Title:
======
Hyperic HQ Enterprise|E v4.5.1 - Multiple Vulnerabilities
Date:
=====
2011-08-08
VL-ID:
=====
240
Introduction:
=============
Designed for companies who run large scale business-critical web applications and systems and want world-class support.
Prepare to be amazed. Award-winning Hyperic HQ Enterprise sets the standard for web application monitoring and management.
Out-of-the box, HQ Enterprise can manage every major operating system, and over 75 of the products and technologies most
commonly found in web infrastructures. How much configuration is required between installation and a live monitoring environment?
None. Believe it - HQ will be up, running, and reporting within minutes of installation. Hard to believe? Try it. Think you ve got a
challenging deployment environment? Try us. HQ Enterprise goes wherever applications run. In your data center, in virtualized
environments, and in the cloud: it s all the same to HQ Enterprise. When we say management and monitoring we mean automatic discovery
of software and network resources; automatic reporting of the key indicators of application health and well-being; a rich database of
your software inventory and its operating history; remote control and administration of software resources; alerting, notification,
escalation, and corrective action; and powerful facilities for analysis, visualization, and reporting.
HQ Enterprise has one mission: managing web apps and the stuff that makes web apps run. It was designed for that. The biggest
web operations in the world use it for that.
(Copy of the Vendor Homepage: http://www.hyperic.com/products/enterprise-systems-monitoring)
Abstract:
=========
Vulnerability-Lab Team discovered multiple Web Vulnerabilities on Hyperic HQ Enterprise & the open source edition.
Report-Timeline:
================
2011-08-08: Public or Non-Public Disclosure
Status:
========
Published
Affected Products:
==================
Exploitation-Technique:
=======================
Remote
Severity:
=========
High
Details:
========
1.1
Multiple Input Validation Vulnerabilities are detected (persistent) on Hyper HQ. Remote attackers or local low privileged user accounts
can implement own malicious persistent script codes on application-side to manipulate specific requested content/sections. Local low
privileged accounts can also include persistent frame requests to access with the same rights the log-health or not allowed static-files.
Vulnerable Module(s): (Persistent)
[+] HQ - Roles
[+] java.security.krb5.kdc Q Health / HQ Process Information & Diagnostics
[+] Browse - Monitor - Indikators
Hyper HQ had created a new & own exception-handling on the software/application.The exception handling displays the upcoming input errors
without parsed format in the device config box. Attackers can also execute malicious script codes out of the exception-handling.
Vulnerable Module(s): (Persistent)
[+] Exception-Handling > Applications > All Applications
Pictures:
../ive1.png
../ive2.png
1.2
A client-side cross site scripting vulnerability is detected on the schemes configuration module of the service.
The vulnerability allows to hijack cookies(session-data) of users/administrators via manipulated client-side xss request link.
High user interaktion required for sucessfull exploitation.
Vulnerable Module(s):
[+] Escalation Schemes Configuration
Pictures:
../xss.png
1.3
A cross site request forgery vulnerability is detected on the password change module of the application.
The cross site request forgery attack allows to add a new admin password (u=1 id=1 =admin).
High user interaktion required for sucessfull exploitation.
Vulnerable Modules:
[+] Section UserAdmin Password Change
Pictures:
../csrf.png
Proof of Concept:
=================
The vulnerabilities can be exploited by remote attackers or local & low privileged user accounts.
For demonstration or reproduce ...
1.1
Code Review: HQ Roles [IVE - Persistent]
|
|
| Dashboard Name: |
New Role Dashboard |
|
|
Code Review: java.security.krb5.kdc Module: HQ Health / HQ Process Information & Diagnostics [IVE - Persistent]
- java.rmi.server.codebase = http://h1461735:9093/
- java.rmi.server.hostname = h1461735
- java.runtime.name = Java(TM) SE Runtime Environment
- java.runtime.version = 1.6.0_13-b03
- java.security.krb5.kdc = >"
- java.security.krb5.realm = >"
- java.specification.name = Java Platform API Specification
- java.specification.vendor = Sun Microsystems Inc.
- java.specification.version = 1.6
- java.vendor = Sun Microsystems Inc.
.../PoC/printReport(poc).hqu
Code Review: Browse - Monitor - Indikators [IVE - Persistent]
hyperic.data.escalation.pauseSelect.options[12] = new Option("72 hours", "259200000");
hyperic.data.escalation.pauseSelect.options[13] = new Option("Until Fixed", "9223372036854775807");
HQ View Application Monitor Current Health - >"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>
>"<INCLUDE/EXECUTE PERSISTENT SCRIPT CODE HERE!!!>