[R1] McAfee Email and Web Security / Email Gateway Multiple Vulnerabilities

1) McAfee Email and Web Security and Email Gateway contains a flaw related to the /admin/cgi-bin/localadmin script. The issue is due to the script calling the SCMAdmin::AuthManagement::localLogin() function when $ENV{WS_SOURCE_IP} is 127.0.0.1. However, the SCMAdminUtils::setSCMEnvironment() function allows a remote attacker to manipulate the IP passed to the system via the X-Forwarded-for HTTP header allowing them to bypass authentication and gain administrative privileges.

The localadmin script calls SCMAdmin::AuthManagement::localLogin when $ENV{WS_SOURCE_IP} is 127.0.0.1:

     28 # Set up the rest of the environment
     29 setSCMEnvironment(\%cookieInfo);
     30 my ($sid, $err) = ("", "");
     31
     32 binmode(STDOUT, ":utf8");
     33
     34 # Are we being invoked from localhost?
     35 if ("127.0.0.1" eq $ENV{WS_SOURCE_IP}) {
     36     unless (SCMAdmin::AuthManagement::localLogin(\$sid, \$err)) {
     37         errorDocument($err);
     38     }
     39 }

SCMAdminUtils::setSCMEnvironment (line 29) allows an attacker to control $ENV{WS_SOURCE_IP} via the X-Forwarded-for HTTP header:

   1049     $ENV{WS_SOURCE_IP} = "127.0.0.1";
   1050     if (exists($ENV{HTTP_X_FORWARDED_FOR})) {
   1051         $ENV{WS_SOURCE_IP} = $ENV{HTTP_X_FORWARDED_FOR};
   1052     }
   1053     elsif (exists($ENV{REMOTE_ADDR})) {
   1054         $ENV{WS_SOURCE_IP} = $ENV{REMOTE_ADDR};
   1055     }

Note that the CVSSv2 score in this advisory reflects this specific issue.

2) McAfee Email Gateway contains a flaw that allows traversing outside of a restricted path. The issue is due to the /admin/cgi-bin/mui/combo script not properly sanitizing user input, specifically path traversal style attacks (e.g. '../') supplied via the URI. With a specially crafted request, a remote attacker can read arbitrary files. Proof-of-concept:

https://[target]:8080/admin/cgi-bin/mui/combo?../../../../../../../../../etc/passwd%00.js

3) McAfee Email and Web Security and Email Gateway contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the URI upon submission to the /admin/cgi-bin/plugindashboard/ or /admin/cgi-bin/dashboard/ scripts before returning it to the user. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. Proof-of-concepts:

https://[target]:8080/admin/cgi-bin/dashboard/1234"><img src="123" onerror=javascript:alert("xss")>
https://[target]:8080/admin/cgi-bin/plugindashboard/1234"><img src="123" onerror=javascript:alert("xss")>