Barracuda WAF Management Application Username and Session ID Leak

Vulnerability Description

The Barracuda WAF management application transmits the current user and session identifier over HTTP GET.

Technical Description

The HTTP URL shown below contains both the username and a md5 hash. This information is transmitted over a plaintext network connection. The password parameter can be seen more like a session identifier whose values are valid for a maximum of five days.

  GET /cgi-bin/index.cgi?password=c12954a040d3a239f05ae63378131045&et=1480178788&auth_type=Local&locale=en_US&page_submitted=1&primary_tab=ADVANCED&secondary_tab=troubleshooting&user=admin HTTP/1.1
  Host: 1.3.3.8:8000
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:50.0) Gecko/20100101 Firefox/50.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Referer: http://1.3.3.8:8000/cgi-bin/index.cgi?&user=admin&password=d8bcadb76eb1f0c22423e1ec6264bc9c&et=1480178786&locale=en_US&primary_tab=ADVANCED&secondary_tab=troubleshooting&file=report_.tar.gz&refresh=1
  DNT: 1
  Connection: close
  Upgrade-Insecure-Requests: 1

  HTTP/1.1 200 OK
  Server: BarracudaHTTP 4.0
  Content-Type: text/html; charset=utf-8
  Connection: close
  Expires: Fri, 27 Nov 2015 16:26:42 GMT
  Date: Sat, 26 Nov 2016 16:26:42 GMT
  Content-length: 100997
  X-Frame-Options: SAMEORIGIN

  [snip]

Mitigation and Remediation Recommendation

The vendor has patched this vulnerability in the latest virtual appliance release.

Credit

This vulnerability was discovered by Matt Bergin (@thatguylevel) of KoreLogic, Inc. and Joshua Hardin.

Proof of Concept

See 3. Technical Description

The contents of this advisory are copyright(c) 2017 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at: https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt