231 lines
14 KiB
Text
Executable file
231 lines
14 KiB
Text
Executable file
Title:
|
|
======
|
|
Dell PacketTrap MSP RMM 6.6.x - Multiple Persistent Web Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2013-07-17
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=791
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
791
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
3.5
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
Network Monitoring Software & Remote monitoring and management. Be the first to know. Remote network monitoring and management for
|
|
the entire IT infrastructure. See all your customers network traffic, application performance, and device events, in one central view.
|
|
Fast and easy anytime, anywhere access to any device. No more truck roll outs to site to fix problems. packetTrap RMM allows you to save
|
|
time, improve productivity, and increase ROI. To meet the needs of your customers, packetTrap RMM offers agent and agentless based deployment
|
|
architecture for ultimate flexibility. Network traffic & website surfing analysis - Deep AntiVirus Integration Virtual Infrastructure
|
|
Monitoring - VoIP Monitoring - Elaborate Scripting Engine - Network Mapping - Support for Most PSA - Custom Reports & Dashboard Gadgets
|
|
- Performance Baseline Monitoring - packetTrap RMM Community - MSP Acceleration Program.
|
|
|
|
(Copy of the Vendor Homepage: http://www.packettrap.com/products/packettrap-msp/ )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered multiple web vulnerabilities in the DELL PacketTrap 6.6.23938 MSP RMM Software.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2013-01-24: Researcher Notification & Coordination (Benjamin Kunz Mejri)
|
|
2013-02-06: Vendor Notification
|
|
2013-02-08: Vendor Response/Feedback
|
|
2013-**-**: Vendor Fix/Patch
|
|
2013-07-17: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
DELL
|
|
Product: PacketTrap MSP RMM 6.6.23938
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Medium
|
|
|
|
|
|
Details:
|
|
========
|
|
Multiple persistent input validation vulnerabilities are detected in the DELL PacketTrap MSP v6.6.23938 appliance application.
|
|
The bug allows remote attackers to implement/inject own malicious script code on the application side of the software (persistent).
|
|
|
|
The first persistent vulnerability is located in the add function of the reports (reports manager & scheduled reports|add) module
|
|
when processing to request the vulnerable gadget_name, gadget_description, template name and device name parameters.
|
|
The vulnerability allows to inject persistent script code as report when processing to add a report or device. The result is the
|
|
persistent execution of script code out of the add reports preview software listing. Exploitation requires low user interaction &
|
|
a low privileged appliance web application user account.
|
|
|
|
The secound persistent vulnerability is located in the reports (index listing) module when processing to request the vulnerable
|
|
customer name, device name & host name parameter & listing. The vulnerability allows to inject via add function persistent script code.
|
|
The result is the persistent execution of script code out of the index reports software listing.
|
|
|
|
Exploitation of the vulnerability requires low user interaction & a low privilege web application user account.
|
|
Successful exploitation of the vulnerability can lead to persistent session hijacking (manager/admin), persistent phishing, persistent
|
|
external redirects to malware or scam and (stable) persistent web context manipulation of the affected vulnerable module.
|
|
|
|
Vulnerable Section(s):
|
|
[+] Reports
|
|
|
|
Vulnerable Module(s):
|
|
[+] Report Manager
|
|
[+] Scheduled Reports
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] Template Name
|
|
[+] Device Name
|
|
[+] gadget_name
|
|
[+] gadget_description
|
|
[+] Customername
|
|
[+] HostName
|
|
|
|
Affected Section(s):
|
|
[+] Add Preview Listing
|
|
[+] Software Report Listing
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The persistent script code inject vulnerabilities can be exploited by low privileged group user accounts with low required user interaction.
|
|
For demonstration or reproduce ...
|
|
|
|
|
|
Review: Reports > Report Manager > [Add Preview Listing & Software Report Listing]
|
|
|
|
</style></head><body><table style="width:100%"><tr><td><img src="5665fcbb3b1c4dd1bf902fe2a199ea15.png" alt="Quest" title="Quest" /></td></tr>
|
|
<tr><td><h2>"><[PERSISTENT INJECTED SCRIPT CODE!]) <</h2>
|
|
<p>All devices for customer '<[PERSISTENT INJECTED SCRIPT CODE!]"><[PERSISTENT INJECTED SCRIPT CODE!]'<BR>Generated: 10.12.2012 21:20</p></td>
|
|
</tr><tr><td><table class="dash_frame" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr>
|
|
<td><table class="dash_col_frame" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr>
|
|
<td><table class="gadget_frame" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr>
|
|
<td><table class="gadget_header" cellspacing="0" cellpadding="0" style="border-collapse:collapse;"><tr>
|
|
<td><span class="gadget_name">"><[PERSISTENT INJECTED SCRIPT CODE!]) <</span><span class="gadget_description">
|
|
<br>Top 10 devices for customer '<[PERSISTENT INJECTED SCRIPT CODE!]"><[PERSISTENT INJECTED SCRIPT CODE!]'</span></td>
|
|
</tr></table></td></tr><tr>
|
|
<td><table class="list_gadget_body sortable" cellspacing="0" cellpadding="2" style="border-collapse:collapse;">
|
|
<tr class="gadget_header_row">
|
|
<th class="gadget_header_cell_horiz" align="left" valign="middle"><span>Host Name</span></th><th class="gadget_header_cell_horiz"
|
|
align="left" valign="middle"><span>IP Address</span></th><th class="gadget_header_cell_horiz" align="left" valign="middle">
|
|
<span title="Customer Name">Customer Name</span></th><th class="gadget_header_cell_horiz" align="right" valign="middle"><span>
|
|
Ping Response Time</span></th><th class="gadget_header_cell_horiz" align="right" valign="middle"><span>Disk Free % Avg</span></th>
|
|
<th class="gadget_header_cell_horiz" align="right" valign="middle"><span title="Average cpu usage of a system.">CPU % Avg</span></th>
|
|
<th class="gadget_header_cell_horiz" align="right" valign="middle"><span>Physical Memory Used %</span></th><th align="right" valign="middle">
|
|
<span>Interface Traffic Total Avg</span></th></tr><tr>
|
|
<td align="left" valign="middle"><span title="HOSTBUSTER [192.168.0.103]" style="color:Black;font-weight:normal;font-style:normal;
|
|
text-decoration:none;">HOSTBUSTER</span></td><td align="left" valign="middle"><span title="HOSTBUSTER" style="color:Black;font-weight:normal;
|
|
font-style:normal;text-decoration:none;">192.168.0.103</span></td><td align="left" valign="middle"><span style="color:Black;font-weight:normal;
|
|
font-style:normal;text-decoration:none;"><[PERSISTENT INJECTED SCRIPT CODE!]"><[PERSISTENT INJECTED SCRIPT CODE!]</span></td><td align="right"
|
|
valign="middle"><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">0 ms</span></td>
|
|
<td align="right" valign="middle"><span style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">62%</span></td>
|
|
<td align="right" valign="middle"><table cellpadding="0" cellspacing="0"><tr>
|
|
<td><span class="numeric_value_0" style="color:Black;font-weight:
|
|
normal;font-style:normal;text-decoration:none;">58.50%</span><span> </span></td><td><table cellspacing="0" cellpadding="1"
|
|
style="font-size:0.75em;height:10px;width:70px;border-collapse:collapse;margin:0;padding:0;">
|
|
<tr><td class="numeric_bar_0" style="width:58%;"> </td><td class="numeric_bar_padding" style="width:42%;"> </td>
|
|
</tr></table></td></tr>
|
|
</table></td><td align="right" valign="middle"><table cellpadding="0" cellspacing="0"><tr>
|
|
<td><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">59.80%</span><span> </span></td>
|
|
<td><table cellspacing="0" cellpadding="1" style="font-size:0.75em;height:10px;width:70px;border-collapse:collapse;margin:0;padding:0;">
|
|
<tr><td class="numeric_bar_0" style="width:60%;"> </td><td class="numeric_bar_padding" style="width:40%;"> </td></tr></table></td></tr>
|
|
</table></td><td align="right" valign="middle"><span style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">
|
|
0.15 Mbps</span></td></tr><tr>
|
|
<td align="left" valign="middle"><span title="<[PERSISTENT INJECTED SCRIPT CODE!]20"><[PERSISTENT INJECTED SCRIPT CODE!];) <
|
|
[127.0.0.9]" style="color:Black;font-weight:normal;font-style:
|
|
normal;text-decoration:none;"><[PERSISTENT INJECTED SCRIPT CODE!]%20"><[PERSISTENT INJECTED SCRIPT CODE!]") <</span></td><td align="left"
|
|
valign="middle"><span title="<[PERSISTENT INJECTED SCRIPT CODE!];) <" style="color:Black;
|
|
font-weight:normal;font-style:normal;text-decoration:none;">127.0.0.9</span></td><td align="left" valign="middle"><span style="color:Black;
|
|
font-weight:normal;font-style:normal;text-decoration:none;"><[PERSISTENT INJECTED SCRIPT CODE!]</span></td><td align="right"
|
|
valign="middle"><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">0 ms</span></td>
|
|
<td align="right" valign="middle"><span style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">62%</span></td>
|
|
<td align="right" valign="middle"><table cellpadding="0" cellspacing="0">
|
|
<tr><td><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">22.00%</span><span> </span></td>
|
|
<td><table cellspacing="0" cellpadding="1" style="font-size:0.75em;height:10px;width:70px;border-collapse:collapse;margin:0;padding:0;">
|
|
<tr><td class="numeric_bar_0" style="width:22%;"> </td><td class="numeric_bar_padding" style="width:78%;"> </td>
|
|
</tr></table></td></tr></table></td><td align="right" valign="middle"><table cellpadding="0" cellspacing="0">
|
|
<tr><td><span class="numeric_value_0" style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">60.41%</span><span>
|
|
</span></td><td><table cellspacing="0" cellpadding="1" style="font-size:0.75em;height:10px;width:70px;border-collapse:collapse;margin:0;padding:0;">
|
|
<tr><td class="numeric_bar_0" style="width:60%;"> </td><td class="numeric_bar_padding" style="width:40%;"> </td>
|
|
</tr></table></td></tr>
|
|
</table></td><td align="right" valign="middle"><span style="color:Black;font-weight:normal;font-style:normal;text-decoration:none;">0.16 Mbps</span></td>
|
|
</tr></table></td></tr></table></td></tr></table></td></tr></table></td></tr></table></body></html>
|
|
|
|
|
|
Manually reproduce steps ...
|
|
|
|
1. Install the PacketTrap MSP RMM Software 6.x and start it up
|
|
2. Create an first account and switch to the main menu of the software dashboard
|
|
3. Go to the reports section and click on add reports
|
|
4. Inject your own script code via add in the vulnerable parameters
|
|
5. Click the next step button (down) of the add mask
|
|
6. The preview executes the code in the right listing after processing the first step. #reproduce1
|
|
7. Now, we reproduce the secound issue. Save the report with the persistent injected own script code
|
|
8. Switch (after the save) to the index module of the reports or scheduled reports listing
|
|
9. The code will be executed persistent out of the main software reports module when processing to watch the customer name, device name or host name #reproduce2
|
|
|
|
|
|
Risk:
|
|
=====
|
|
The security risk of the persistent input validation vulnerabilities are estimated as medium(+).
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com)
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
|
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright ? 2013 | Vulnerability Laboratory [Evolution Security]
|
|
|
|
--
|
|
VULNERABILITY LABORATORY RESEARCH TEAM
|
|
DOMAIN: www.vulnerability-lab.com
|
|
CONTACT: research@vulnerability-lab.com
|
|
|
|
|