( , ) (, . `.' ) ('. ', ). , ('. ( ) ( (_,) .`), ) _ _, / _____/ / _ \ ____ ____ _____ \____ \==/ /_\ \ _/ ___\/ _ \ / \ / \/ | \\ \__( <_> ) Y Y \ /______ /\___|__ / \___ >____/|__|_| / \/ \/.-. \/ \/:wq (x.0) '=.|w|.=' _='`"``=. presents.. Name : BroadWorks Arbitrary Call Detail Record Eavesdropping Vendor Website : http://broadsoft.com/products/broadworks/ Date Released : November 2, 2010 Affected Software : BroadWorks <= R16 Researcher : Nick Freeman (nick.freeman@security-assessment.com) PDF: http://security-assessment.com/files/advisories/BroadWorks_Call_Detail_Record_Disclosure_Vulnerability.pdf TXT: http://security-assessment.com/files/advisories/BroadWorks_Call_Detail_Record_Disclosure_Vulnerability.txt +-----------+ |Description| +-----------+ Security-Assessment.com discovered an issue regarding privilege separation between different enterprise groups within BroadWorks. This issue allows a user with Attendant Console privileges to view and record live call detail records for any user of the system, including users from other organisations. +------------+ |Exploitation| +------------+ Eavesdropping of call detail records requires knowledge of the target user’s BroadWorks username, e.g. 098765432@serviceprovider.com. BroadWorks uses Client Application Protocol (CAP) XML messages to communicate between client applications and the BroadWorks platform. One of the messages, monitoringUsersRequest, is transmitted by the Attendant Console to BroadWorks during the logon procedure. This command includes a list of usernames that the Attendant Console can monitor for incoming and outgoing calls. A malicious user can replay this message with usernames from other enterprises, and once this operation has completed, all incoming and outgoing calls for the target user(s) will be visible to the Attendant. The following is an example XML message to add a target user (in this case, 098765432@serviceprovider.com) to the monitoring list. This must be sent after successful authentication to the BroadWorks platform. +-----------------------------------------------------------------------------+ | | | | | | | | | | | Client License 3 | | | | 098765432@serviceprovider.com | | | | | | | | | +-----------------------------------------------------------------------------+ A basic proxy is available at http://www.security-assessment.com/files/advisories/bwe.py which can intercept and modify the XML stream, allowing the injection of monitoringUsersRequest packets. +--------+ |Solution| +--------+ A patch is available from Broadsoft for this vulnerability. +------+ |Credit| +------+ Discovered and advised to Broadworks June 2010 by Nick Freeman of Security-Assessment.com. +-----------------------------+ |About Security-Assessment.com| +-----------------------------+ Security-Assessment.com is a New Zealand based world leader in web application testing, network security and penetration testing. Security-Assessment.com services organisations across New Zealand, Australia, Asia Pacific, the United States and the United Kingdom.