bugtraq - CVE-2012-6494 - Nexpose Security Console

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 03 Jan 2013 15:06:36 -0600
From: "i@...oot.com" <i@...oot.com>
To: bugtraq@...urityfocus.com
Subject: CVE-2012-6494 - Nexpose Security Console - Session Hijacking

Product: Nexpose Security Console
Vendor: Rapid7
Version: < 5.5.3
Tested Version: 5.5.1
Vendor Notified Date: December 19, 2012
Release Date: January 2, 2013
Risk: Medium
Authentication: Access to logs required.
Remote: Yes

Description:
Due to a flaw in the way the Nexpose Security Console logs session data, 
it is possible to capture the session of a logged in user.
This could be especially interesting when using a central logging system 
and system admin have access to logs but not the security console.
In capturing a user’s session as shown in the proof-of-concept below, an 
attacker can gain access to the already logged in account. Once the 
attacker has this information, they can then hijack the established 
session and impersonate the owner in a variety of contexts.

Exploit steps for proof-of-concept:
1. Nexpose admin logs in.
2. While monitoring auth.log, the “Registered session” value is captured.
3. A request to the security console is made and intercepted using a proxy.
4. ‘JSESSIONID=<session>’ is replaced by 
‘nexposeCCSessionID=<SESSION-CAPTURED-IN-STEP-2>;time-zone-offset=000.
5. Success.

Vendor Notified: Yes
Vendor Response: Quickly escalated and resolved.
Vendor Update: Remediated in 5.5.4.

Reference:
CVE-2012-6494
https://community.rapid7.com/docs/DOC-2065#release5
https://www.owasp.org/index.php/Session_hijacking_attack

Credit:
Robert Gilbert
HALOCK Security Labs