Document Title:
===============
Barracuda Networks Backup - Persistent Web Vulnerability
References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=784
BARRACUDA NETWORK SECURITY ID: BNSEC-885
Release Date:
=============
2014-02-25
Vulnerability Laboratory ID (VL-ID):
====================================
784
Common Vulnerability Scoring System:
====================================
3.5
Product & Service Introduction:
===============================
Barracuda Backup Service is a complete and affordable data backup solution. The Barracuda Backup
Server provides a full local data backup and is combined with a storage subscription to replicate
data to two offsite locations. This approach provides the best of both worlds - onsite backups for
fast restore times and secure, offsite storage for disaster recovery. Block level deduplication is
applied inline to reduce traditional backup storage requirements by 20 to 50 times while also
reducing backup windows and bandwidth requirements. Cloud Storage with Deduplication
Barracuda Backup Subscription plans provide diverse offsite storage at affordable monthly fees that
scale to meet increasing data requirements.
* Secure backup to two geo-separate data centers
* Deduplicated efficient backup storage
* Redundant disk-based storage
* Best-of-breed data retention policies
* Web interface multi-location management
* Restore by Web, FTP and Windows software
(Copy of the Vendor Homepage: http://www.barracudanetworks.com/ns/products/backup_overview.php)
Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a persistent web vulnerability in the official Barracuda Networks Backup appliance web-application.
Vulnerability Disclosure Timeline:
==================================
2013-12-02: Researcher Notification & Coordination (Benjamin Kunz Mejri)
2013-12-04: Vendor Notification (Barracuda Networks Security Team)
2013-12-08: Vendor Response/Feedback (Barracuda Networks Security Team)
2014-02-17: Vendor Fix/Patch (Barracuda Networks Developer Team)
2014-02-26: Public Disclosure (Vulnerability Laboratory)
Discovery Status:
=================
Published
Exploitation Technique:
=======================
Remote
Severity Level:
===============
Low
Technical Details & Description:
================================
A persistent web vulnerability has been discovered in the official Barracuda Networks Backup appliance web-application.
The bugs allows remote attackers to inject own malicious script code on the application-side (persistent) of the service.
The persistent vulnerability is located in the `remote_host` value of the `Extern Backup` module. Remote attackers are able
to inject via POST method request own malcious script codes as remote_host. The result is the persistent (application-side)
execution out in the vulnerable remote_host list module. The attack vector is persistent on the application-side and the
request method to inject is POST. The security risk of the persistent input validation web vulnerability is estimated as
medium with a cvss (common vulnerability scoring system) count of 3.5(+)|(-)3.6.
Exploitation of the persistent web vulnerability requires low user interaction and a low privileged web-application appliance
user account. Successful exploitation of the vulnerability results in persistent session hijacking (admin/auditor), persistent
phishing (application-side), persistent external redirect and persistent manipulation of affected or connected vulnerable modules.
Request Method(s):
[+] POST
Vulnerable Section(s):
[+] Jetz Sichern
Vulnerable Module(s):
[+] Extern Backup > Ziel hinzufügen (Add Target) - Listing
Vulnerable Parameter(s):
[+] remote_host (Exception-Handling) - Error (Invalid)
Proof of Concept (PoC):
=======================
The persistent input validation vulnerability can be exploited by remote attacker with low privileged application user account and
low required user interaction. For demonstration or reproduce ...
Review: Jetz Sichern > Extern Backup > Ziel hinzufügen > [remote_host] > Listing
You can optionally choose a Backup Server from your account to load the required info automatically,
or enter it manually.