Sophos Web Appliance 4.2.1.3 /index.php Password information disclosure

Summaryinfo

A vulnerability classified as problematic was found in Sophos Web Appliance 4.2.1.3. Affected is an unknown function of the file /index.php. Executing a manipulation can lead to information disclosure (Password). In addition, an exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Sophos Web Appliance 4.2.1.3. This vulnerability affects an unknown function of the file /index.php. The manipulation with an unknown input leads to a information disclosure vulnerability (Password). The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality.

The weakness was presented 11/04/2016 by Matt Bergin as KL-001-2016-008 : Sophos Web Appliance Privilege Escalation as confirmed mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The public release was coordinated in cooperation with the vendor. The attack can be initiated remotely. The successful exploitation requires a single authentication. Technical details and also a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1592. The advisory points out:

An unprivileged user can obtain an MD5 hash of the administrator password which can then be used to discover the plain-text password.

A public exploit has been developed by Matt Bergin in HTTP GET Request and been published immediately after the advisory. It is possible to download the exploit at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 34 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:index.php it is possible to find vulnerable targets with Google Hacking. The code used by the exploit is:

GET /index.php?c=change_password&STYLE=7151e50b0389755717510f218b1af00c HTTP/1.1
Host: [redacted]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:46.0)
Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: close

Upgrading to version 4.3 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

See VDB-93269 for similar entry. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Sophos

Name

• Web Appliance

Version

• 4.2.1.3

License

• commercial

Website

• Vendor: https://www.sophos.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion