CVE-2014-5445 : Détail

CVE-2014-5445

Directory Traversal
A01-Broken Access Control
91.59%V4
Network
2014-12-04
16h00 +00:00
2018-10-09
16h57 +00:00
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Multiple absolute path traversal vulnerabilities in ZOHO ManageEngine Netflow Analyzer 8.6 through 10.2 and IT360 10.3 allow remote attackers or remote authenticated users to read arbitrary files via a full pathname in the schFilePath parameter to the (1) CSVServlet or (2) CReportPDFServlet servlet.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 5 AV:N/AC:L/Au:N/C:P/I:N/A:N nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Informations sur l'Exploit

Exploit Database EDB-ID : 43895

Date de publication : 2014-12-02 23h00 +00:00
Auteur : Pedro Ribeiro
EDB Vérifié : No

>> Arbitrary file download in ManageEngine Netflow Analyzer and IT360 >> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security ========================================================================== Disclosure: 30/11/2014 / Last updated: 3/12/2014 >> Background on the affected product: "NetFlow Analyzer, a complete traffic analytics tool, leverages flow technologies to provide real time visibility into the network bandwidth performance. NetFlow Analyzer, primarily a bandwidth monitoring tool, has been optimizing thousands of networks across the World by giving holistic view about their network bandwidth and traffic patterns. NetFlow Analyzer is a unified solution that collects, analyzes and reports about what your network bandwidth is being used for and by whom." "Managing mission critical business applications is now made easy through ManageEngine IT360. With agentless monitoring methodology, monitor your applications, servers and databases with ease. Agentless monitoring of your business applications enables you high ROI and low TOC. With integrated network monitoring and bandwidth utilization, quickly troubleshoot any performance related issue with your network and assign issues automatically with ITIL based ServiceDesk integration." This is being released as a 0-day because ManageEngine have been twiddling their thumbs (and making a fool out of me) for 105 days. See timeline below for explanation. >> Technical details: Vulnerability: Arbitrary file download Constraints: unauthenticated in NetFlow; authenticated in IT360 Affected versions: NetFlow v8.6 to v10.2; at least IT360 v10.3 and above CVE-2014-5445: GET /netflow/servlet/CSVServlet?schFilePath=/etc/passwd GET /netflow/servlet/CReportPDFServlet?schFilePath=C:\\boot.ini&pdf=true CVE-2014-5446 GET /netflow/servlet/DisplayChartPDF?filename=../../../../boot.ini All 3 servlets can be exploited in both Windows and Linux. A Metasploit module that exploits CVE-2014-5445 has been released. >> Fix: UNFIXED - ManageEngine failed to take action after 105 days. Timeline of disclosure: 18/08/2014 - Requested contact via ManageEngine Security Response Center. 19/08/2014 - Received contact from the NetFlow Analyzer support team. Responded with the security advisory above detailing the vulnerabilities. - Further back and forth explaining the vulnerabilities, how to exploit them and their impact. 22/08/2014 - Requested information regarding the release date for the fix. Received response "We do not have a ETA on this, I will check with our engineering team and update you." 22/09/2014 - Requested information regarding the release date for the fix. Received response "We expect that the new release will be within the next couple of weeks". 20/10/2014 - Requested information regarding the release date for the fix. Received response "Our new release will be happening early by next week, you can get the update in our NetFlow Analyzer website". - Asked if they are sure that the fix will be included in the new release. Received response "yes you are correct, the issue that you have specified is fixed in new release". 27/10/2014 - NetFlow Analyzer version 10.2 released - still vulnerable. - Sent an email to ManageEngine asking if they are going to release a fix soon. Received response "We will release the PPM file of the upgrade soon, in which we have fixed the Vulnerability you mentioned". 5/11/2014 - Requested information regarding the release date for the fix. Received response "You can expect the release before this month end". 28/11/2014 - Requested information regarding the release date for the fix. Received response "The PPM file is in testing phase and will be released in next Month". - Asked if they can commit to a date. Received response "the ppm is in testing phase now, as it is one of the major release, we will not be able to give an exact date of release". 30/11/2014 - Realised that ManageEngine have been playing me for 105 days, and immediately released advisory and exploit. ================ Agile Information Security Limited http://www.agileinfosec.co.uk/ >> Enabling secure digital business >>

Products Mentioned

Configuraton 0

Zohocorp>>Manageengine_it360 >> Version 10.3.0

Configuraton 0

Zohocorp>>Manageengine_netflow_analyzer >> Version From (including) 8.6 To (including) 10.2

Références

http://www.securityfocus.com/bid/71404
Tags : vdb-entry, x_refsource_BID
http://seclists.org/fulldisclosure/2014/Dec/9
Tags : mailing-list, x_refsource_FULLDISC