Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2 Build 9207 (Other versions could also be affected) Fixed Version: 9.2 Build 9228 (Released on: 29 September 2016) URL readme fixed version: https://www.manageengine.com/products/service-desk/readme-9.2.html Vendor ID report: SD-63280, SD-63281, SD-63282, SD-63283 Product Introduction ========================== ServiceDesk Plus is ITIL-ready help desk software with integrated Assetand Project Management capabilities. With advanced ITSM functionality and easy-to-use capability, ServiceDesk Plus helps IT support teams deliver world-class service to end users with reduced costs and complexity. It comes in three editions and is available in 29 different languages. Over 100,000 organizations, across 185 countries, trust ServiceDesk Plus to optimize IT service desk performance and achieve high end user satisfaction. Source: https://www.manageengine.com/products/service-desk/ Vulnerability Information ========================== Class: Improper Privilege Management Impact: Low privileged user can access sensetive data Remotely Exploitable: Yes Authentication Required: Yes User interaction required: Yes CVE Name: N/A Vulnerability Description ========================== A user with low privileged can be able view all requests/tickets (include attachments). Vulnerability Details ========================== SD-63280: Low privileged user can change value for "notifyTo" variable to "REQFORWARD" and get advanced features. After, user can change ticket id (variable "id") and see all request include attachments, and send (forward) to email. SD-63281: Using low privileged user can send "Submit for Approval" e-mail even if the user don't have a necessary permission to view the request. SD-63282: Using low privileged user can able to view the other user's assets by using the below URL. (Able to view the associated assets of administrator user using guest login) SD-63283: Low privileged user can change value for "viewType" variable to "All" and see preview all requests. Proof-of-Concept ========================== SD-63280: http://localhost:9090/SDNotify.do?notifyModule=Request&mode=E-Mail&id=1&notifyTo=REQFORWARD SD-63281: http://localhost:9090/SubmitForApproval.do?ITEMID=1&MODULE=Request SD-63282: http://localhost:9090/UserAssets.do?userId=3 SD-63283: http://localhost:9090/ListRequests.do?reqId=1&viewType=All Timeline ========================== 09-04-2016: Notification Vendor. 02-06-2016: Vendor set ID's vulnerability. 29-09-2016: Vulnerability fixed.