Elcom CommunityManager.NET Authentication Bypass

`Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-10-004  
Release Date. 20-Dec-2010  
Last Update. -  
Vendor Notification Date. 22-Jan-2010  
Product. Elcom Technology's  
CommunityManager.NET  
Platform. IIS with ASP.NET  
Affected versions. v6.7 verified and   
possibly others.  
Severity Rating. High  
Impact. Application "System" user access  
Attack Vector. Remote without authentication  
Solution Status. Vendor patch  
CVE reference. Not yet assigned  
  
Details.  
The web application uses cookie parameters passed via HTTP   
requests to identify which user is logged in. Authentication   
routines can be bypassed by simply appending the below POC   
string to a cookie which already contains a valid ASP.NET   
session ID. The value given to the various cookie parameters   
indicates the specific user ID for the application user the   
attacker wishes to impersonate.  
  
Proof of Concept.  
To exploit this vulnerability, simply browse to the software   
to automatically create a valid ASP.NET session ID. Once   
obtained, add the following to the cookie parameter:  
  
; CMLogUserwww2=21; OnlineLearnUserwww2=21  
  
Note that the ID value of "21" in the above instance   
indicates that the user with the user ID of "21" will be   
impersonated. If this user ID is not linked to a user account,  
access will not be obtained. Some enumeration or educated  
guessing may be required.   
  
Solution.  
Sense of Security has been advised that Elcom Technology has  
patched all versions of CommunityManager.NET and notified all  
clients.  
  
Discovered by.  
Sense of Security Labs.  
  
About us.  
Sense of Security is a leading provider of information  
security and risk management solutions. Our team has expert  
skills in assessment and assurance, strategy and architecture,  
and deployment through to ongoing management. We are  
Australia's premier application penetration testing firm and  
trusted IT security advisor to many of the countries largest  
organisations.  
  
Sense of Security Pty Ltd   
Level 8, 66 King St  
Sydney NSW 2000  
AUSTRALIA  
  
T: +61 (0)2 9290 4444  
F: +61 (0)2 9290 4455  
W: http://www.senseofsecurity.com.au/consulting/penetration-testing  
E: [email protected]  
Twitter: @ITsecurityAU  
  
The latest version of this advisory can be found at:  
http://www.senseofsecurity.com.au/advisories/SOS-10-004.pdf  
`