CVE-2018-12571 – This vulnerability in Microsoft Forefront Unifi... (How to Fix)

Q: What is the severity of CVE-2018-12571?

CVE-2018-12571 has a CVSS score of 9.8 (CRITICAL). This vulnerability in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries to arbitrary hosts via the orig_url parameter, potentially enabling DNS amplification attacks or server-side request forgery (SSRF). It affects organizations using Microsoft Forefront UAG 2010 with the vulnerable component exposed. The high CVSS score reflects the potential for significant impact.

📋 TL;DR

This vulnerability in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS queries to arbitrary hosts via the orig_url parameter, potentially enabling DNS amplification attacks or server-side request forgery (SSRF). It affects organizations using Microsoft Forefront UAG 2010 with the vulnerable component exposed. The high CVSS score reflects the potential for significant impact.

💻 Affected Systems

Products:

Microsoft Forefront Unified Access Gateway

Versions: 2010

Operating Systems: Windows Server

Default Config Vulnerable: ⚠️ Yes

Notes: Requires the InitParams.aspx endpoint to be accessible, which is part of the default UAG configuration.

📦 What is this software?

Forefront Unified Access Gateway by Microsoft

View all CVEs affecting Forefront Unified Access Gateway →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could use the vulnerable endpoint to conduct DNS amplification attacks against third parties, potentially causing denial of service, or perform SSRF to access internal systems and services.

🟠

Likely Case

Most probable exploitation would involve using the vulnerable system as a DNS proxy to query internal or external systems, potentially revealing network information or enabling reconnaissance.

🟢

If Mitigated

With proper network segmentation and egress filtering, impact would be limited to potential information disclosure through DNS queries.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only HTTP requests to the vulnerable endpoint with crafted parameters.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Update Rollup 7 for Forefront UAG 2010

Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-12571

Restart Required: Yes

Instructions:

1. Download Update Rollup 7 from Microsoft Update Catalog. 2. Apply the update to all UAG servers. 3. Restart the UAG services or server as required.

🔧 Temporary Workarounds

Block access to vulnerable endpoint

windows

Restrict access to /uniquesig0/InternalSite/InitParams.aspx using web server configuration or firewall rules.

# IIS URL Rewrite rule example
<rule name="Block InitParams" stopProcessing="true">
    <match url="^uniquesig0/InternalSite/InitParams\.aspx" />
    <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Access Denied" />
</rule>

Implement egress filtering

windows

Restrict outbound DNS queries from UAG servers to only authorized DNS servers.

# Windows Firewall rule to restrict DNS outbound
netsh advfirewall firewall add rule name="Restrict DNS" dir=out protocol=UDP remoteport=53 action=block

🧯 If You Can't Patch

Implement network segmentation to isolate UAG servers and restrict outbound DNS traffic.
Deploy a web application firewall (WAF) with rules to block malicious requests to the vulnerable endpoint.

🔍 How to Verify

Check if Vulnerable:

Send a GET request to https://<UAG_SERVER>/uniquesig0/InternalSite/InitParams.aspx?orig_url=http://example.com and monitor for DNS queries to example.com.

Check Version:

Check UAG version via Control Panel > Programs and Features or using PowerShell: Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*Forefront Unified Access Gateway*"} | Select-Object Name, Version

Verify Fix Applied:

After patching, repeat the vulnerable check; no DNS queries should be triggered. Also verify the installed version matches Update Rollup 7.

📡 Detection & Monitoring

Log Indicators:

HTTP requests to /uniquesig0/InternalSite/InitParams.aspx with orig_url parameter containing multiple URLs or external domains
Unusual outbound DNS queries from UAG servers to non-standard destinations

Network Indicators:

DNS queries originating from UAG servers to unexpected domains, especially in rapid succession
HTTP traffic to UAG servers with crafted orig_url parameters

SIEM Query:

source="UAG_Server" AND (url="/uniquesig0/InternalSite/InitParams.aspx" OR query="orig_url")

📊 Metadata

CVE ID: CVE-2018-12571

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-918

Published: July 5, 2018

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/148389/Microsoft-Forefront-Unified-Access-Gateway-2010-External-DNS-Interaction.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/2 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2018/Jul/7 Exploit,Mailing List,Third Party Advisory
http://www.securitytracker.com/id/1041212 Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/148389/Microsoft-Forefront-Unified-Access-Gateway-2010-External-DNS-Interaction.html Exploit,Third Party Advisory,VDB Entry
http://seclists.org/fulldisclosure/2018/Jul/2 Exploit,Mailing List,Third Party Advisory
http://seclists.org/fulldisclosure/2018/Jul/7 Exploit,Mailing List,Third Party Advisory
http://www.securitytracker.com/id/1041212 Third Party Advisory,VDB Entry

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2018-12571, you might also want to check these: