Message-Id: <201606021347.u52DlelX007683@sf01web3.securityfocus.com>
Date: Thu, 2 Jun 2016 13:47:40 GMT
From: d_fens@...brick.dcu.ie
To: bugtraq@...urityfocus.com
Subject: Zoho OpManager < v12

Reported these 27/08/2015 these were eventually fixed in version 12 because the entire application is based on emberjs now. There are no CVEs for these issues assigned nor is there any acknowledgement of the issues in any patches. Therefore only version 12 fixes these.

Multiple stored and reflected XSS as well as CSRF. There are also multiple issues related to content-type and one related to overwriting local files that wasn't reported and passwords being disclosed. Basically prior to version 12 opmanager is riddled with security issues

The following are stored XSS:
/admin/ConfigURLMonitor.do [fieldname]
/admin/MaintenanceTask.do [selectedAvailableDevices]
/admin/MaintenanceTask.do [selectedDevicesToMove]
/admin/ScheduleMgmt.do [repName]
/api/json/admin/getSysLogForwarders [destHost]
/api/json/device/getDeviceSummary [clName]
/api/json/reports/getReportsList [repName]
/devices/AddNewCF.do [fieldname]
/devices/DeviceCustomFields.do [fieldname]
/devices/manageUnmanage.do [fieldname]
/devices/manageUnmanage.do [fieldname]
/reports/ReportsIndex.do [repName]
/reports/ReportsIndex.do [repName]

The following are reflected XSS attacks
/admin/AddDeviceTypeForm.do [oid]
/admin/AddDeviceTypeForm.do [operationmode]
/admin/ConfigURLMonitor.do [ipAddress]
/admin/DependencyList.do [selectedTab]
/admin/DependencyList.do [selectedTab]
/admin/DeviceAssociation.do [selectedTab]
/admin/EditDeviceGraph.do [operation]
/admin/InvokeDeviceType.do [PAGE_NUMBER]
/admin/MaintenanceTask.do [selectedAvailableDevices]
/admin/MaintenanceTask.do [selectedDevicesToMove]
/admin/MaintenanceTask.do [taskID]
/admin/MibTool.do [selectedmib]
/admin/SNMPTrapProcessors.do [PAGE_NUMBER]
/admin/SNMPTrapProcessors.do [PAGE_NUMBER]
/admin/SNMPTrapProcessors.do [operation]
/admin/SNMPTrapProcessors.do [operation]
/admin/SNMPTrapProcessors.do [operation]
/admin/SNMPTrapProcessors.do [operation]
/admin/ServiceConfiguration.do [operation]
/admin/ServiceConfiguration.do [operation]
/admin/ServiceConfiguration.do [operation]
/admin/SetupSDesk.do [AutoSync]
/admin/SetupSDesk.do [Merge]
/admin/SetupSDesk.do [ticketType]
/admin/SysLogRules.do [SysLogPort]
/admin/SysLogRules.do [SysLogPort]
/admin/SysLogRules.do [status]
/admin/TrapConfiguration.do [PAGE_NUMBER]
/admin/TrapConfiguration.do [status]
/admin/ViewFailoverDetails.do [endDate]
/admin/ViewFailoverDetails.do [endDate]
/admin/ViewFailoverDetails.do [endHour]
/admin/ViewFailoverDetails.do [endHour]
/admin/ViewFailoverDetails.do [startDate]
/admin/ViewFailoverDetails.do [startDate]
/admin/ViewFailoverDetails.do [startHour]
/admin/ViewFailoverDetails.do [startHour]
/admin/ViewFailoverDetails.do [viewLength]
/customDashboard.do [dashboardName]
/devices/AddNewCF.do [fieldname]
/devices/AddNewCF.do [type]
/devices/CustomLinks.do [name]
/devices/DeviceCustomFields.do [type]
/devices/Search.do [searchTerm]
/devices/deviceinfo.do [devicename]
/devices/graphview.do [name]
/devices/manageUnmanage.do [displayName]
/devices/manageUnmanage.do [ipAddress]
/devices/objectdetails.do [displayName]
/devices/objectdetails.do [ipAddress]
/devices/updateStatus.do [displayName]
/devices/updateStatus.do [ipAddress]
/fault/AlarmView.do [displayName]
/map/AddFileMonitor.do [devicename]
/map/AddFileMonitor.do [displayName]
/map/AddFileMonitor.do [ipAddress]
/map/AddNotification.do [devicename]
/map/AddNotification.do [displayName]
/map/AddNotification.do [ipAddress]
/map/AddProcesses.do [deviceName]
/map/AddProcesses.do [displayName]
/map/AddProcesses.do [ipAddress]
/map/AddServices.do [devicename]
/map/AddServices.do [devicename]
/map/AddServices.do [devicename]
/map/EditMap.do [source]
/map/FileMonitorTemplates.do [devicename]
/map/FileMonitorTemplates.do [monitorType]
/map/InvokeDeviceType.do [devicename]
/map/InvokeDeviceType.do [devicename]
/map/InvokeDeviceType.do [devicename]
/map/InvokeMonitoring.do [devicename]
/map/InvokeMonitoring.do [devicename]
/map/MapView.do [displayName]
/map/SnpUpdateServices.do [displayName]
/map/SnpUpdateServices.do [ipAddress]
/map/UpdateDeviceType.do [devicename]
/modifyDashboard.do [dashboardName]
/reports/Availability.do [bview]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [reportGroup]
/reports/Availability.do [viewCount]
/reports/NewReport.do [repName]
/reports/NewReport.do [repName]
/reports/NewReport.do [repName]
/reports/NewReport.do [repName]
/reports/deviceAvailability.do [deviceName]
/reports/deviceAvailability.do [deviceName]
/reports/deviceAvailability.do [deviceName]
/reports/deviceAvailability.do [deviceName]
/webclient/admin/jsp/DeviceQuery.jsp [oidtext]


Vulnerable to CSRF:
/SavePreferences.do
/TabMenu.do
/admin/AddCriteria.do
/admin/AddIPSLAMonitor.do
/admin/BenchmarkDataUpload.do
/admin/BulkDeviceAssociation.do
/admin/BulkEditDeviceGraph.do
/admin/CategoryOperation.do
/admin/ConfigureProfile.do
/admin/DBManagement.do
/admin/DependencyList.do
/admin/DeviceAssociation.do
/admin/EditInterfaceTemplates.do
/admin/EditInterfaceTemplates1.do
/admin/ImportWorkflow.do
/admin/MaintenanceTask.do
/admin/RebrandOPM.do
/admin/SNMPTrapProcessors.do
/admin/SaveInterfaceTemplates.do
/admin/ScheduleMgmt.do
/admin/ScriptMonitor.do
/admin/ScriptTemplateImport.do
/admin/SelectQCW.do
/admin/ServiceConfiguration.do
/admin/SetupSDesk.do
/admin/ShareTemplate.do
/admin/SysLogNotification.do
/admin/SysLogRules.do
/admin/TrapNotification.do
/admin/UpdateAlarmEscalation.do
/admin/ViewFailoverDetails.do\
/cctvConfig.do
/devices/AddFromCSV.do
/devices/CustomLinks.do
/devices/switchPortMapTool.do
/map/L2Map.do
/map/SnmpDetails.do
/reports/AuditReport.do
/reports/GenerateReports.do
/reports/SelectDevice.do
/reports/deviceAvailability.do
/topo/addNewNetwork.do

Additionally

GET /api/json/device/getDeviceSummary?name=localhost&apiKey=aaaa&_bbbb

:false,"deviceName":"localhost","sysDescr":"","isNetwork":false,"responseTime":"001ms","ipAddress":"127.0.0.1","ramSize":"NA","vendorName":"Unknown","pollUsing":"ICMP","status":"L..schen","community":"public","dnsName":"localhost","availdata":{"Down":0,"Not
Monitored":0,"Up":100,"Parent Down":0,"Dependent Unavailable":0,"On
Hold":0,"On Maintenance":0},"customLinks":[],"isvCenter":false,"isSNMP":false,"snm

This returns the community password for SNMP devices. This can allows someone malicious on the panel or via XSS collect SNMP passwords.

Powered by blists - more mailing lists