================================================================================ Secur-I Research Group Security Advisory [SRG-2011-002] ================================================================================ Title : ManageEngine ServiceDesk Plus Improper User Privileges Management Vulnerability Product : ServiceDesk Plus (http://www.manageengine.com/) Affected Version : 8.0 (Other versions could also be affected) Fixed Version : N/A Vunerability Impact : High Advisory ID : SV-002 Pubished Date : 26-JUL-2011 Author : Narendra Shinde Secur-I Research Group http://www.securview.com/ ================================================================================ Product Introduction -------------------- ServiceDesk Plus integrates your help desk requests and assets to help you manage your IT effectively. It helps you implement ITIL best practices and troubleshoot IT service requests faster. ServiceDesk Plus is highly customizable, easy-to-implement help desk software. More than 10,000 IT managers worldwide use ServiceDesk Plus to manage their IT help desk and assets.ServiceDesk Plus is available in 23 different languages. Source: http://www.manageengine.com/products/service-desk/ Vulnerability Information ------------------------- Class: Improper Privilege Management [CWE-269] Impact: Low privileged user can modify application data Remotely Exploitable: Yes Authentication Required: Yes User interaction required: Yes CVE Name: N/A Vulnerability Description ------------------------- A user with limited privileges could gain access to certain functionality that is available only to administrative users. For example, users with Guest privileges could delete backup database from the system by submitting a malicious URI to the vulnerable application. This is due to insufficient security checks on user permissions while completing the backup database deletion operation. Proof-of-Concept ---------------- An attacker could delete the database backup for the vulnerable application using the following URI: http://vulnserver/BackupSchedule.do?module=delete_backup&backup_ids=[ID] By default, backup_ids start with a numeric value of 301. Fixes/Workarounds ----------------- Currently there is no vendor supplied fix available for this vulnerability at the time of this publication. Users are advised to limit exposure by enforcing appropriate firewall rules. TimeLine -------- Notification to Vendor: 11-Jul-2011 Vendor Confirmation : 14-Jul-2011 Public Disclosure : 26-Jul-2011 Thanks & Regards, Narendra. Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium.