SolarWinds Storage Resource Monitor Profiler < 6.2.3 Hotfix 1 RulesMetaData SQLi RCE

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(91917);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/06/03");

  script_xref(name:"ZDI", value:"ZDI-16-374");
  script_xref(name:"IAVA", value:"2016-A-0166-S");

  script_name(english:"SolarWinds Storage Resource Monitor Profiler < 6.2.3 Hotfix 1 RulesMetaData SQLi RCE");
  script_summary(english:"Checks the version of the Storage Resource Monitor Profiler module.");

  script_set_attribute(attribute:"synopsis", value:
"A web application running on the remote host is affected by a remote
code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of SolarWinds Storage Resource Monitor (SRM) Profiler
(formerly SolarWinds Storage Manager) running on the remote host is
prior to 6.2.3 Hotfix 1. It is, therefore, affected by a remote code
execution vulnerability in ScriptServlet due to a failure to sanitize
user-supplied input to the addNewRule() method of RulesMetaData. An
unauthenticated, remote attacker can exploit this, via SQL injection,
to disclose or manipulate arbitrary data in the back-end database or
to execute arbitrary code with SYSTEM privileges.");
  # https://thwack.solarwinds.com/login.jspa?referer=https://thwack.solarwinds.com/community/systems-management/storage-resource-monitor-srm-storage-manager/blog/2016/06/10/srm-profiler-module-formerly-known-as-storage-manager-v623-hot-fix-1-is-available
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?799b97fc");
  script_set_attribute(attribute:"see_also", value:"https://www.zerodayinitiative.com/advisories/ZDI-16-374/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to SolarWinds SRM Profiler version 6.2.3 Hotfix 1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");

  script_set_attribute(attribute:"vuln_publication_date", value:"2016/06/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/07/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:solarwinds:storage_manager");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:solarwinds:storage_resource_monitor");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2016-2021 Tenable Network Security, Inc.");

  script_dependencies("solarwinds_storage_manager_installed.nbin");
  script_require_keys("installed_sw/SolarWinds Storage Manager");
  script_require_ports(139, 445);

  exit(0);
}

include("audit.inc");
include("bsal.inc");
include("byte_func.inc");
include("misc_func.inc");
include("install_func.inc");
include("smb_func.inc");
include("smb_hotfixes.inc");
include("smb_hotfixes_fcheck.inc");
include("smb_reg_query.inc");
include("zip.inc");

# Patched JAR file, profiler-commons-6.2.3.jar, contains
# a file pom.properties that contains a creation date.
# Get that date string and return it along with a
# converted version of it (use for comparison).
# Return is NULL if there are any issues, otherwise,
# return is an array containing the items noted above.
function get_pom_date(path)
{
  local_var pom_date, matches, lines, line, month_integer;
  local_var fh, name, port, login, pass, domain, rc;
  local_var soc, share, dir, date_pat, pom_file;

  fh = CreateFile(
    file:path,
    desired_access:GENERIC_READ,
    file_attributes:FILE_ATTRIBUTE_NORMAL,
    share_mode:FILE_SHARE_READ,
    create_disposition:OPEN_EXISTING
  );
  if (!isnull(fh))
  {
    pom_file = zip_parse(smb:fh, "META-INF/maven/com.tektools/profiler-commons/pom.properties");
    CloseFile(handle:fh);
  }
  if (isnull(pom_file)) return NULL;

  # Extract date string from pom.properties file.
  if ("#Generated by Maven" >< pom_file)
  {
    date_pat = "^#(Mon|Tue|Wed|Thu|Fri|Sat|Sun) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ([0-9]+) ([0-9][0-9]:[0-9][0-9]:[0-9][0-9]) [A-Z][A-Z][A-Z] ([12][0-9][0-9][0-9])";

    # "#Dow Mon DD HH:MM:SS {zone} YYYY"
    line = egrep(string:pom_file, pattern:date_pat);
    if (empty(line)) return NULL;
  }
  else return NULL;

  matches = eregmatch(string:line, pattern:date_pat);
  if (empty_or_null(matches)) return NULL;

  month_integer = make_array("Jan", "01", "Feb", "02", "Mar", "03", "Apr", "04", "May", "05", "Jun", "06", "Jul", "07", "Aug", "08", "Sep", "09", "Oct", "10", "Nov", "11", "Dec", "12");

  pom_date = matches[5] +                  # YYYY
             month_integer[matches[2]] +   # MM
             matches[3] +                  # DD
             matches[4];                   # HH:MM:SS
  pom_date = str_replace(string:pom_date, find:":", replace:"");

  # YYYYMMDDHHMMSS
  return make_array(
    'date_string', str_replace(string:matches[0], find:"#", replace:""),
    'date_converted', pom_date
  );
}


app = "SolarWinds Storage Manager";

install = get_single_install(app_name:app, exit_if_unknown_ver:TRUE);
path    = install['path'];
version = install['version'];

fix_ver = "6.2.3";
vuln    = FALSE;
port    = 0;
extra_info = NULL;

if (ver_compare(ver:version, fix:fix_ver, strict:FALSE) < 0)
{
  port = get_kb_item("SMB/transport");
  if (isnull(port)) port = 445;

  vuln = TRUE;
}
# Version is 6.2.3 - check if affected file was updated 
else if (ver_compare(ver:version, fix:fix_ver, strict:FALSE) == 0)
{
  port    =  kb_smb_transport();
  login   =  kb_smb_login();
  pass    =  kb_smb_password();
  domain  =  kb_smb_domain();

  # Try to connect to server.
  if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');

  jar_file = "webapps\ROOT\WEB-INF\lib\profiler-commons-6.2.3.jar";
  jar_path = hotfix_append_path(path:path, value:jar_file);

  share = ereg_replace(string:path, pattern:"^([A-Za-z]):.*", replace:"\1$");
  dir   = ereg_replace(string:jar_path, pattern:"^[A-Za-z]:(.*)", replace:"\1");
  NetUseDel(close:FALSE);

  # Connect to the share software is installed on.
  rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
  if (rc != 1)
  {
    NetUseDel();
    audit(AUDIT_SHARE_FAIL, share);
  }

  pom_date = get_pom_date(path:dir);

  NetUseDel();

  if (empty_or_null(pom_date)) exit(1, 'Failed to retrieve the build date needed for comparison.');

  fixed_pom_date_string    = "Fri May 20 15:24:02 IST 2016";
  fixed_pom_date_converted = "20160520152402";
  if (pom_date['date_converted'] < fixed_pom_date_converted)
  {
    vuln = TRUE;

    extra_info +=
      '\nBased on its creation date, ' + jar_path + ' needs to be updated.' +
      '\n' +
      '\n  Installed creation date : ' + pom_date['date_string'] +
      '\n  Fixed creation date     : ' + fixed_pom_date_string;
  }
}

if (vuln)
{
  report =
    '\n  Path              : ' + path +
    '\n  Installed version : ' + version +
    '\n  Fixed version     : ' + fix_ver + ' with Hotfix 1';
  if (!isnull(extra_info)) report += '\n' + extra_info;
  report += '\n';

  security_report_v4(extra:report, port:port, sqli:TRUE, severity:SECURITY_HOLE);
}
else audit(AUDIT_INST_PATH_NOT_VULN, app, version, path);