1) McAfee Email and Web Security and Email Gateway contains a flaw related to the /admin/cgi-bin/localadmin script. The issue is due to the script calling the SCMAdmin::AuthManagement::localLogin() function when $ENV{WS_SOURCE_IP} is 127.0.0.1. However, the SCMAdminUtils::setSCMEnvironment() function allows a remote attacker to manipulate the IP passed to the system via the X-Forwarded-for HTTP header allowing them to bypass authentication and gain administrative privileges. The localadmin script calls SCMAdmin::AuthManagement::localLogin when $ENV{WS_SOURCE_IP} is 127.0.0.1: 28 # Set up the rest of the environment 29 setSCMEnvironment(\%cookieInfo); 30 my ($sid, $err) = ("", ""); 31 32 binmode(STDOUT, ":utf8"); 33 34 # Are we being invoked from localhost? 35 if ("127.0.0.1" eq $ENV{WS_SOURCE_IP}) { 36 unless (SCMAdmin::AuthManagement::localLogin(\$sid, \$err)) { 37 errorDocument($err); 38 } 39 } SCMAdminUtils::setSCMEnvironment (line 29) allows an attacker to control $ENV{WS_SOURCE_IP} via the X-Forwarded-for HTTP header: 1049 $ENV{WS_SOURCE_IP} = "127.0.0.1"; 1050 if (exists($ENV{HTTP_X_FORWARDED_FOR})) { 1051 $ENV{WS_SOURCE_IP} = $ENV{HTTP_X_FORWARDED_FOR}; 1052 } 1053 elsif (exists($ENV{REMOTE_ADDR})) { 1054 $ENV{WS_SOURCE_IP} = $ENV{REMOTE_ADDR}; 1055 } Note that the CVSSv2 score in this advisory reflects this specific issue. 2) McAfee Email Gateway contains a flaw that allows traversing outside of a restricted path. The issue is due to the /admin/cgi-bin/mui/combo script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the URI. With a specially crafted request, a remote attacker can read arbitrary files. Proof-of-concept: https://[target]:8080/admin/cgi-bin/mui/combo?../../../../../../../../../etc/passwd%00.js3) McAfee Email and Web Security and Email Gateway contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the URI upon submission to the /admin/cgi-bin/plugindashboard/ or /admin/cgi-bin/dashboard/ scripts before returning it to the user. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. Proof-of-concepts: https://[target]:8080/admin/cgi-bin/dashboard/1234"> https://[target]:8080/admin/cgi-bin/plugindashboard/1234">
This Cyber News was published on www.tenable.com. Publication date: Fri, 08 Dec 2023 01:28:04 +0000