ManageEngine EventLog Analyzer 10.8 Privilege Escalation

`# ManageEngine EventLog Analyzer v10.8  
# Date: 2/9/2016  
# Exploit Author: @GraphX  
# Vendor Homepage: http://www.manageengine.com  
# Version: 10.8  
  
1 Description:  
It is possible for a remote authenticated attacker using an unprivileged  
account to gain access to the admin account via parameter manipulation  
using the account settings tab and the browser developers console. By  
changing the userName field to be the name of the admin user, an attacker  
can successfully overwrite the admin user password and then login as the  
admin user.  
  
2) Proof of Concept  
  
1)Login to the eventlog analyzer as an unprivileged account.  
2)Navigate to the settings tabs and click on the account settings link  
3)With the developer's console open or using an interception proxy, change  
the userName field from "guest" to "admin"  
4)Change the password and click submit (admin password will be overwritten)  
5)login as admin with your new password  
  
  
</tr></tbody></table>  
  
<input name="addField" value="false">  
<input name="userName" value="guest"> //Change the value of this field  
from guest to admin.  
<input name="userID" value="2">  
<input name="changePassword" value="false">  
<input name="domainName" value="">  
<input name="isPlugin" value="false">  
  
  
  
3 Solution:  
Vendor states fix will be included in next service pack.  
  
Provided by ManageEngine:  
1. Stop the EventLog Analyzer service.  
2. Download and extract LogAnalyzerClient folder from the below link to  
<EventLog Home>\\lib.  
http://bonitas2.zohocorp.com/zipUploads/2016_03_02_21_24_32_o_1aajte2mb1sri3ra1875gi312581.tar.gz  
3. You will see a file " UserManagementAction.class " under the folder  
structure after extraction, <EventLog  
Home>\\lib\\LogAnalyzerClient\\com\\adventnet\\la\\webclient  
4. Start the EventLog Analyzer service.  
  
  
This is very similar to http://seclists.org/bugtraq/2016/Feb/65  
It appears that ManageEngine shares code across many of their products.  
This vulnerability has also been found in the ManageEngine Network  
Configuration.  
  
  
Timeline:  
1/14/16 Initial Vendor Contact: Support ID [##2708539##]  
2/3/16 patch provided for testing (see above)  
2/8/16 Fix confirmed  
`