Software Engineering Institute

According to Bloxx's website, Bloxx Web Filtering is a real-time Web content filter which performs live analysis and real-time categorization of Web pages to dramatically improve protection and security. Bloxx Web Filtering software contains multiple XSS, CSRF, and authentication bypass vulnerabilities which could allow an attacker to run arbitrary code.

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2012-2563:
(1) The Bloxx Reports are vulnerable to Persistent XSS. A malicious user, who's web traffic is being filtered by the Bloxx Web Filtering could inject persistent malicious code into the Bloxx Reports. When a Bloxx administrator views reports in the administrative interface that contains the entry, the malicious code will execute. A malicious user could use this to gain administrative access to the Bloxx administrator interface or execute arbitrary code on an administrative user.

Example : http://localhost/?test=<script>alert("XSS");</script>

• Administrators -> Administrators: Full Name field
• Filtering & Protection -> Categories: Name and Description fields
• Identification -> Identify: Name field
• Users & Groups -> Users: Username field
• Users & Groups -> Groups: Name and Description fields
• Filtering Policies: Name and Description fields
• Proxy & Cache -> Redirection: Original URL and Redirection fields
• Administrators -> Audit Trail: XSS that is injected in the Redirection function will render here and execute
• Alerts -> Email: Destination field
• Appliance Customization -> Access Denied Page: Name field
• Appliance Customization -> Login Page: Name field
• Appliance Customization -> Logout Denied Page: Name field

Example: https://www.website.com/test.php?test="><script>alert("XSS");</script>

An attacker with access to the Bloxx Web Filtering management web interface can conduct a cross-site scripting or cross-site request forgery attack, which could be used to result in information leakage, privilege escalation, and/or denial of service. An attacker with access to the Bloxx backup configuration files could recover the password hashes of the administrator account or possibly change the administrator account password.

Update

The vendor has stated that these vulnerabilities have been addressed in Bloxx Web Filtering 5.0.14. The Microdasys SSL issues have been addressed in Microdasys 3.5.1-B708 (or above) is now is installed by default for Bloxx Web Filtering 5.0.14 and above. The vendor is advising user to update to Bloxx Web Filtering 5.0.14 and above.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the Bloxx Web Filtering management web interface using stolen credentials from a blocked network location.