Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 18 replies
  • Subscribers 35 subscribers
  • Views 11970 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

KBA 135412 - Fixing SQL injection vulnerability, impact on SSL VPN

Jon Beets

The article suggests disabling HTTPS Admin Services and User Portal access on the WAN interface. While I have never had the Admin Services interface enabled, I have had the User Portal, as this was required to set up remote clients for VPN access. Is this still the case at least with a SSL VPN? If I have the User Portal disabled, will I have to manually send the EXE for the VPN client, and will I have to resend it, if any VPN settings/policies are changed?



This thread was automatically locked due to age.
Parents
  • 0

    If you disable the User Portal, you do NOT need to re-send the EXE or anything. I typically have the User Portal enabled on WAN for initial client deployment so they can download it themselves, then I cut it off on the Device Access tab.

    Any webpage with an input field like username/pass such as the User Portal or the Admin login page is exploitable using SQL injection. EDIT: exploitable *IF* input validation was not implemented, and fuzz techniques weren't implemented in Quality Assurance department

  • 0 in reply to apalm123

    Hello apalm123,

    it is more than obvious that the developers did nothing like that. It surprises me that this product received EAL4 + certification about two weeks ago.
    Incredibly...

    Regards

    alda

  • 0 in reply to alda

    Can you check on yours XGs if You can reach user portal even its not selected on WAN interface ?

    Only what i got selected on WAN is SSLVPN BUT i still can access a user portal...

  • 0 in reply to Regex

    Yes I can! Is it possible? Please look in the logs too, in some of our devices are deleted. Who did delete the logs, the hotfix or the hackers?

  • 0 in reply to Regex

    Hello Roman,

    it's really crazy.

    Unfortunately I have to confirm your finding, I have deactivated WebAdmin and UserPortal on the WAN zone and only SSL VPN is active but I can connect to UserPortal!
    I have access to WebAdmin only through ACL rules from defined IP networks, but although I tried to access UserPortal from a mobile phone (and this network is definitely not allowed through ACL), access to UserPortal is possible but not to WebAdmin.

    Probably better without comment, I don't think the developers did a good job!

    Regards

    alda

  • 0 in reply to alda

    Well thats seems to be another potential vulnerability. Ofcourse WebAdmin access Should be turned off via WAN -> but userportal should be also restricted. I hope that sophos will fix it ;) If im good remember on v17.5 it was fixed but i cant remember directly ;)

  • 0 in reply to alda

    I can confirm this also.  Only SSL VPN is enabled on WAN and User portal still accessible.

  • 0 in reply to AdamB

    AdamBasalyga said:

    I can confirm this also.  Only SSL VPN is enabled on WAN and User portal still accessible.

     

     

    Not seeing this with ours.  You sure there's not an override ACL below the device access matrix?  We use that to enable admin access from our own management IPs.

  • +1 in reply to AlexRomp

    This appears to be happening only if your VPN and User portal are both sharing 443.   If they are on different ports than it works as expected.  We usually use 443 for both since non-standard ports are often restricted depending on the remote users environment. 

  • 0 in reply to AdamB

    Ah, that makes sense.  We keep them separate on ours.  Good to know.

Reply Children