the earlier manipulated vulnerable values.

To bypass the filter it is required to split the request by attaching a double frame for the script code execute. The restricted application itself 
disallows the POST request of guest by usage of the unrestricted context POST method request attackers are able to bypass the filter & exception-handling.

The security risk of the persistent input validation web vulnerability is estimated as high(-) with a cvss (common vulnerability scoring system) 
count of 4.1(+). The coordinated disclosure procedure of the remote vulnerability has been navigated by the product manager Wilson Lee (DELL). 
The hotfix and information has been provided in cooperation with the vulnerability-laboratory.

Exploitation of the persistent web vulnerability requires low user interaction and a local low privileged (guest) web application user account. 
Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via persistent web attacks, 
persistent phishing or persistent manipulation of vulnerable module context.

Vulnerable Application(s):
				[+] DELL - SonicWall GMS v7.1.x Appliance Application

Vulnerable Module(s):
				[+] Alert Settings > NewThreshold

Vulnerable File(s):
				[+] createNewThreshold.jsp > ematStaticAlertTypes.jsp

Vulnerable Parameter(s):
				[+] valfield_1
				[+] value_1

Affected Module(s):
				[+] createNewThreshold
				[+] ematStaticAlertTypes
				[+] Alert Settings - Main Listing

Affected Product(s):
				[+] Dell SonicWALL GMS
				[+] Dell SonicWALL Analyzer
				[+] Dell SonicWALL UMA E5000


Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by remote attackers with low privileged or restricted guest accounts and 
low user interaction. For security demonstration or reproduce the vulnerability follow the information and steps below.


L