229 lines
No EOL
13 KiB
Text
229 lines
No EOL
13 KiB
Text
Title:
|
||
======
|
||
Dell PacketTrap MSP RMM 6.6.x - Multiple Persistent Web Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2013-07-17
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=791
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
791
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
3.5
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Network Monitoring Software & Remote monitoring and management. Be the first to know. Remote network monitoring and management for
|
||
the entire IT infrastructure. See all your customers network traffic, application performance, and device events, in one central view.
|
||
Fast and easy anytime, anywhere access to any device. No more truck roll outs to site to fix problems. packetTrap RMM allows you to save
|
||
time, improve productivity, and increase ROI. To meet the needs of your customers, packetTrap RMM offers agent and agentless based deployment
|
||
architecture for ultimate flexibility. Network traffic & website surfing analysis - Deep AntiVirus Integration Virtual Infrastructure
|
||
Monitoring - VoIP Monitoring - Elaborate Scripting Engine - Network Mapping - Support for Most PSA - Custom Reports & Dashboard Gadgets
|
||
- Performance Baseline Monitoring - packetTrap RMM Community - MSP Acceleration Program.
|
||
|
||
(Copy of the Vendor Homepage: http://www.packettrap.com/products/packettrap-msp/ )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the DELL PacketTrap 6.6.23938 MSP RMM Software.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2013-01-24: Researcher Notification & Coordination (Benjamin Kunz Mejri)
|
||
2013-02-06: Vendor Notification
|
||
2013-02-08: Vendor Response/Feedback
|
||
2013-**-**: Vendor Fix/Patch
|
||
2013-07-17: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
DELL
|
||
Product: PacketTrap MSP RMM 6.6.23938
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Medium
|
||
|
||
|
||
Details:
|
||
========
|
||
Multiple persistent input validation vulnerabilities are detected in the DELL PacketTrap MSP v6.6.23938 appliance application.
|
||
The bug allows remote attackers to implement/inject own malicious script code on the application side of the software (persistent).
|
||
|
||
The first persistent vulnerability is located in the add function of the reports (reports manager & scheduled reports|add) module
|
||
when processing to request the vulnerable gadget_name, gadget_description, template name and device name parameters.
|
||
The vulnerability allows to inject persistent script code as report when processing to add a report or device. The result is the
|
||
persistent execution of script code out of the add reports preview software listing. Exploitation requires low user interaction &
|
||
a low privileged appliance web application user account.
|
||
|
||
The secound persistent vulnerability is located in the reports (index listing) module when processing to request the vulnerable
|
||
customer name, device name & host name parameter & listing. The vulnerability allows to inject via add function persistent script code.
|
||
The result is the persistent execution of script code out of the index reports software listing.
|
||
|
||
Exploitation of the vulnerability requires low user interaction & a low privilege web application user account.
|
||
Successful exploitation of the vulnerability can lead to persistent session hijacking (manager/admin), persistent phishing, persistent
|
||
external redirects to malware or scam and (stable) persistent web context manipulation of the affected vulnerable module.
|
||
|
||
Vulnerable Section(s):
|
||
[+] Reports
|
||
|
||
Vulnerable Module(s):
|
||
[+] Report Manager
|
||
[+] Scheduled Reports
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] Template Name
|
||
[+] Device Name
|
||
[+] gadget_name
|
||
[+] gadget_description
|
||
[+] Customername
|
||
[+] HostName
|
||
|
||
Affected Section(s):
|
||
[+] Add Preview Listing
|
||
[+] Software Report Listing
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The persistent script code inject vulnerabilities can be exploited by low privileged group user accounts with low required user interaction.
|
||
For demonstration or reproduce ...
|
||
|
||
|
||
Review: Reports > Report Manager > [Add Preview Listing & Software Report Listing]
|
||
|
||
</style></head><body><table style="width:100%"><tr><td><img src="5665fcbb3b1c4dd1bf902fe2a199ea15.png" alt="Quest" title="Quest" /></td></tr>
|
||
<tr><td><h2>"><[PERSISTENT INJECTED SCRIPT CODE!]) <</h2>
|
||
<p>All devices for customer '<[PERSISTENT INJECTED SCRIPT CODE!]"><[PERSISTENT INJECTED SCRIPT CODE!]'<BR>Generated: 10.12.2012 21:20</p></td>
|
||
</tr><tr><td><table class="dash_frame" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr>
|
||
<td><table class="dash_col_frame" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr>
|
||
<td><table class="gadget_frame" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr>
|
||
<td><table class="gadget_header" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr>
|
||
<td><span class="gadget_name">"><[PERSISTENT INJECTED SCRIPT CODE!]) <</span><span class="gadget_description">
|
||
<br>Top 10 devices for customer '<[PERSISTENT INJECTED SCRIPT CODE!]"><[PERSISTENT INJECTED SCRIPT CODE!]'</span></td>
|
||
</tr></table></td></tr><tr>
|
||
<td><table class="list_gadget_body sortable" cellspacing="0" cellpadding="2" style="border-collapse:collapse;">
|
||
<tr class="gadget_header_row">
|
||
<th class="gadget_header_cell_horiz" align="left" valign="middle"><span>Host Name</span></th><th class="gadget_header_cell_horiz"
|
||
align="left" valign="middle"><span>IP Address</span></th><th class="gadget_header_cell_horiz" align="left" valign="middle">
|
||
<span title="Customer Name">Customer Name</span></th><th class="gadget_header_cell_horiz" align="right" valign="middle"><span>
|
||
Ping Response Time</span></th><th class="gadget_header_cell_horiz" align="right" valign="middle"><span>Disk Free % Avg</span></th>
|
||
<th class="gadget_header_cell_horiz" align="right" valign="middle"><span title="Average cpu usage of a system.">CPU % Avg</span></th>
|
||
<th class="gadget_header_cell_horiz" align="right" valign="middle"><span>Physical Memory Used %</span></th><th align="right" valign="middle">
|
||
<span>Interface Traffic Total Avg</span></th></tr><tr>
|
||
<td align="left" valign="middle"><span title="HOSTBUSTER [192.168.0.103]" style="color:Black;font-weight:normal;font-style:normal;
|
||
text-decoration:none;">HOSTBUSTER</span></td><td align="left" valign="middle"><span title="HOSTBUSTER" style="color:Black;font-weight:normal;
|
||
font-style:normal;text-decoration:none;">192.168.0.103</span></td><td align="left" valign="middle"><span style="color:Black;font-weight:normal;
|
||
font-style:normal;text-decoration:none;"><[PERSISTENT INJECTED SCRIPT CODE!]"><[PERSISTENT INJECTED SCRIPT CODE!]</span></td><td align="right"
|
||
valign="middle"><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">0 ms</span></td>
|
||
<td align="right" valign="middle"><span style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">62%</span></td>
|
||
<td align="right" valign="middle"><table cellpadding="0" cellspacing="0"><tr>
|
||
<td><span class="numeric_value_0" style="color:Black;font-weight:
|
||
normal;font-style:normal;text-decoration:none;">58.50%</span><span> </span></td><td><table cellspacing="0" cellpadding="1"
|
||
style="font-size:0.75em;height:10px;width:70px;border-collapse:collapse;margin:0;padding:0;">
|
||
<tr><td class="numeric_bar_0" style="width:58%;"> </td><td class="numeric_bar_padding" style="width:42%;"> </td>
|
||
</tr></table></td></tr>
|
||
</table></td><td align="right" valign="middle"><table cellpadding="0" cellspacing="0"><tr>
|
||
<td><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">59.80%</span><span> </span></td>
|
||
<td><table cellspacing="0" cellpadding="1" style="font-size:0.75em;height:10px;width:70px;border-collapse:collapse;margin:0;padding:0;">
|
||
<tr><td class="numeric_bar_0" style="width:60%;"> </td><td class="numeric_bar_padding" style="width:40%;"> </td></tr></table></td></tr>
|
||
</table></td><td align="right" valign="middle"><span style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">
|
||
0.15 Mbps</span></td></tr><tr>
|
||
<td align="left" valign="middle"><span title="<[PERSISTENT INJECTED SCRIPT CODE!]20"><[PERSISTENT INJECTED SCRIPT CODE!];) <
|
||
[127.0.0.9]" style="color:Black;font-weight:normal;font-style:
|
||
normal;text-decoration:none;"><[PERSISTENT INJECTED SCRIPT CODE!]%20"><[PERSISTENT INJECTED SCRIPT CODE!]") <</span></td><td align="left"
|
||
valign="middle"><span title="<[PERSISTENT INJECTED SCRIPT CODE!];) <" style="color:Black;
|
||
font-weight:normal;font-style:normal;text-decoration:none;">127.0.0.9</span></td><td align="left" valign="middle"><span style="color:Black;
|
||
font-weight:normal;font-style:normal;text-decoration:none;"><[PERSISTENT INJECTED SCRIPT CODE!]</span></td><td align="right"
|
||
valign="middle"><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">0 ms</span></td>
|
||
<td align="right" valign="middle"><span style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">62%</span></td>
|
||
<td align="right" valign="middle"><table cellpadding="0" cellspacing="0">
|
||
<tr><td><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">22.00%</span><span> </span></td>
|
||
<td><table cellspacing="0" cellpadding="1" style="font-size:0.75em;height:10px;width:70px;border-collapse:collapse;margin:0;padding:0;">
|
||
<tr><td class="numeric_bar_0" style="width:22%;"> </td><td class="numeric_bar_padding" style="width:78%;"> </td>
|
||
</tr></table></td></tr></table></td><td align="right" valign="middle"><table cellpadding="0" cellspacing="0">
|
||
<tr><td><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">60.41%</span><span>
|
||
</span></td><td><table cellspacing="0" cellpadding="1" style="font-size:0.75em;height:10px;width:70px;border-collapse:collapse;margin:0;padding:0;">
|
||
<tr><td class="numeric_bar_0" style="width:60%;"> </td><td class="numeric_bar_padding" style="width:40%;"> </td>
|
||
</tr></table></td></tr>
|
||
</table></td><td align="right" valign="middle"><span style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">0.16 Mbps</span></td>
|
||
</tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></body></html>
|
||
|
||
|
||
Manually reproduce steps ...
|
||
|
||
1. Install the PacketTrap MSP RMM Software 6.x and start it up
|
||
2. Create an first account and switch to the main menu of the software dashboard
|
||
3. Go to the reports section and click on add reports
|
||
4. Inject your own script code via add in the vulnerable parameters
|
||
5. Click the next step button (down) of the add mask
|
||
6. The preview executes the code in the right listing after processing the first step. #reproduce1
|
||
7. Now, we reproduce the secound issue. Save the report with the persistent injected own script code
|
||
8. Switch (after the save) to the index module of the reports or scheduled reports listing
|
||
9. The code will be executed persistent out of the main software reports module when processing to watch the customer name, device name or host name #reproduce2
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the persistent input validation vulnerabilities are estimated as medium(+).
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2013 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |