Ipswitch MOVEit DMZ 8.1 Information Disclosure

Type packetstorm
Reporter Profundis Labs
Modified 2016-01-28T00:00:00


                                            `Profundis Labs - Security Advisory  
Vulnerablity Title  
Enumeration of existing usernames  
Ipswitch, Inc (http://www.ipswitchft.com)   
MOVEit File Transfer  
MOVEit is an automated file transfer system that lets you manage, view, secure, and control all business-critical file transfer activity through a single, secure system.  
(Source: http://www.ipswitchft.com/moveit-managed-file-transfer)  
Affected Versions:  
MOVEit DMZ v8.1 and below  
Vulnerability Type:  
Information disclosure  
CVE Reference:  
VENDOR Reference:  
Vendor Reference Number: MIDMZ-6571  
Vulnerability Details:  
An unauthenticated user can check if a user name exists by using the controller: machine.aspx  
By performing a login via XML/Soap the different return codes can be evaluated to check wheather a user exists or not:  
ErrorCode 2050 -> Username does not exist  
ErrorCode 2025 -> Username exists but password is wrong or user is locked  
ErrorCode 0 -> Username exists and right password was provided  
PoC code(s):  
POST /machine.aspx HTTP/1.1  
<?xml version='1.0' encoding="iso-8859-1" ?>  
Disclosure Timeline:  
Vendor Notification: 09/23/2015  
Vendor Confirmation: 09/24/2015  
Vendor Patch Release: 10/20/2015   
Public Disclosure: 01/27/2016  
Severity Level:  
7.1 (High)  
Request Method(s): [+] HTTP GET  
Vulnerable Product: [+] MOVEit DMZ v8.1 and below  
Authentication (Role): [+] Anonymous  
[+] Author: Philipp Rocholl  
[+] Website: https://www.profundis-labs.com  
[+] Source: https://profundis-labs.com/advisories/CVE-2015-7680.txt  
[+] Disclaimer  
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given.   
Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.  
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information.