cf92ea269e
22 changes to exploits/shellcodes Quick N Easy Web Server 3.3.8 - Denial of Service (PoC) Go SSH servers 0.0.2 - Denial of Service (PoC) Android Binder - Use-After-Free (Metasploit) Diamorphine Rootkit - Signal Privilege Escalation (Metasploit) Apache James Server 2.3.2 - Insecure User Creation Arbitrary File Write (Metasploit) Avaya IP Office Application Server 11.0.0.0 - Reflective Cross-Site Scripting ESCAM QD-900 WIFI HD Camera - Remote Configuration Disclosure Real Web Pentesting Tutorial Step by Step - [Persian] AMSS++ v 4.31 - 'id' SQL Injection SecuSTATION IPCAM-130 HD Camera - Remote Configuration Disclosure CandidATS 2.1.0 - Cross-Site Request Forgery (Add Admin) AMSS++ 4.7 - Backdoor Admin Account SecuSTATION SC-831 HD Camera - Remote Configuration Disclosure ATutor 2.2.4 - 'id' SQL Injection I6032B-P POE 2.0MP Outdoor Camera - Remote Configuration Disclosure ManageEngine EventLog Analyzer 10.0 - Information Disclosure eLection 2.0 - 'id' SQL Injection DotNetNuke 9.5 - Persistent Cross-Site Scripting DotNetNuke 9.5 - File Upload Restrictions Bypass Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure Cacti 1.2.8 - Remote Code Execution Windows\x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes)
79 lines
No EOL
3.3 KiB
Text
79 lines
No EOL
3.3 KiB
Text
# Exploit Title: ManageEngine EventLog Analyzer 10.0 - Information Disclosure
|
|
# Date: 2020-02-23
|
|
# Author:Scott Goodwin
|
|
# Vendor: https://www.manageengine.com/
|
|
# Software Link: https://www.manageengine.com/products/eventlog/
|
|
# CVE: CVE-2019-19774
|
|
|
|
Vulnerability Name: Authenticated Information Disclosure in ManageEngine EventLog Analyzer
|
|
Registered: CVE-2019-19774
|
|
|
|
Discoverer:
|
|
Scott Goodwin, OSCP
|
|
OCD Tech
|
|
|
|
Vendor of Product:
|
|
ManageEngine
|
|
|
|
Affected Product Code Base:
|
|
EventLog Analyzer - 10.0 SP1
|
|
|
|
Affected Component:
|
|
Affected ManageEngine endpoint: http://exampleclient:8400/event/runquery.do
|
|
This endpoint allows the ManageEngine user to execute commands against the
|
|
ManageEngine PostgreSQL database.
|
|
|
|
Attack Type:
|
|
Remote
|
|
|
|
Vulnerability Type:
|
|
Incorrect Access Control
|
|
|
|
Vulnerability Impact:
|
|
Authenticated Information Disclosure
|
|
|
|
Attack Vector:
|
|
To exploit the vulnerability, an authenticated user must execute a specially crafted
|
|
query against the ManageEngine database to bypass the built-in security controls and
|
|
extract credential data.
|
|
|
|
Vulnerability Description:
|
|
An issue was discovered in Zoho ManageEngine EventLog Analyzer 10.0 SP1.
|
|
By running "select hostdetails from hostdetails" at the /event/runquery.do endpoint,
|
|
it is possible to bypass the security restrictions that prevent even administrative
|
|
users from viewing credential data stored in the database, and recover the MD5 hashes
|
|
of the accounts used to authenticate the ManageEngine platform to the managed machines
|
|
on the network (most often administrative accounts). Specifically, this bypasses the
|
|
following restrictions: a query cannot mention "password", and a query result cannot
|
|
have a "password" column.
|
|
|
|
PoC: Run the database query: "select hostdetails from hostdetails" at the /event/runquery.do endpoint
|
|
|
|
Reporting Timeline:
|
|
10/30/2019: This vulnerability was reported to ManageEngine via the
|
|
Zoho/ManageEngine Bug Bounty program. They acknowledged the initial report.
|
|
12/12/2019: Vulnerability registered
|
|
12/13/2019: Vulnerability acknowledged and update (12110) made available to ManageEngine
|
|
customers.
|
|
12/13/2019: Public disclosure
|
|
|
|
Additional Information:
|
|
This query bypasses the following security restrictions implemented within Manage Engine:
|
|
1. restrictions on queries that include the word "password". This query will output the
|
|
value stored in the "password" field, without the word "password" actually appearing in
|
|
the query. If the query contains the word "password" Manage Engine will not execute the query.
|
|
2. restrictions on printing the password field to the screen in a column called "password".
|
|
If the results of the query include a columncalled "password", Manage Engine will mask the
|
|
password with a series of asterisks "". This query will output the entire contents of the table,
|
|
without formatting is as a table within the web interface, which leads to bypass of this security
|
|
control.
|
|
|
|
Remediated Product Version:
|
|
ManageEngine EventLog Analyzer Build 12110
|
|
|
|
Reference:
|
|
https://www.manageengine.com/products/eventlog/
|
|
https://www.manageengine.com/products/eventlog/features-new.html#release
|
|
https://gist.github.com/scottgoodwin90/19ccecdc9f5733c0a9381765cfc7fe39
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19774
|
|
https://ocd-tech.com |