# Author Title: John Page (aka hyp3rlinx)		
# Author Website: hyp3rlinx.altervista.org
# Source:  https://hyp3rlinx.altervista.org/advisories/IBMi_Navigator_HTTP_Security_Token_Bypass-CVE-2024-51464.txt
 # Vendor: www.ibm.com

[Product]
Navigator for i is a Web console interface where you can perform the key tasks to administer your IBM i.
IBM Navigator for i supports the vast majority of tasks that were available in the System i Navigator Windows client application.
This Web application is part of the base IBM i operating system, and can be easily accessed from your web browser.

[Vulnerability Type]
HTTP Security Token Bypass

[CVE Reference]
CVE-2024-51464

[Security Issue]
IBM i is vulnerable to bypassing Navigator for i interface restrictions.  By sending a specially crafted request, an authenticated attacker could exploit this
vulnerability to remotely perform operations that the user is not allowed to perform when using Navigator for i.

The web application generates an HTTP security token ID called "Mn:" with a 19 digit value and is set in the HTTP session response header per user.
Navigator, uses this token for integrity purpose to protect against arbitrary and or malicious HTTP requests. Therefore, upon receipt of a bogus
security token in an HTTP request the server will respond with HTTP 403 Forbidden message.

However, attackers can modify existing tokens to bypass the 403 Forbidden directive to achieve their objectives. Problem is Navigator security token logic
does not properly create or detect if a security token is valid or if it has been tampered with.

Attackers can manipulate the last eight digits of a token by setting them to all 0000s (zeroes) and or increment them by one, token length must be the same.
This can trick the application into processing attacker controlled security tokens as the server thinks it is valid, this undermines the security of this protection.

E.g. Valid HTTP header generated by the server.

Mn: 6844795211344371559
Content-Length: 290
Origin: https://10.1.1.4:2003

Example of a bogus but honored MN header token set by an attacker, padded with zeros and happily accepted by the backend servlet.
Mn: 6844795211300000000

The MN token is generated in the "initProtectionSetting" java method.

public void initProtectionSetting(HttpServletRequest request, HttpServletResponse response) {
    initEncryption();
    initSession();

   [ REDACTED ]

    setMagicNumber(magicNumber);
    response.setHeader("MN", magicNumber + "");
    setUserAgent(request.getHeader("User-Agent"));
  }


In the (doFilter) Method we see the check for MN header which sends HTTP 403 on invalid tokens.

     String mnStr = hRequest.getHeader("MN");
        if (mnStr == null)
          mnStr = hRequest.getParameter("MN");
        if (!isMnMatched(mnStr, hSession)) {
          NavLogger.severe("Forbidden. Incorrect HTTP ID");
          NavLogger.info("Request URI: " + requestURI);
          hResponse.sendError(403);
          return;


Invalid token response will return:
Error 403: SRVE38895F: Error reported: 403
 

Attacker increments MN or pad with zeros and requests are accepted and the token succeeds.
HTTP 200 OK


[References]
ADV0142855
https://www.ibm.com/support/pages/node/7179509

IBM classified as "CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax".
To be clear HTTP headers are just the delivery method for sending attacker controlled tokens to bypass Navigator protection.


[Exploit/POC]
Intercept Navigator HTTP requests and increment the last one or two digits of the Mn: HTTP
header security token or just pad the last eight digits with all zeroes.


[Network Access]
Remote


[Severity]
Medium
CVSS Base score:  4.3

[Affected versions]
7.5.0,7.4.0, 7.3.0


[Disclosure Timeline]
Vendor Notification:  10/14/2024
Vendor fix and publication: 12/20/2024
12/27/2024 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx