ManageEngine OpStor 7.4 Cross Site Scripting / SQL Injection

ManageEngine OpStor v7.4 - Multiple Web Vulnerabilities 

Affected Products:
==================
Manage Engine
Product: OpStor Monitor v7.4

Details:
========
1.1
A blind SQL Injection vulnerability is detected in OpStor v7.4, Storage Area Network Monitoring.
The vulnerability allows an attacker (remote) or local low privileged user account to execute a SQL commands on the 
affected application dbms. The vulnerability is located in raidMaps.do file with the bound vulnerable name parameter.
Successful exploitation of the vulnerability results in dbms & application compromise. Exploitation requires no user 
inter action & without privileged user account.


Vulnerable Module(s):
      [+] raidMaps.do - [name]
Vulnerable File(s):
      [+] raidMaps.do


--- SQL Exception Logs ---
Problem Type
Struts Exception   Problem Details
Syntax error or access violation message from server: 
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the 
right syntax to use near  000123456789 )  at line 1  



1.2
A persistent input validation vulnerability is detected in OpStor v7.4, Storage Area Network Monitoring.
The bugs allow remote attackers to implement/inject malicious script code on the application side (persistent). 
The persistent vulnerability is located in Alarm reporting module with the bound vulnerable subject parameters.
Successful exploitation of the vulnerability can lead to session hijacking (manager/admin) or stable (persistent) context 
manipulation. Exploitation requires low user inter action & privileged user account.

Vulnerable Module(s):
      [+] Alarms -> Alarm reporting -> Escalate Unattended Alarms

Vulnerable Parameter(s):
      [+] Subject


1.3
Multiple non persistent cross site scripting vulnerability is detected in OpStor v7.4, Storage Area Network Monitoring.
The vulnerability allows remote attackers to hijack website customer, moderator or admin sessions with medium or high 
required user inter action or local low privileged user account. The vulnerabilities are located in availability730.do 
with the bound vulnerable day & name parameters. Successful exploitation can result in account steal, client site phishing 
& client-side content request manipulation.

Vulnerable Module(s):
      [+] availability

Vulnerable File(s):
      [+] availability730.do

Vulnerable Parameter(s):
      [+]  Days
      [+]  Name


Proof of Concept:
=================
1.1
The blind SQL injection vulnerability can be exploited by remote attackers without user inter action. For demonstration or reproduce ...

PoC:
http://opstor.127.0.0.1:1338/raidMaps.do?raidId=10000&name=000123456789'+AND+'1'='1')-- -
http://opstor.127.0.0.1:1338/raidMaps.do?raidId=10000&name=000123456789%27+AND+substring(@@version,1,1)='4')-- -
http://opstor.127.0.0.1:1338/raidMaps.do?raidId=10000&name=000123456789%27+AND+(select 1)='1')-- -


1.2
The persistent input validation vulnerability can be exploited by remote attackers with low required user inter action & low 
privileged user account. For demonstration or reproduce ...

The attacker create an alarm report and insert in a subject field own malicious javascript or html code.
To create an alarm the attacker needs to go to Alarms -> Alarm reporting -> Escalate Unattended Alarms
Then inject the malicious script code i.e., <iframe src=www.vuln-lab.com onload=alert("VL")/>
When the user browses the alarms page in the control panel the persistent injected script code will be 
executed out of the web application context.

1.3
PoC:
http://opstor.127.0.0.1:1338/availability730.do
?days=>"<iframe src=http://www.vuln-lab.com onload=alert("XSS")></iframe>
&name=>"<iframe src=http://www.vuln-lab.com onload=alert("XSS")></iframe>


Solution:
=========
2012-08-07:  Vendor Fix/Patch

Manually steps to apply the patch/fix:

1. Download the patch and place it in <AppManager_home> directory. (<AppManager_Home> is the directory 
in which Applications Manager is installed, default location is C://Program Files (x86)/ManageEngine/AppManager10)

2. Extract the patch under <AppManager_home>. If prompted for a file replace, replace the existing file with the 
file from the Patch.  (or you can extract the zip file and copy the server.xml from the zip to the location as shown 
in the below structure).

3. After extracting ensure you have the Server.xml file as per the below provided structure:

 <AppManager_home>
|
.working
    ...apache
        ...tomcat
            ...conf
                ...backup
                        .server.xml 


4. Shut Down Applications Manager Software
5. Rename Logs folder path or variable
6. Start Applications Manager after the change
7. Done!


PATCH DOWNLOAD:  http://bonitas.zohocorp.com/customer_uploads/2012_8_16_10_12_39_BadInput_10600.zip 


Risk:
=====
1.1
The security risk of the  blind SQL injection  vulnerability is estimated as critical.

1.2
The security risk of the persistent input validation vulnerability is estimated as medium(+).

1.3
The security risk of the client side cross site vulnerabilities are estimated as low(+).



#  0day.today [2018-03-02]  #