exploit the possibilities

SevOne Network Management System 5.7.2.22 SQL Injection / Command Injection

SevOne Network Management System 5.7.2.22 SQL Injection / Command Injection
Posted Oct 2, 2020
Authored by Calvin Phang | Site sec-consult.com

SevOne Network Management System version 5.7.2.22 suffers from command injection, CSV formula injection, and remote SQL injection vulnerabilities.

tags | advisory, remote, vulnerability, sql injection
MD5 | a1985e5482a5458f4280f73901a09840

SevOne Network Management System 5.7.2.22 SQL Injection / Command Injection

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20201002-0 >
=======================================================================
title: Multiple Vulnerabilities
product: SevOne Network Management System (NMS)
vulnerable version: 5.7.2.22
fixed version:
CVE number:
impact: Critical
homepage: https://www.sevone.com/
found: 2020-07-16
by: Calvin Phang (Office Singapore)
SEC Consult Vulnerability Lab

An integrated part of SEC Consult
Europe | Asia | North America

https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"SevOne provides modern monitoring and analytics solutions that organizations
need to monitor their networks today, tomorrow and beyond. SevOne simplifies
the extraction and enrichment of metric, flow, and streaming telemetry data
across multi-vendor networks enabling enterprises, carriers and managed services
providers to ensure optimal network operations and performance."

Source: https://www.sevone.com/company/about-us/


Business recommendation:
------------------------
The vendor did not respond to our communication attempts, hence no patch is
available. It's recommended to closely monitor any activities related to NMS.

An in-depth security analysis performed by security professionals is highly
advised, as the software may be affected from further security issues.


Vulnerability overview/description:
-----------------------------------
In order to exploit the identified security issues an attacker needs at
least the following privileges: "view alerts and manage devices"
depending on the role assigned.

1) Command Injection in Traceroute Feature (Authenticated User)
There is a command injection vulnerability found in "traceroute.php".
Any OS command can be injected by an authenticated user who has access to
the "SNMP Walk" page. This could lead to a full system compromise.

2) Multiple SQL Injection vulnerabilities (Authenticated User)
Due to insufficient input validation, the application allows the injection
of direct SQL commands. The identified SQL Injection vulnerabilities can
be exploited by an authenticated user who has access to the "Alert Summary"
and "Alert Archive" pages.

3) CSV Formula Injection vulnerability (Authenticated User)
The "Device Manager" page of the application has a "CSV export all devices"
feature which allows the export of device data (name, device IP, objects,
and so on) as a CSV file. On the "Device Creator" page, it is possible to
input a malicious formula that will be embedded inside an exported CSV file.
This vulnerability can be exploited by an authenticated user who has access to
the "Device Creator" page.


Proof of concept:
-----------------
PoC has been removed as no patch is available and the vendor is unresponsive.


Vulnerable / tested versions:
-----------------------------
SevOne Network Management System (NMS) version 5.7.2.22 has been tested.
Previous versions may also be affected.


Vendor contact timeline:
------------------------
2020-08-04: Contacting vendor through infosec-cases@sevone.com; no response
2020-08-12: Follow-up with vendor; no response
2020-08-26: Follow-up with vendor; no response
2020-09-14: Follow-up with vendor; no response
2020-10-02: Public release of the security advisory


Solution:
---------
The vendor did not respond to our communication attempts, hence no patch is
available.


Workaround:
-----------
None


Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/contact/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF C. Phang / @2020


Login or Register to add favorites

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    18 Files
  • 22
    Oct 22nd
    16 Files
  • 23
    Oct 23rd
    2 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close