Livetecs Timelive 6.2.71 Unauthenticated Access / File Upload Vulnerabilities

Vulnerability title: Unauthenticated access to sensitive information and
functionality in Livetecs Timelive
CVE: CVE-2014-1217
Vendor: Livetecs
Product: Timelive
Affected version: 6.2.71
Fixed version: 6.2.8
Reported by: Richard Hatch

Details:
It was possible to access a URL that allowed unauthenticated access
to sensitive configuration change functionality, and also revealed the
database connection
string (including authentication credentials) used by TimeLive to access
the database.

The following URL was identified:
http://MyTimeLiveServer/home/systemsetting.aspx

Note: This URL was identified by entering "timelive default credentials"
into the Google
Internet search engine. At time of writing the URL was revealed by the
first result returned
by Google.


Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/

Vulnerability title: Unrestricted file upload in Livetecs Timelive
CVE: CVE-2014-2042
Vendor: Livetecs
Product: Timelive
Affected version: 6.2.71
Fixed version: 6.5.1
Reported by: Richard Hatch

Details:
It was discovered that it was possible for low-level TimeLive
application users to upload
files (by using the "My Projects".."Manage Project" functionality).
There was no restriction on
file types that could be uploaded and the permissions applied to those
uploaded files included
"Read and Execute".

1. Using any text editor create a new file "run-cacl.aspx" and add the
following content:

<%@ Page Language="VB" %>
 <%
 System.Diagnostics.Process.Start("calc.exe")
 %>

2. Login to the TimeLive application as a low-level (standard) user
3. Click "My Projects" from the left-hand menu
4. Click the "Manage" icon - It looks like a notepad and pen
5. Scroll to the bottom of the page that opens and click "Attachment"
6. Click "Browse" and navigate to to where you saved "run-cacl.exe"
7. Click "Upload"
8. Logout of TimeLive [Optional]
9. On the server hosting the TimeLive application run "TaskMgr"
9. Browse to http://MyTimeLiveURL/Uploads/1/1/run-cacl.aspx
10. Observe "calc.exe" running as "NETWORK_SERVICE" in the Task manager
Note: Depending on the configuration of the TimeLive application used
for testing it may be
necessary to change the "1/1" part of the URL.
        

Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2042/

#  0day.today [2018-01-24]  #