Open-AudIT – Multiple Vulnerabilities
GVI-2010-02 : Multiple vulnerabilities in Open-AudIT ==================================================== 1 Overview ---------- Excerpt from http://www.open-audit.org : "Open-AudIT is an application to tell you exactly what is on your network, how it is configured and when it changes. Open-AudIT will run on Windows and Linux systems. Essentially, Open-AudIT is a database of information, that can be queried via a web interface." 2 Description ------------- Multiple security issues were discovered which can be categorized as : - Lack of Authentication - SQL Injection - Cross-Site Scripting - Local File Include 3 Details --------- Product : Open-AudiT Versions : 20081013, 20091223-RC Vulnerability Type : authentication, SQLi, XSS, LFI Discovered by : Sébastien Duquette (virtualguardian.ca) Original Advisory : http://www.gardienvirtuel.ca/wp-content/uploads/2010/05/GVI-2010-02-EN.txt 4 Timeline ---------- Patches were sent to the vendor. The vendor said that they are focussing on version 2 of the product. Patches are not applied at disclosure date. Vendor informed : December 12th, 2009 Vendor Response : December 13th, 2009 Update request : January 14th, 2010 Vendor response : January 14th, 2010 Update request : February 19th, 2010 Vendor response : February 21th, 2010 Patches sent : March 29th, 2010 Public Disclosure : May 20th, 2010 5 Analysis ---------- 5.1 Lack of Authentication -------------------------- When the "Use Passwords" option is activated, Open-AudIT requires a user and password to be provided to access the web administrative interface. However, several scripts will not properly verify authentication before accepting requests. This allows an attacker to add or remove information in the database concerning the audited systems, obtain or modify system configurations like SMTP or LDAP server addresses etc. Also, the "backup" folder has user access rights by default, allowing anyone to grab any backup contained in the folder. Please note that this problem is not fixed by the patch provided with this advisory. To perform the inventorying on machines, Open-AudIT uses vbscript on Windows and bash scripts Linux and sends the data back via HTTP POST requests. The scripts currently do not support HTTP authentication. ------------------------------ | Affected scripts | |------------------------------| | upgrade.php | | admin_config_data.php | | delete_system.php | | admin_delete_all_systems.php | | admin_nmap_input.php | | admin_pc_add_2.php | | delete_other.php | | delete_missed_audit.php | | ldap_audit_script.php | | ldap_login.php | | ldap_logout.php | | list.php | | list_export.php | | system_post.php | | system_export.php | | php.php | ------------------------------ 5.1.1 Proof of concept ---------------------- Obtain the address of the LDAP server admin_config_data.php?sub=f1 Delete a system by it's ID delete_system.php?pc=<ID> 5.2 SQL Injection ----------------- Most SQL queries in the application do not sanitize the parameters. As an example, here is an excerpt from the system_post.php file : $sql = "UPDATE other SET other_network_name = '" . $_REQUEST['other_network_name'] . "',"; Please refer to the provided patch for the complete list of affected queries. 5.2.1 Proof of concept ---------------------- This request will output the name of the mysql user and current database admin_config_data.php?sub=f8&ldap_path_id=1%20UNION%20SELECT%20user%28%29, %20database%28%29 This request will return a text file with the list of all audited systems list_export.php?filename=export&sql=SELECT%2B%252A%2BFROM%2B%2560system 5.3 Cross-Site Scripting ------------------------ Some instances of Cross-Site scripting were found in Open-AudIT. Below is a table summarizing the affected variables. ------------------------------ | Script | Variable | ------------------------------ | include_lang.php | language | | list.php | view | ------------------------------ 5.3.1 Proof of concept ---------------------- list.php?view=%3Cscript%3Ealert('XSS')%3B%3C%2Fscript%3E 5.4 Local File Include ---------------------- The include_lang.php script is vulnerable to local file include. Let's take a look at the code : <?php if(!isset($language) or $language=="") $GLOBALS["language"]="en"; $language_file="./lang/".$GLOBALS["language"].".inc"; if(is_file($language_file)){ include($language_file); }else{ .... If we can somehow manage to modify the language value, a local file include would be possible by using a directory traversal. It so happens that the setup.php script is not disabled or deleted once the installation is completed and allows an unauthenticated user to modify the language value. See the proof of concept below. 5.4.1 Proof of concept ---------------------- Create a file named /tmp/test containing some php code. Send a POST request to setup.php with the following parameters : - language = %2f..%2f..%2f..%2f..%2f..%2f..%2ftmp%2ftest - step = 2 The script will then be included on pretty much every page. Solution -------- The flaws disclosed in this advisory are unpatched at the day of the release. We provide a patch against the latest version of the software. Please note that this patch was not extensively tested and does not fix all the issues. It is provided solely as a reference. |