Imperva SecureSphere Web Application Firewall privileges management

Summaryinfo

A vulnerability categorized as critical has been discovered in Imperva SecureSphere Web Application Firewall. The impacted element is an unknown function. The manipulation with the input %00 results in privileges management. Additionally, an exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Imperva SecureSphere Web Application Firewall (Firewall Software) (affected version unknown). Affected is an unknown functionality. The manipulation with the input value %00 leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was released 11/04/2016 by Wiswat Aswamenakul as Bypass Imperva by confusing HTTP Pollution Normalization Engine as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The public release happened without coordination with the vendor. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1068. The advisory points out:

One of technique that attackers use to bypass web application firewall is to use HTTP pollution attack. The attack can be produced by sending parameters with the same name to web application and the result on the web application will depend on which web server and language used on the server. IIS and ASP will combine all the value together separated each one with "," (comma).

A public exploit has been developed by Wiswat Aswamenakul in URL and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k. The code used by the exploit is:

http://www.example.com/sqli.asp?a=nonexist'/*&a%00=*/or/*&a=*/1=1/*&a%00=*/--+-

Some web application firewall will fail detecting this attack. However, Imperva handles this type of attack by combining all the parameters with same name like IIS+ASP does (I call it normalization engine) before passing the end result to detection engine. However, I have found that there is a trick, bug, vulnerability, feature, (you name it) that allows the normalization engine to create end results different from IIS+ASP does.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Firewall Software

Vendor

• Imperva

Name

• SecureSphere Web Application Firewall

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion