Elcom CommunityManager.NET – Authentication Bypass

• Exploit Database
• 9 阅读

• 作者： Sense of Security
  日期： 2010-12-20
• 类别：

  • webapps
  平台：

  • asp
• 来源：https://www.exploit-db.com/exploits/15784/

• Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-10-004
  Release Date.20-Dec-2010
  Last Update. -
  Vendor Notification Date.22-Jan-2010
  Product. Elcom Technology's
   CommunityManager.NET
  Platform.IIS with ASP.NET
  Affected versions. v6.7 verified and 
   possibly others.
  Severity Rating. High
  Impact.Application "System" user access
  Attack Vector. Remote without authentication
  Solution Status. Vendor patch
  CVE reference. Not yet assigned
  
  Details.
  The web application uses cookie parameters passed via HTTP 
  requests to identify which user is logged in. Authentication 
  routines can be bypassed by simply appending the below POC 
  string to a cookie which already contains a valid ASP.NET 
  session ID. The value given to the various cookie parameters 
  indicates the specific user ID for the application user the 
  attacker wishes to impersonate.
  
  Proof of Concept.
  To exploit this vulnerability, simply browse to the software 
  to automatically create a valid ASP.NET session ID. Once 
  obtained, add the following to the cookie parameter:
  
  ; CMLogUserwww2=21; OnlineLearnUserwww2=21
  
  Note that the ID value of "21" in the above instance 
  indicates that the user with the user ID of "21" will be 
  impersonated. If this user ID is not linked to a user account,
  access will not be obtained. Some enumeration or educated
  guessing may be required. 
  
  Solution.
  Sense of Security has been advised that Elcom Technology has
  patched all versions of CommunityManager.NET and notified all
  clients.
  
  Discovered by.
  Sense of Security Labs.
  
  About us.
  Sense of Security is a leading provider of information
  security and risk management solutions. Our team has expert
  skills in assessment and assurance, strategy and architecture,
  and deployment through to ongoing management. We are
  Australia's premier application penetration testing firm and
  trusted IT security advisor to many of the countries largest
  organisations.
  
  Sense of Security Pty Ltd 
  Level 8, 66 King St
  Sydney NSW 2000
  AUSTRALIA
  
  T: +61 (0)2 9290 4444
  F: +61 (0)2 9290 4455
  W: http://www.senseofsecurity.com.au/consulting/penetration-testing
  E: info@senseofsecurity.com.au
  Twitter: @ITsecurityAU
  
  The latest version of this advisory can be found at:
  http://www.senseofsecurity.com.au/advisories/SOS-10-004.pdf