Exploit-DB #37322
Description: ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2015-06-19
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
ManageEngine SupportCenter Plus 7.90 - Multiple Vulnerabilities


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1501


Release Date:
=============
2015-06-19


Vulnerability Laboratory ID (VL-ID):
====================================
1501


Common Vulnerability Scoring System:
====================================
6.9


Product & Service Introduction:
===============================
SupportCenter Plus is a web-based customer support software that lets organizations effectively manage customer tickets, their account and 
contact information, the service contracts and in the process providing a superior customer experience. SupportCenter Plus is commonly deployed on 
internet accessible interfaces to allow customers to access the application. This common deployment scenario often involves a combination of 
low privilege accounts for customers (typically local authentication) and higher privilege accounts for help desk stuff (typically Active Directory 
integrated). Note that it is not unusual to allow any internet user to be able to register a low privilege account. This deployment scenario is 
important to consider when evaluating the risk of the below vulnerabilities.

(Copy of the Vendor Homepage: https://www.manageengine.com/products/support-center/ )


Abstract Advisory Information:
==============================
An indepndent vulnerability researcher discovered multiple vulnerabilities in the official ManageEngine SupportCenter Plus v7.90 web-application.


Vulnerability Disclosure Timeline:
==================================
2015-05-27:	Researcher Notification & Coordination (Alain Homewood)
2015-06-19:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Manage Engine
Product: SupportCenter Plus - Web Application 7.90


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
1.1 Improper authentication disclosing password (Authenticated)
Missing user access control mechanisms allow low privilege users to gain unauthorised access to sensitive Active Directory integration functionality normally only accessibly by Administrators. 
This functionality allows a low privilege user to:
1.) Retrieve the plain text user name and password for the domain account (typically Domain Administrator or similar) used to integrate with Active Directory
2.) Configure arbitrary domains to be used for authentication and import users from these domains (overwriting existing user records)

A low privilege user in SupportCenter Plus can gain privileged access to both the application and any integrated domains. Typical attack scenarios could include:
1.) SupportCenter Plus is accessible via the internet. An internet based attacker who can gain access to a low privilege account (registering an account if enabled or stealing an account) can gain access to highly privileged domain credentials. The attacker can then use these credentials to gain remote access to the organisation through other means (e.g. VPNs or physically in a meeting room at the organisation).
2.) SupportCenter Plus is not accessible via the internet. An attacker who has gained a low level of compromise in an organisation (i.e. any user who can access SupportCenter Plus) can use these vulnerabilities to escalate themselves to domain administrator or similar.

Pre-requisites and considerations include:
 - In order to steal existing domain credentials it is necessary for Active Directory integration to have been setup.
 - In order to import users from an attacker controlled domain it is necessary for the SupportCenter Plus server to have network connectivity to the attacker server (i.e. firewall rules may prevent this)
 - It is possible to login to SupportCenter Plus using domain authentication even when this option is hidden (typically done so that the domain name isn`t displayed on the internet accessible login)


 
1.2 Directory traversal on file upload (Authenticated)
Low privilege users have the ability to attach files to work order requests (e.g. to attach a screenshot). 
This functionality is vulnerable to directory traversal and allows low privilege users to upload files to arbitrary directories.

Potential impacts of this vulnerability include:
1.) Remote code execution ***
2.) Denial of service
3.) Uploading malicious static content to web accessible directories (e.g. JavaScript, malware etc)

*** There are two key limitations to this vulnerability that limit any easily exploitable method for code execution through exploiting the underlying JBoss environment:
1.) A Java compiler is not installed as part of SupportCenter Plus which prevents uploaded JSP files from being executed
2.) The uploaded directory always appends an additional directory (named after the user`s ID) which prevents deployment of a packaged or unpackaged WAR file (or similar)

Despite the above limitations I cannot con conclusively determine that code execution is not possible.



1.3 Reflected cross site scripting (Authenticated)
Multiple authenticated reflected cross site scripting vulnerabilities exist in SupportCenter Plus.

Unsanitised user provided input in the `query` parameter is echoed back to the user during requests to /CustomReportHandler.do.
Only administrators (or similar highly privileged) users with access to the custom report functionality are vulnerable to this attack vector.

Unsanitised user provided input in the `compAcct` parameter is echoed back to user during requests to /jsp/ResetADPwd.jsp.
Unsanitised user provided input in the `redirectTo` parameter is echoed back to user during requests to /jsp/CacheScreenWidth.jsp.
All authenticated users are vulnerable to these a