Exploit-DB #35915
Description: Symantec Data Center Security - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2015-01-26
Author: SEC Consult

Exploit:
SEC Consult Vulnerability Lab Security Advisory < 20150122-0 >
=======================================================================
             title: Multiple critical vulnerabilities
          products: Symantec Data Center Security: Server Advanced (SDCS:SA)
                    Symantec Critical System Protection (SCSP)
vulnerable version: see: Vulnerable / tested versions
     fixed version: SCSP 5.2.9 MP6, SDCS:SA 6.0 MP1 - not all
                    vulnerabilities were fixed, but mitigations exist
            impact: Critical
        CVE number: CVE-2014-7289, CVE-2014-9224, CVE-2014-9225, CVE-2014-9226
          homepage: http://www.symantec.com
             found: 2014-09-19
                by: Stefan Viehböck
                    SEC Consult Vulnerability Lab
                    https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
"Symantec Data Center Security: Server Advanced v6.0 (DCS: Server Advanced)
extends the Data Center Security: Server solution beyond agentless threat
protections by incorporating technologies previous known as Critical System
Protection. Data Center Security: Server Advanced provides granular, policy-
based controls with a low impact in-guest agent to monitor and protect numerous
physical and virtual server environments. Through a combination of technologies
including application-centric controls including protected white listing,
sandboxing using least privilege access controls, host-based intrusion detection
(HIDS) and prevention (HIPS), and real-time file integrity monitoring (FIM),
organizations can proactively safeguard their heterogeneous server environments
and the information they contain from zero-day and targeted attacks, and fulfill
their compliance mandates across critical systems. Click here for more info"

Source:
http://www.symantec.com/connect/forums/announcing-data-center-security-server-server-advanced-products


Business recommendation:
------------------------
Attackers are able to completely compromise the SDCS:SA Server as they can gain
access at the system and database level. Furthermore attackers can manage all
clients and their policies.

SDCS:SA Server can be used as an entry point into the target infrastructure
(lateral movement, privilege escalation).

Furthermore the SDCS:SA Client protections can be bypassed in several ways.

It is highly recommended by SEC Consult not to use this software until a
thorough security review (SDCS:SA Server, SDCS:SA Client Policies) has been
performed by security professionals and all identified issues have been
resolved.

Note: SDCS:SA was replaced by SCSP. In this document the name SDCS:SA is used.


Vulnerability overview/description:
-----------------------------------
1) Unauthenticated SQL Injection (SDCS:SA Server) (CVE-2014-7289)
Due to insufficient input validation, the application allows the injection
of direct SQL commands. By exploiting the vulnerability, an attacker gains
access (read/write) to all records stored in the database as arbitrary SQL
statements can be executed.

Furthermore the application design enables an attacker to gain code execution
as SYSTEM (highest privilege Windows user) on the server by exploiting this
vulnerability.

No prior authentication is needed to exploit this vulnerability.

Affected script:
https://<host>:4443/sis-ui/authenticate


2) Reflected Cross-Site-Scripting (XSS) (SDCS:SA Server) (CVE-2014-9224)
The applications suffers from a reflected cross-site scripting vulnerability,
which allows an attacker to steal other users' sessions, to impersonate other
users and to gain unauthorized access to the admin interface.

Affected scripts:
https://<host>:8081/webui/Khaki_docs/SSO-Error.jsp
https://<host>:8081/webui/admin/WCUnsupportedClass.jsp


3) Information Disclosure (SDCS:SA Server) (CVE-2014-9225)
A script discloses internal information about the application on the server
without prior authentication. This information includes file paths on the
webserver, version information (OS, Java) and is accessible without prior
authentication.

Affected script:
https://<host>:8081/webui/admin/environment.jsp


4) Multiple Default Security Protection Policy Bypasses (SDCS:SA Client)
(CVE-2014-9226)
Several bypasses were discovered. These require Windows Administrator
permissions. This requirement is usually met in SDCS:SA deployments.

Note: SEC Consult did not check whether the mitigations provided by Symantec do
in fact sufficiently mitigate these vulnerabilities!

- Persistent code execution via Windows Services
The default Symantec policy rules can be bypassed in order to get persistent
arbitrary code execution.

- Remote code execution via RPC
The default Symantec policy rules can be bypassed in order to get persistent
arbitrary code execution. In addition to that "psexec-style" remote code
execution via SMB is possible as well.

- Policy bypass: Extraction of Windows passwords/hashes
The default Symantec policy rules do not prevent attackers from extracting
the Windows passwords/password hashes from the System.

- Privilege elevation via Windows Installer (msiexec.exe)
The restrictions imposed by the default policies can be bypassed entirely by
exploiting incorrect assumptions made in the policy regarding the Windows
Installer (msiexec.exe).

- Privilege elevation/code execution via Windows Management Instrumentation
(.mof files)
The restrictions imposed by default policies can be bypassed partially by
exploiting incorrect assumptions made in the policy regarding the Windows
Management Instrumentation. The policy does not take intended OS functionality
to execute code into account.

Proof of concept:
-----------------
1) Unauthenticated SQL Injection (SDCS:SA Server) (CVE-2014-7289)
The servlet accessible via /sis-ui/authenticate (TCP