Title: Solarwinds LEM Hardcoded Credentials
Advisory ID: KL-001-2017-015
Publication Date: 2017.07.06
Publication URL: https://www.korelogic.com/
1. Vulnerability Details
Affected Vendor: Solarwinds
Affected Product: Log and Event Manager Virtual Appliance
Affected Version: v6.3.1
Platform: Embedded Linux
CWE Classification: CWE-798: Use of Hard-coded Credentials
Impact: Unintended Access
Attack vector: Local
2. Vulnerability Description
The appliance contains multiple hardcoded passwords and hash
digests.
3. Technical Description
# grep "password" /usr/local/jetty/scripts/
output_password = QDXTCDD2nJIU
# grep "password" /usr/local/jetty/scripts/
output_password = QDXTCDD2nJIU
# grep "password" /usr/local/contego/scripts/
output_password = QDXTCDD2nJIU
# grep -i "password" /usr/local/jetty/etc/jetty-
<Set name="password">q4ROVdYYsV5M</
<Set name="keyPassword">
<Set name="trustPassword">
# grep -i "password" /usr/local/contego/scripts/ind
my $PASSWORD = "omgcontegorox";
# grep -i "password" /usr/local/contego/scripts/
CREATE ROLE trigeo WITH CREATEDB LOGIN PASSWORD 'rootme';
CREATE ROLE contego WITH CREATEDB LOGIN PASSWORD 'reports';
//Empty Password
# grep -i "password" /usr/local/contego/run/
CREATE USER SA PASSWORD DIGEST '
# grep -i "password" /usr/local/contego/run/
InDepthMaintenPassword=tVyf+
InDepthManagerPassword=
// cracks to "welcome" without quotes
# grep -i "password" /usr/local/contego/run/tomcat/
<user username="manager" password="
<user username="administrator" password="
<user username="auditor" password="
<user username="monitor" password="
<user username="contact" password="
<user username="user" password="
# grep -i "password" /usr/local/contego/run/system.
archive.password=omgcontegorox
backup.password=omgcontegorox
logbackup.password=
# grep -i "password" /usr/local/contego/run/daemon-
my $tls = "-Djavax.net.ssl.keyStore=/
-Djavax.net.ssl.
-Djavax.net.ssl.
# grep -i "password" /usr/local/contego/run/
PSQLPassword=
ForensicPassword=BosMXyGmaT/
# grep -i "password" /var/rawdata/cores/solr.conf
query_password=
//hardcoded md5
# grep -i "password" /var/alertdata/hsql/alertdb.
CREATE USER SA PASSWORD DIGEST '
CREATE USER "trigeo" PASSWORD DIGEST '
4. Mitigation and Remediation Recommendation
The vendor has released a Hotfix to remediate this
vulnerability. Hotfix and installation instructions are
available at:
https://support.solarwinds.
http://downloads.solarwinds.
5. Credit
This vulnerability was discovered by Matt Bergin (@thatguylevel)
of KoreLogic, Inc. and Joshua Hardin.
6. Disclosure Timeline
2017.04.06 - KoreLogic submits vulnerability report and PoC to
Solarwinds contact.
2017.05.15 - Solarwinds notifies KoreLogic that a hotfix
addressing this issue will be available at the end
of June.
2017.05.18 - 30 business days have elapsed since this issue was
reported.
2017.06.09 - 45 business days have elapsed since this issue was
reported.
2017.06.29 - Solarwinds releases hotfix.
2017.07.06 - KoreLogic public disclosure.
7. Proof of Concept
See 3. Technical Description
The contents of this advisory are copyright(c) 2017
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http://creativecommons.org/
KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https://www.korelogic.com/
Our public vulnerability disclosure policy is available at:
https://www.korelogic.com/
Komentarų nėra:
Rašyti komentarą