BugTraq
SmarterTools Smarter Track 6-10 - Information Disclosure Vulnerability Sep 26 2014 11:18AM
Vulnerability Lab (research vulnerability-lab com)
Document Title:
===============
SmarterTools Smarter Track 6-10 - Information Disclosure

References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1298

Tracking ID: 088-1B879F0C-0A22

Release Date:
=============
2014-09-22

Vulnerability Laboratory ID (VL-ID):
====================================
1298

Common Vulnerability Scoring System:
====================================
6.1

Product & Service Introduction:
===============================
SmarterTrack is a powerful communications platform that acts as an online help desk for initiating, tracking, managing and reporting
on a number of different communication channels. Whether it is a ticket submission via email or from the online portal, a live chat,
a community post, comments made on a knowledge base article or more, SmarterTrack provides a centralized outlet for all communication
channels and is an ideal solution for building your online community.

( Copy of the Vendor Homepage: http://www.smartertools.com/smartertrack/help-desk-software.aspx )

Abstract Advisory Information:
==============================
An independent Vulnerability Laboratory Researcher discovered an Information Disclosure issue in the official SmarterTools Smarter Track v6,v7,v8,v9 & v10.

Vulnerability Disclosure Timeline:
==================================
2014-08-23: Researcher Notification & Coordination (Ehsan Vahab )
2014-08-23: Vendor Notification (Smartertools Security Team)
2014-08-25: Vendor Response/Feedback (Smartertools Security Team)
2014-09-21: Vendor Fix/Patch Notification (Smartertools - Developer Team)
2014-09-22: Public Disclosure (Vulnerability Laboratory)

Discovery Status:
=================
Published

Affected Product(s):
====================

Exploitation Technique:
=======================
Remote

Severity Level:
===============
Medium

Technical Details & Description:
================================
An Information Disclosure vulnerability has been discovered in the smarter track v(6,7,8,9,10) web-application.
The information disclosure issue allows a remote attacker to gain unauthorized access to available mail conversations.

The vulnerability allows remote attackers to get all of the mail messages that gets transfered between the customer and application owner.
The vulnerability is located in the AvatarHandler.ashx file with vulnerable query string parameter `logoid`.
remote attackers are able to change in the GET method request the logoid and can download the .zip files that contains the .eml
(outlook extension) file. The .eml file impact admin or user messages. If the logoid was wrong the zip file capacity is 0 byte
and download is not possible.

Exploitation of the vulnerability requires no privileged web application user account and also no user interaction.
Successful exploitation of the issue results in unauthorized access to private server communication via email support.

Request method(s):
[+] GET

Vulnerable File(s):
[+] AvatarHandler.ashx

Vulnerabel ´Parameter(s):
[+] logoid

Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers without privileged application user account and also without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Google Dork :
inurl:/kb/root.aspx

PoC :
smartertrack.localhost.com/AvatarHandler.ashx?logoid=[vulnerable number]

Wrong logoid:
http://support.xxx.com/AvatarHandler.ashx?logoid=182206

Correct logoid:
http://support.xxx.com/AvatarHandler.ashx?logoid=208758
http://support.xxx.com/AvatarHandler.ashx?logoid=208765
http://support.xxx.com/AvatarHandler.ashx?logoid=208766

Solution - Fix & Patch:
=======================
2014-09-21: Vendor Fix/Patch Notification (Smartertools - Developer Team)

Security Risk:
==============
The security risk of the information dsiclosure issue is estimated as medium(+).

Credits & Authors:
==================
Ehsan Vahab (https://www.linkedin.com/profile/view?id=305567696)

Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin (at) vulnerability-lab (dot) com [email concealed] - research (at) vulnerability-lab (dot) com [email concealed] - admin (at) evolution-sec (dot) com [email concealed]
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin (at) vulnerability-lab (dot) com [email concealed] or research (at) vulnerability-lab (dot) com [email concealed]) to get a permission.

Copyright © 2014 | Vulnerability Laboratory [Evolution Security]

--
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research (at) vulnerability-lab (dot) com [email concealed]

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus