full-disclosure - [FD] CVE-2014-8558 - JExperts Tecnologia - Channel Software Escalation Access Issues

Open Source and information security mailing list archives

Message-ID: <CAKjh9adqasmV-Kte2P-1u+Fh++YxNogp88Qg6noD1g_Mm3=EEA@mail.gmail.com>
Date: Wed, 5 Nov 2014 10:35:41 -0300
From: Luciano Pedreira <lpedreira@...il.com>
To: bugtraq <bugtraq@...urityfocus.com>,
	fulldisclosure <fulldisclosure@...lists.org>
Subject: [FD] CVE-2014-8558 - JExperts Tecnologia - Channel Software
 Escalation Access Issues

CVE-2014-8558 - JExperts Tecnologia / Channel Software Escalation Access
Issues
Vendor Notified: 2014-10-27

INTRODUCTION:

The Channel Platform is an enterprise software project management (or
project management) developed by Brazilian company JExperts Technology and
present at thousands clients private enterprise and government enterprise.
This software consists of an integrated set of solutions in the areas of
strategy, projects and processes.

This problem was confirmed in the following versions of the Channel, other
versions maybe also affected.

Version: 5.0.33_CCB

DETAILS:

The Channel software is affected by Escalation Access. The variables
"action" and "key" can be manipulate by the GET method (passing parameters
at the URL itself), where a user, with restricted access, such as "read
only", can realize access to any other request of the call center of a user
other than him and even create or edit existing content posted of other
users.

A logged with any user at the system, just change the parameter of the
action ("action" variable) and the value of the key ("key" variable) to be
manipulated to get unauthorized access to the areas of others users.

Examples:

[1] set action to "acompanhar" and key to "201"
http://<server>/channel/ticket.do?action=acompanhar&key=201

[2] set action to "editar" and key to "100"
http://<server>/channel/ticket.do?action=editar&key=100

CREDITS:

This vulnerability was discovered and researched by Luciano Pedreira
(a.k.a. shark)

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives