pfSense 2.3.1-RELEASE-p1 Squid 0.4.16_2 XSS / Log Manipulation
Posted on 18 June 2016
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I. VULNERABILITY - ------------------------- Multiple vulnerabilities in squid 0.4.16_2 running on pfSense Version 2.3.1-RELEASE-p1 II. BACKGROUND - ------------------------- The pfSense project is a free network firewall distribution, based on the FreeBSD operating system, with a custom kernel and an array of third-party free software packages that can be installed for additional functionality. Through this package system pfSense software is able to provide most of the functionality of common commercial firewalls, and many times more. III. DESCRIPTION - ------------------------- In pfSense, it is possible to configure a third-party package, Squid, to act as a transparent HTTP proxy. This package uses clamd as an AV solution. If clamd detects a piece of malware in one of the proxied requests, the request is blocked and the user is redirected to the following URL instead: https://10.10.10.1/squid_clwarn.php?url=http://www.eicar.org/download/eicar.com&source=10.10.10.100&user=-&virus=stream:%20Eicar-TestSignature%20FOUND Upon inspection of the source code of the Squid package, the file "squid_clwarn.php" appears to contain several vulnerabilities. At the start of the file we see that various HTTP GET parameters are loaded into local variables through the $_REQUEST superglobal: ========================================================================== $url = $_REQUEST['url']; $virus = ($_REQUEST['virus'] ? $_REQUEST['virus'] : $_REQUEST['malware']); $source = preg_replace("@/-@", "", $_REQUEST['source']); $user = $_REQUEST['user']; ========================================================================== These variables are later rendered directly into HTML output, without any form of escaping, thus resulting in a reflected XSS vulnerability. Proof of Concept: https://10.10.10.1/squid_clwarn.php?url=xyz&source=xyz&user=&virus=stream:<script>alert('xss')</script> The information sent in this HTTP GET request is also saved to a log file: ========================================================================== error_log(date("Y-m-d H:i:s") . " | VIRUS FOUND | " . $virus . " | " . $url . " | " . $source . " | " . $user . " ", 3, "/var/log/c-icap/virus.log"); ========================================================================== An administrator who looks at the logs through the pfSense web-GUI, at "squid-monitor.php", will be open to a stored XSS vulnerability, because the variables are rendered directly into HTML output, without proper escaping: Finally, there is no authentication present in the "squid_clwarn.php" file, resulting in possible log manipulation attacks. For example, requesting the following URL will result in an empty log entry being added. Proof of Concept: https://10.10.10.1/squid_clwarn.php?url=%0A||||| IV. BUSINESS IMPACT - ------------------------- An attacker can execute arbitrary JavaScript code in a targeted user's browser, as well as any administrators viewing the log files through the pfSense web-GUI. V. SYSTEMS AFFECTED - ------------------------- Tested on: 2.3.1-RELEASE-p1 (amd64) built on Wed May 25 14:53:06 CDT 2016 FreeBSD 10.3-RELEASE-p3 With: squid 0.4.16_2 VI. SOLUTION - ------------------------- Upgrade squid to version 0.4.18. VII. REVISION HISTORY - ------------------------- June 10, 2016: Initial release VIII. DISCLOSURE TIMELINE - ------------------------- June 7, 2016: Vulnerability discovered by Remco Sprooten June 7, 2016: Contacted vendor June 7, 2016: Vendor confirmed the vulnerability June 7, 2016: Vendor fixed the XSS vulnerabilities June 8, 2016: Vendor updated to fix to prevent false log entries June 16, 2016: Vendor released a SA: https://www.pfsense.org/security/advisories/pfSense-SA-16_06.squid.asc June 17, 2016: Sent to lists IX. REFERENCES - ------------------------- Devel (pfSense 2.4 packages): https://github.com/pfsense/FreeBSD-ports/commit/e99ba5ea416690285a4ab3e094c4b2c0fb20c735 https://github.com/pfsense/FreeBSD-ports/commit/442b7dd6b6e3ff8976f88ab1f168d365cdebe520 RELENG_2_3_1 (pfSense 2.3.1_x packages): https://github.com/pfsense/FreeBSD-ports/commit/e2a02e3773f33d0bd9f450ffb0d9cfd7215791b8 https://github.com/pfsense/FreeBSD-ports/commit/408eb385c5696a271945226bb10c77dc2231793c RELENG_2_3 (pfsense 2.3.2 packages): https://github.com/pfsense/FreeBSD-ports/commit/90bcaee8d8315e4026e2afed2ea7c6fdd55ffd20 https://github.com/pfsense/FreeBSD-ports/commit/d581d14a7a88027655719c8ad3f9bed7c2f7585f RELENG_2_3_0 (pfSense 2.3_x packages): https://github.com/pfsense/FreeBSD-ports/commit/e82ef1c5b43ab4fd1117966d0de881655958f1f3 https://github.com/pfsense/FreeBSD-ports/commit/b301844cadcb2887c788be38eadc9b50ea5b8d52 X. LEGAL NOTICES - ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. XI. ABOUT - ------------------------- Remco Sprooten Security Consultant -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJXYzAjAAoJEMAbBFdxLTwF2jUQAKAtkzMaeK0svql8mWx4dcyC CJaNe1tiYfjl9tIv7ywSFzGh3Bq7WdcxiOVgDEj+0Co5+H8B2+EslezJg6636BMP svOq57xpEo7qMqnnRGpJAI1Ytyky+nUI+aSr472vuuwEFiXg7rmJx2UsfFPcoQDG YgfUtLwrYdkLatq5RBX38Q3I6KWHFNgflcp7RHvbi+3/CcOYzBkYhoQRm7faZIgN n74ymI2+PFq3pvhLnOLRtKLftVro5n0XmK/ADFVIcC7Mw1gOalvREkCi0He8dYoE mdr9oPNESKFcVadFgrJiO/KTdcc+DwYuU+p+yYF7pMGvLLEGUQJPdIcfd2n5AS1D 4Y8kdmIOJPmzCWsWJ8LZRu/kLy3H/jaDZlBkhOElbQk2Z+h0KxeCNDeatxtopGpn jizuDqrhTrBw3prQRWn/zvCeuuA/EFtVrMFcL0k04ilHa+543m9abXshKQss8S89 eUvsDQNgz4hWPw46Ptp2NBpUwyrci2QW8mZG1iKvjrycW7GVN80dfs+sdf5EcJuX DYJQ7qAyIDnUBOQgcEvzRnn+oD7JlvCqFhKfASlK8S9BlzSD9qAJydh8sfliaH0r LnUOJd3ucBqM5OrscHPnrMD7siXsy54ZEMiAVZP/D6H29uNL1QmEN/fr4uUjpaZC N1qM2bqWy4u471A2GKN8 =ih9y -----END PGP SIGNATURE-----
