Summaryinfo

A vulnerability has been found in Barracuda Firewall 6.1.0.016 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component User Access Policy Exceptions Page. This manipulation of the argument UPDATE_authen_cp_usernames with the input ateeq%20"><iframe onload=prompt(/PoC/) src=x></iframe> causes cross site scripting. The attack may be initiated remotely. In addition, an exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Barracuda Firewall 6.1.0.016 (Firewall Software). It has been declared as problematic. Affected by this vulnerability is an unknown part of the component User Access Policy Exceptions Page. The manipulation of the argument UPDATE_authen_cp_usernames with the input value ateeq%20"><iframe onload=prompt(/PoC/) src=x></iframe> leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect integrity.

The weakness was presented 02/26/2014 by Ateeq Khan with Vulnerability Lab as Barracuda Networks Bug Bounty #31 Firewall as confirmed advisory (Packetstorm). It is possible to read the advisory at packetstormsecurity.com. The public release was coordinated in cooperation with Barracuda. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details and also a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

A public exploit has been developed by Ateeq Khan and been published immediately after the advisory. It is possible to download the exploit at packetstormsecurity.com. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 137 days. During that time the estimated underground price was around $0-$5k.

Applying a patch is able to eliminate this problem. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (91497). See VDB-12467, VDB-12466 and VDB-12462 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Barracuda

Name

• Firewall

Version

• 6.1.0.016

License

• commercial

Website

• Vendor: https://www.barracuda.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion