ManageEngine Eventlog Analyzer Privilege Escalation v10.8

[graphx () sigaint org]

# ManageEngine EventLog Analyzer v10.8
# Date: 2/9/2016
# Exploit Author: @GraphX
# Vendor Homepage: http://www.manageengine.com
# Version: 10.8

1 Description:
It is possible for a remote authenticated attacker using an unprivileged
account to gain access to the admin account via parameter manipulation
using the account settings tab and the browser developers console. By
changing the userName field to be the name of the admin user, an attacker
can successfully overwrite the admin user password and then login as the
admin user.

2) Proof of Concept

1)Login to the eventlog analyzer as an unprivileged account.
2)Navigate to the settings tabs and click on the account settings link
3)With the developer's console open or using an interception proxy, change
the userName field from "guest" to "admin"
4)Change the password and click submit (admin password will be overwritten)
5)login as admin with your new password


</tr></tbody></table>

<input name="addField" value="false">
<input name="userName" value="guest"> //Change the value of this field
from guest to admin.
<input name="userID" value="2">
<input name="changePassword" value="false">
<input name="domainName" value="">
<input name="isPlugin" value="false">



3 Solution:
Vendor states fix will be included in next service pack.

Provided by ManageEngine:
1.  Stop the EventLog Analyzer service.
2.  Download and extract LogAnalyzerClient folder from the below link to
<EventLog Home>\\lib.
http://bonitas2.zohocorp.com/zipUploads/2016_03_02_21_24_32_o_1aajte2mb1sri3ra1875gi312581.tar.gz
3.  You will see a file  " UserManagementAction.class " under the folder
structure after extraction, <EventLog
Home>\\lib\\LogAnalyzerClient\\com\\adventnet\\la\\webclient
4.  Start the EventLog Analyzer service.


This is very similar to http://seclists.org/bugtraq/2016/Feb/65
It appears that ManageEngine shares code across many of their products.
This vulnerability has also been found in the ManageEngine Network
Configuration.


Timeline:
1/14/16 Initial Vendor Contact: Support ID [##2708539##]
2/3/16 patch provided for testing (see above)
2/8/16 Fix confirmed