80 lines
No EOL
2.6 KiB
Text
80 lines
No EOL
2.6 KiB
Text
Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets
|
|
Date: 18 October 2016
|
|
Author: p0z
|
|
Vendor: ManageEngine
|
|
Vendor Homepage: https://www.manageengine.com/
|
|
Product: ServiceDesk Plus
|
|
Version: 9.2 Build 9207 (Other versions could also be affected)
|
|
Fixed Version: 9.2 Build 9228 (Released on: 29 September 2016)
|
|
URL readme fixed version: https://www.manageengine.com/products/service-desk/readme-9.2.html
|
|
Vendor ID report: SD-63280, SD-63281, SD-63282, SD-63283
|
|
|
|
|
|
Product Introduction
|
|
==========================
|
|
|
|
ServiceDesk Plus is ITIL-ready help desk software with integrated Assetand Project Management capabilities.
|
|
With advanced ITSM functionality and easy-to-use capability, ServiceDesk Plus helps IT support teams deliver
|
|
world-class service to end users with reduced costs and complexity. It comes in three editions and is available
|
|
in 29 different languages. Over 100,000 organizations, across 185 countries, trust ServiceDesk Plus to optimize
|
|
IT service desk performance and achieve high end user satisfaction.
|
|
|
|
Source: https://www.manageengine.com/products/service-desk/
|
|
|
|
|
|
Vulnerability Information
|
|
==========================
|
|
|
|
Class: Improper Privilege Management
|
|
Impact: Low privileged user can access sensetive data
|
|
Remotely Exploitable: Yes
|
|
Authentication Required: Yes
|
|
User interaction required: Yes
|
|
CVE Name: N/A
|
|
|
|
|
|
Vulnerability Description
|
|
==========================
|
|
|
|
A user with low privileged can be able view all requests/tickets (include attachments).
|
|
|
|
|
|
Vulnerability Details
|
|
==========================
|
|
|
|
SD-63280:
|
|
Low privileged user can change value for "notifyTo" variable to "REQFORWARD" and get advanced features.
|
|
After, user can change ticket id (variable "id") and see all request include attachments, and
|
|
send (forward) to email.
|
|
|
|
SD-63281:
|
|
Using low privileged user can send "Submit for Approval" e-mail even if the user don't have a necessary permission
|
|
to view the request.
|
|
|
|
SD-63282:
|
|
Using low privileged user can able to view the other user's assets by using the below URL.
|
|
(Able to view the associated assets of administrator user using guest login)
|
|
|
|
SD-63283:
|
|
Low privileged user can change value for "viewType" variable to "All" and see preview all requests.
|
|
|
|
|
|
Proof-of-Concept
|
|
==========================
|
|
SD-63280:
|
|
http://localhost:9090/SDNotify.do?notifyModule=Request&mode=E-Mail&id=1¬ifyTo=REQFORWARD
|
|
|
|
SD-63281:
|
|
http://localhost:9090/SubmitForApproval.do?ITEMID=1&MODULE=Request
|
|
|
|
SD-63282:
|
|
http://localhost:9090/UserAssets.do?userId=3
|
|
|
|
SD-63283:
|
|
http://localhost:9090/ListRequests.do?reqId=1&viewType=All
|
|
|
|
Timeline
|
|
==========================
|
|
09-04-2016: Notification Vendor.
|
|
02-06-2016: Vendor set ID's vulnerability.
|
|
29-09-2016: Vulnerability fixed. |