lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <CANmV1-pcOTHgmraBiqoAU1YT7ZiEC0pfMDBNBCxUpwb7wijbUQ@mail.gmail.com> Date: Mon, 30 Mar 2020 23:22:00 +0200 From: RedForce Advisory <advisory@...force.ae> To: "fulldisclosure@...lists.org <fulldisclosure@...lists.org>, , bugtraq@...urityfocus.com" <fulldisclosure@...lists.org> Subject: [FD] Deskpro Helpdesk < 2019.8.0 (Privilege Escalation, RCE) RedForce Advisory https://redforce.io ## ِAdvisory Information Title: Deskpro Helpdesk < 2019.8.0 Multiple Vulnerabilities Advisory URL: https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study/ Date published: 2020-03-28 Date of last update: 2020-03-30 Vendors contacted: DeskPro ## About Deskpro Deskpro is a helpdesk software solution that helps companies manage their communication with their customers and user base across a multiple channels; email, live chat, voice, social media. DeskPro has clients in different industries. Some of the well-known names per their website are: Microsoft, Siemens, P&G, Vodafone, HMRC, CapitalOne, Panasonic, NHS, Valve, Brown University, Hotel Chocolat, Garmin, Team USA, Arrow, Pure, Xerox, 1&1, Booz Allen Hamilton, Bitdefender, US Department of Defense and more. ## Vulnerability Description Deskpro on-premise helpdesk solution < 2019.8.0 was found to be prone to multiple high severity vulnerabilities that enable a remote attacker to escalate their privilege to helpdesk administrator. Moreover, it was prone to remote code execution (RCE) leading to full compromise of the server. Full vulnerability technical details and exploitation steps can be found in our advisory ( https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro-with-bitdefender-as-case-study/ ) ## Credits These vulnerabilities were discovered and researched by Abdulrahman Nour from RedForce. ## About RedForce RedForce is an information security consultancy firm consists of a team of experts in the offensive security field. By using the latest techniques, methodologies and attack simulation from an adversary prospective, we make sure that your organization is approaching the best practice to mitigate the risk at the lowest cost. We approach our offensive services from a holistic approach. Our aim is to contribute to the efforts of our customers in securing the critical IT infrastructure and crown jewels within their IT landscape. For more information, please visit https://redforce.io _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists