-----BEGIN PGP SIGNED MESSAGE-----
-= Security Advisory =-
Advisory: MediaCast Password Dump Vulnerability
Release Date: 04/25/2011
Author: Daniel Clemens [daniel.clemens[at]packetninjas.net]
Application: MediaCast <= 8 (By Inventive, Inc) - http://www.InventiveTec.com
Vulnerabilities exist within the MediaCast application have been discovered that allow
an unauthenticated user to force the application to return critical values (Username
and Password Information) to the end user within verbose error messages.
By sending a GET request to /authenticate_ad_setup_finished.cfm?UserID=<ID>&ClearSession=1
( or /authenticate_ad_setup_finished.cfm?UserID=<ID> )
usernames and passwords of previously cached Active Directory
credentials would be displayed as well as specific application level user name and
password information (which at times could differ from AD credentials if the
credentials have been updated within Active Directory and the user hasn't logged into
the web application with new credentials).
The impact of this vulnerability is that an attacker has the ability to enumerate sequential
usernames as well as the clear text passwords associated with users within the application
and Active Directory Domain.
Further review of the root cause of this vulnerability was not performed during the analysis
of this vulnerability since these issues were discovered during a remote penetration test
of a network in contrast to a dedicated application review.
Besides obvious correlation between verbose error message output and
incorrect or non-existant exception handlers, it appears that this vulnerability
exists due because the following conditions met:
* Incorrect Session Handling and Implementation (on /authenticate_ad_setup_finished.cfm)
* Incorrect Logic implementation
* Clear Text Storage of password information
* Active ldap integration with existing Active Directory Domain
* Possibly a problem with the cold fusion dll that is aiding in the AD integration....
Vendor Status: Patch Available
"MediaCAST combines a Web-enabled learning management system with the tools to create,
manage, and deliver live and on-demand IP multimedia anytime, anywhere. It is feature-rich,
easy-to-use and efficient platform for creating and managing multimedia content and delivering
online learning programs"
Proof of Concept:
Sequential GET Request:
UploadMethod 1 UserID 31337
email [null] emailAddress [null]
<td class='cfdump_td_value'>2009-12-07 09:12:30.000</td>
<td class='cfdump_td_value'>company name</td>
<td class='cfdump_td_value'>[empty string]</td>
July 21, 2010 - Initial Contact with client using MediaCAST which enabled remote root of network
during remote penetration test.
August 11, 2010 - Email contact as well as phone calls placed to vendor
August x, 2010 - Multiple calls to developers, support etc.
August 24, 2010 - Vendor Response
"You are correct that the system was displaying verbose error messages that contained
information that could be used in a nefarious way.
I have turned off the display of this extended debugging information.
I have also addressed the issue with the /authenticate_ad_setup_finished.cfm URL
such that it traps the problematic condition and redirects the user to the login page."
- Patch to the most current version of MediaCast, or patch current MediaCast application.
Misc. Items that should be patched with patched deployed by MediaCast:
1) Default Blue Dragon Administrative Interface exposed to the Internet in default installations.
This should really be bound to localhost:10000
- Misc xss vulns were present in this piece of software.
2) XML Injection - /inventivex/mangetraining/ CP_RIGHTSOURCE , bdclient_Inventive Cookie
3) SQL Injection through /authenticate_ad_setup_finished.cfm
4) SQL Injection MediaCast SQL Injection /inventivex/managetraining [ CP_ENLARGESTYLE cookie ] injection
5) Mediacast Application Information Leakage URI: /inventivex/isptools/release/metadata/globalIncludeFolders.txt
-- snip --
-- snip --
| Daniel Uriah Clemens
| Packetninjas L.L.C | | http://www.packetninjas.net
| c. 205.567.6850 | | o. 866.267.8851
"Moments of sorrow are moments of sobriety"
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----