Message-ID: <54254B9E.20708@vulnerability-lab.com>
Date: Fri, 26 Sep 2014 13:18:54 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: bugtraq@...urityfocus.com, bugs@...uritytracker.com
Subject: SmarterTools Smarter Track 6-10 - Information Disclosure Vulnerability

Document Title:
===============
SmarterTools Smarter Track 6-10 - Information Disclosure


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1298

Tracking ID: 088-1B879F0C-0A22


Release Date:
=============
2014-09-22


Vulnerability Laboratory ID (VL-ID):
====================================
1298


Common Vulnerability Scoring System:
====================================
6.1


Product & Service Introduction:
===============================
SmarterTrack is a powerful communications platform that acts as an online help desk for initiating, tracking, managing and reporting 
on a number of different communication channels. Whether it is a ticket submission via email or from the online portal, a live chat, 
a community post, comments made on a knowledge base article or more, SmarterTrack provides a centralized outlet for all communication 
channels and is an ideal solution for building your online community.

( Copy of the Vendor Homepage: http://www.smartertools.com/smartertrack/help-desk-software.aspx )


Abstract Advisory Information:
==============================
An independent Vulnerability Laboratory Researcher discovered an Information Disclosure issue in the official SmarterTools Smarter Track v6,v7,v8,v9 & v10.


Vulnerability Disclosure Timeline:
==================================
2014-08-23:	Researcher Notification & Coordination (Ehsan Vahab )
2014-08-23:	Vendor Notification (Smartertools Security Team)
2014-08-25:	Vendor Response/Feedback (Smartertools Security Team)
2014-09-21:	Vendor Fix/Patch Notification (Smartertools - Developer Team)
2014-09-22:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================

Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
An Information Disclosure vulnerability has been discovered in the smarter track v(6,7,8,9,10) web-application.
The information disclosure issue allows a remote attacker to gain unauthorized access to available mail conversations.

The vulnerability allows remote attackers to get all of the mail messages that gets transfered between the customer and application owner.
The vulnerability is located in the AvatarHandler.ashx file with vulnerable query string parameter `logoid`.
remote attackers are able to change in the GET method request the logoid and can download the .zip files that contains the .eml 
(outlook extension) file. The .eml file impact admin or user messages. If the logoid was wrong the zip file capacity is 0 byte 
and download is not possible. 

Exploitation of the vulnerability requires no privileged web application user account and also no user interaction. 
Successful exploitation of the issue results in unauthorized access to private server communication via email support.

Request method(s):
				[+] GET

Vulnerable File(s):
				[+] AvatarHandler.ashx

Vulnerabel ´Parameter(s):
				[+] logoid


Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers without privileged application user account and also without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Google Dork :
inurl:/kb/root.aspx

PoC :
smartertrack.localhost.com/AvatarHandler.ashx?logoid=[vulnerable number]

Wrong logoid:
http://support.xxx.com/AvatarHandler.ashx?logoid=182206

Correct logoid:
http://support.xxx.com/AvatarHandler.ashx?logoid=208758
http://support.xxx.com/AvatarHandler.ashx?logoid=208765
http://support.xxx.com/AvatarHandler.ashx?logoid=208766


Solution - Fix & Patch:
=======================
2014-09-21:	Vendor Fix/Patch Notification (Smartertools - Developer Team)


Security Risk:
==============
The security risk of the information dsiclosure issue is estimated as medium(+).


Credits & Authors:
==================
Ehsan Vahab (https://www.linkedin.com/profile/view?id=305567696)


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either 
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers 
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even 
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation 
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break 
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       		- www.evolution-sec.com
Contact:    admin@...nerability-lab.com 	- research@...nerability-lab.com 	       		- admin@...lution-sec.com
Section:    dev.vulnerability-db.com	 	- forum.vulnerability-db.com 		       		- magazine.vulnerability-db.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       		- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   		- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php  	- vulnerability-lab.com/list-of-bug-bounty-programs.php	- vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact 
(admin@...nerability-lab.com or research@...nerability-lab.com) to get a permission.

				Copyright © 2014 | Vulnerability Laboratory [Evolution Security]



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com

Powered by blists - more mailing lists