mailing list archives
Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability (0Day)
From: Vulnerability Lab <research () vulnerability-lab com>
Date: Thu, 05 Dec 2013 14:00:08 +0100
Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability
Bulletin: Dell SonicWALL GMS Service Bulletin for Cross-Site Scripting Vulnerability
Vulnerability Laboratory ID (VL-ID):
Common Vulnerability Scoring System:
Product & Service Introduction:
Dell SonicWALL`s management and reporting solutions provide a comprehensive architecture for centrally creating and
security policies, providing real-time monitoring and alerts, and delivering intuitive compliance and usage reports,
a single management interface. Whether your organization is a small- or medium-sized business, a distributed enterprise
managed service provider, Dell™ SonicWALL™ offers software and appliance solutions to meet its needs.
The award-winning Dell SonicWALL Global Management System (GMS®) provides organizations, distributed enterprises and
providers with a flexible, powerful and intuitive solution to centrally manage and rapidly deploy SonicWALL firewall,
backup and recovery, and secure remote access solutions. Flexibly deployed as software, hardware—in the form of the
Management Appliance (UMA)—or a virtual appliance, SonicWALL GMS also provides centralized real-time monitoring and
policy and compliance reporting to drive down the cost of owning and managing SonicWALL security appliances. Multiple
software, hardware, and virtual appliance agents, when deployed in a cluster, can scale to manage thousands of
security appliances. This makes GMS an ideal solution for small- to medium-sized businesses, enterprises and managed
providers that have either single-site or distributed multi-site environments.
(Copy of the Vendor Homepage: http://www.sonicwall.com/emea/en/products/Centralized_Management_Reporting.html )
Abstract Advisory Information:
The Vulnerability Laboratory Research Team discovered a persistent validation vulnerability in the DELL SonicWall GMS
v7.1.x Appliance Web-Application.
Vulnerability Disclosure Timeline:
2013-09-26: Researcher Notification & Coordination (Benjamin Kunz Mejri)
2013-09-27: Vendor Notification (DELL SonicWall Security Team)
2013-10-09: Vendor Response/Feedback (DELL SonicWall Security Team)
2013-12-04: Vendor Fix/Patch ( DELL SonicWall Developer Team)
2013-12-05: Public Disclosure (Vulnerability Laboratory)
Product: GMS Networks Appliance Application 7.1
Technical Details & Description:
A persistent input validation web vulnerability has been discovered in the official DELL SonicWall GMS v7.1.x Appliance
The bug allows an attacker (remote) to implement/inject own malicious malicious script codes on the application-side
The persistent vulnerability is located in the `valfield_1` & `value_1` value parameters of the `Alert Settings` module
POST method request.
Remote attackers with low privileged application user account can inject own script codes to the POST method request of
appliance application file. After the inject the attacker is able to update and save the values to continue with the
execute the main alert
settings module. The execute of the script code occurs in the ematStaticAlertTypes.jsp file context by the earlier
manipulated vulnerable values.
To bypass the filter it is required to split the request by attaching a double frame for the script code execute. The
restricted application itself
disallows the POST request of guest by usage of the unrestricted context POST method request attackers are able to
bypass the filter & exception-handling.
The security risk of the persistent input validation web vulnerability is estimated as high(-) with a cvss (common
vulnerability scoring system)
count of 4.1(+). The coordinated disclosure procedure of the remote vulnerability has been navigated by the product
manager Wilson Lee (DELL).
The hotfix and information has been provided in cooperation with the vulnerability-laboratory.
Exploitation of the persistent web vulnerability requires low user interaction and a local low privileged (guest) web
application user account.
Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), account steal via
persistent web attacks,
persistent phishing or persistent manipulation of vulnerable module context.
[+] DELL - SonicWall GMS v7.1.x Appliance Application
[+] Alert Settings > NewThreshold
[+] createNewThreshold.jsp > ematStaticAlertTypes.jsp
[+] Alert Settings - Main Listing
[+] Dell SonicWALL GMS
[+] Dell SonicWALL Analyzer
[+] Dell SonicWALL UMA E5000
Proof of Concept (PoC):
The persistent input validation web vulnerability can be exploited by remote attackers with low privileged or
restricted guest accounts and
low user interaction. For security demonstration or reproduce the vulnerability follow the information and steps below.
Location: Alert Settings
Inject via Add: Edit contents for alert type: Backed-Up Syslog Files
Execute: Create New Threshold
Manual steps to reproduce ...
1. Open the Sonicwall GMS appliance application and login with full restrictions as guest
2. Switch to the vulnerable Console > Events > Alert Settings section
3. Click Add Alert and a new blank window of the application will be opened
4. Click in the upcomings window in the Alert Types section the Edit Content link
5. Now, a new window opens "Edit contents for alert type: Backup Sys-Log Files
6. On top is a little plus button next to the Threshold value
9. A new window opens with Elements box ... Inject your payload (script code) to the description eval in the operator
10. After the inject to the input fields the attacker only needs to click the Add Element button on the buttom of the
11. The code will be directly executed and is persistent saved as element in the specific section
12. Save the input via update and go back to the alert settings main section were the code execute occurs in the same
13. Successful reproduced!
PoC: Alert Settings - Create New Threshold
Critical</option></select> </td><td class="tblData2" width="1">
<img src="Create%20New%20Threshold_files/1x1trans.gif"></td><td class="tblData2" align="center"
nowrap="nowrap"><input class="controlFont" name="disabled" value="1" type="checkbox"></td>
<td class="tblData2" width="1"><img src="Create%20New%20Threshold_files/1x1trans.gif"></td>
<td class="tblData2" align="center" nowrap="nowrap"><a href="#" onclick="deleteElement(1);">
<img src="Create%20New%20Threshold_files/trash.gif" alt="Delete this destination" border="0"></a></td>
<td class="tblData2" width="1"><img src="Create%20New%20Threshold_files/1x1trans.gif"></td></tr><tr><td></td>
<td class="tblData2" width="1"><img src="Create%20New%20Threshold_files/1x1trans.gif"></td><td colspan="5"
class="tblData2" align="left" nowrap="nowrap"> <font class="controlfont">Description: </font>
<input class="controlfont" size="64" name="description"
value="is equal to >" <[PERSISTENT INJECTED SCRIPT CODE!]" type="text"> >"<[PERSISTENT INJECTED SCRIPT CODE!]">"
Note: Please, feel free to read also the patch information provided in the solution section of the advisory document.
Solution - Fix & Patch:
The vulnerability can be patched by a secure parse, prevention filter mechanism or clean encode of the vulnerable
value_1 and valfield_1 parameters.
Also restrict and escape the affected input field and output listing in the connected modules.
Resolution (DELL SonicWall):
We recommend existing users of Dell SonicWALL GMS/Analyzer/UMA 7.1 to apply SP1 (if they have not already done so), and
then apply Hotfix 134235 to prevent cross-site scripting by unauthorized users. 7.1 SP1 and the Hotfix are available
for download from www.mysonicwall.com. Users should log into mySonicWALL and click on Downloads > Download Center in
the navigation panel on the left, then select “GMS/Analyzer” in the Software Type drop down menu.
The security risk of the persistent input validation web vulnerability with filter bypass is estimated as medium(+).
Credits & Authors:
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm () evolution-sec com) [www.vulnerability-lab.com]
Disclaimer & Information:
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all
either expressed or implied, including the warranties of merchantability and capability for a particular purpose.
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin () vulnerability-lab com - research () vulnerability-lab com - admin () evolution-sec
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com -
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab -
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php -
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the
use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code,
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record,
modify, use or edit our material contact (admin () vulnerability-lab com or research () vulnerability-lab com) to get a
Copyright © 2013 | Vulnerability Laboratory [Evolution Security]
VULNERABILITY LABORATORY RESEARCH TEAM
CONTACT: research () vulnerability-lab com
- Sonicwall GMS v7.x - Filter Bypass & Persistent Vulnerability (0Day) Vulnerability Lab (Dec 09)