=================================================== ADAUDIT PLUS ON-LINE DEMO TomCat Directory Listing / CSRF / Password field Submited using GET Method / OPTIONS Method =================================================== 08-09-2013 Security Advisory 14-09-2013 Response "The vendor has not problem with the flaws in the "demo" on line." 17-09-2013 Full Disclosure I. VULNERABILITY ------------------------- #Author:Juan Carlos Garca (@secnight) #Follow me Twitter:@secnight II. DESCRIPTION ------------------------- ADAuditPlus is a simple Active Directory Auditing and Reporting to helps AD Administrators and Help Desk Technicians with their day-to-day activities. With a centralized and Intuitive web-based UI, the software handles a variety of complex tasks like Bulk Management of User accounts and other AD objects, Delegate Role based access to Help Desk Technicians,and generates an exhaustive list of AD Reports, some of which are an essential requirement to satisfy Compliance Audits. This Active Directory tool also offers mobile AD apps that empower you to perform important user management tasks right from you mobile devices. Active Directory alerts and email notification Active Directory audit and compliance Active Directory audit reports Group Policy audit reports Tracking user management actions user Logon Audit Reports Reports from archive data Track user logon actions Schedule Active Directory change reports Windows Active Directory Monitoring User management audit reports GPO change auditing DISNEY, NASA, ACCENTURE OR SONY USE THIS TOOL ... III. PROOF OF CONCEPT *********************** Tomcat directory listing *************************** /adsf /adsf/js /adsf/js/common /adsf/js/common/components /adsf/js/layout /help/troubleshooting /help/welcome /images/ads /images/ads/blue /images/ads/common /images/ads/green /images/blue /images/green /js/framework /styles /styles/ads /styles/ads/blue /styles/ads/green /styles/blue /styles/green Password type input with autocomplete enabled /AddOnIntegration.do /DomainConfig.do (1200dfb30a115695f01f3ae6fa6e5189) /DomainConfig.do (62d40088a4a4be34e12f6020280f760c) /mailServerSettings.do (54cfa2363cbb4cc2c909301b43bfd2fa) /TechnicianConfiguration.do /TechnicianConfiguration.do (5e72876e52b3655fef586fdccb45295a) /ViewNetAppFilers.do (e25d53aac4030269c11d6a40e94e7d5c) CSRF HTML form without CSRF protection ************************************** Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Affected Items ------------------ /AddOnIntegration.do /Admin.do /AuditAlerts.do (6d9bb43f2bd7065990c8a1e238988260) /AuditAlerts.do (9b5f21f8edd13ce65861e348d41982e4) /AuditAlerts.do (d57a4acdd7c0798d7080b5469f62ce50) /AuditReports.do (3510295fcef2c20bcc6cd54aaa33cdbd) /AuditReports.do (e398fa07aee5eb80e16c5535ff3c16ba) /BusinessHourSettings.do (c78248309f8c1ed81177f784a0e09b5a) /clearAlertsPage.do (db53e01acc5c5e2e3ef78d3110d009a5) /clearAlertsPage.do (f562ce77d473c8c897f38a7fcff604d3) /ConfigureDiskFreeSpace.do (6fa855a47ed265b84d233dcd16d5613f) /ConfiguredPrintServers.do (97058e2da17863ded4f6e6835bb58dce) /ConfigureServiceAccounts.do /ConfigureServiceAccounts.do (e22b2f30fe810fce6c1dadca052f00d0) /CreateAlertProfile.do /CreateAuditAction.do (11d407ca4f8b52f46c90a176411b75ac) /CreateAuditAction.do (48400010ef4cf3819cd4f457bfdf60a3) /CreateMonitor.do (17e6dfe819e8c6c9b74354451458b0be) /CreateMonitor.do (1dc247ee02d117c3f6614174e4d481af) /CreateMonitor.do (2a2cdc9e48077e73dee0346269ebe1cd) /CreateMonitor.do (569f112609441a95291904481fc867f3) /CreateMonitor.do (64ace2c835c919045cbdd8149855e0db) /CreateMonitor.do (8053cb9c721c6578df46b8f2e4470f65) /CreateMonitor.do (8d7fe9d986988cc6923bbee1975b9029) /CreateMonitor.do (d4a815b7c041cb77b6f2b926c70d3d2e) /DomainConfig.do (1200dfb30a115695f01f3ae6fa6e5189) /DomainConfig.do (62d40088a4a4be34e12f6020280f760c) /Home.do /mailServerSettings.do (54cfa2363cbb4cc2c909301b43bfd2fa) /ModifyAlertProfile.do (81994df334421bb63ef0f8c7b0c6c760) /ModifyAuditAction.do (10e5263d4344a042371512536ba9b7e9) /ModifyAuditAction.do (1a920dcbf7672e515f99e1ffbce83779) /ModifyAuditAction.do (1c8d15b9f700cb8f35eea0e051372d65) /ModifyAuditAction.do (1ee29d33c136a2b67a300052b1891971) /ModifyAuditAction.do (25fffa415a11304aba6fac271dfb9d5c) /ModifyAuditAction.do (35cf2224c8f4a076f6808bca51293206) /ModifyAuditAction.do (37939d16e21e6f5080d88c7bcbe24615) /ModifyAuditAction.do (58a439b57ee4dad43d77beb8e3e6ce5c) /ModifyAuditAction.do (68d2ebe7d262e0e8ba0b0e010bf10710) /ModifyAuditAction.do (6dc19527183b9dfe0f941f26d0dadcd1) /ModifyAuditAction.do (6e606cfbb98d6f33902f3319904f1e41) /ModifyAuditAction.do (7715d20509aaf599e43124ac8f9b635c) /ModifyAuditAction.do (7dfca018bfaef68d49f5ecfb11eaa9e6) /ModifyAuditAction.do (a7495aef9b347b446727a1820df88540) /ModifyAuditAction.do (aece10082192567d9c773dcf664bfcf2) /ModifyAuditAction.do (c6e1f4c2e39f58d8a759155e1f59eed7) /ModifyAuditAction.do (d0e61de374e5e13fbc25a630cf5bd481) /ModifyAuditAction.do (daab90a90354e1c3bdea1f41a0f3e250) /ModifyAuditAction.do (e43d678ca6074adaea0d44812f2a9df9) /ModifyAuditAction.do (e76bd6ebcfde8b8fdc1dade908969334) /ModifyAuditAction.do (f1fdcf26099037782cb0b7176ac7190a) /ModifyAuditAction.do (fa8d07184095b3f3a29b88715710e646) /ModifyMonitor.do /ModifyMonitor.do (4171a9f69f4a2fb90d61f71c6398b9e2) /ModifyMonitor.do (52dd972761adec5d86c0eef9408854f4) /ModifyMonitor.do (7e0de36b06bbe4eb26a5d46f0527a42a) /ModifyMonitor.do (9f91fed51557794244c3193620ea0b31) /ModifyMonitor.do (a6373e3090c6958d8e1ad45f6dc14fe1) /ModifyMonitor.do (d4f8ae7d03d8228b70ed37d5115ef03c) /ModifyMonitor.do (f6553ef4dd6a0eb859c6e62b6dbce5fa) /ModifyMonitor.do (fb366a2ad60671cd430216fa2889cae7) /personalisePage.do (adcf13643893cacd456fccf152942a71) /personalisePage.do (bc4456082bc40e3bdaa905a17e1b447d) /personalisePage.do (ff6fec9804b285f9e6b3a7b0ff8977ad) /RestoreEventTables.do (3245de312ade81cfcd70a621b267fd38) /RestoreEventTables.do (b09edf0d6bbacf8d4e40f2ff93ab1c1a) /RestoreEventTables.do (fc2722a0def2f2e517b4f3c4e1354251) /TechnicianConfiguration.do /ViewClusters.do /ViewClusters.do (4a43a03cb9a408895f948d0e35d76e6f) /ViewClusters.do (e25d53aac4030269c11d6a40e94e7d5c) /ViewComputer.do (49c10a71f0b99ca0ef18875f423300c5) /ViewComputer.do (4f6509b9a3dfad8e03d320c5d1f6be91) /ViewComputer.do (779d05794f5407a2d47ae231e79b382d) /ViewFileServers.do /ViewFileServers.do (df22bfd067cd3804c925dffcbd3ae2c1) /ViewMonitor.do (1c1fe03c218164d638918e13959a0154) /ViewMonitor.do (227b3dcf1ad0a58d3084bbd7384b28a2) /ViewMonitor.do (2f067974903713cce4d770636117803d) /ViewMonitor.do (35c622534ec401a11e9d839b118d8fad) /ViewMonitor.do (49bb3be77dc7bce41e91a63c52343cfa) /ViewMonitor.do (4f3645a9811bd238b33697a0ef8c570d) /ViewMonitor.do (53f4e849f1284412ed68827270f9bbb6) /ViewMonitor.do (86d30b77fbcf476e4bd9648dc3bdda1a) /ViewMonitor.do (8c84d61f5561f565069f5e676ddf20d4) /ViewMonitor.do (8d7444e0eae26afeebd6d00edec14090) /ViewMonitor.do (8f3e5737a18111836c6bc96a8a127bc9) /ViewMonitor.do (95ae60c6a899c2dcdcf3f9ee3f3e9ab7) /ViewMonitor.do (9b45fe1593904e6d69905ae47607efa6) /ViewMonitor.do (af6d232105fe888409f1a622460aba94) /ViewMonitor.do (b33277701f00441f37383b2e9b8ce51f) /ViewMonitor.do (dd70bba82123b671654f0c6b03f50098) /ViewMonitor.do (de6cd669e945c9b6c924bea31c13ca62) /ViewMonitor.do (e5b1e63d45ac7a9089ceb27691f7c64c) /ViewMonitor.do (eca565d9bd367f0c6d5939cd45cf00a7) /ViewMonitor.do (f3711cf0032e486cd77376fcb4ccc1ff) /ViewMonitor.do (f9eb02946d5f2536955523d1f7cd8665) /ViewMonitor.do (fc6a074c4676998689241adbf2f63c0b) /ViewNetAppFilers.do /ViewNetAppFilers.do (e25d53aac4030269c11d6a40e94e7d5c) Password field submitted using GET method ***************************************** Vulnerability description ----------------------------- This page contains a form with a password field. This form submits user data using the GET method, therefore the contents of the password field will appear in the URL. Sensitive information should not be passed via the URL. URLs could be logged or leaked via the Referer header. Affected items ---------------------- /TechnicianConfiguration.do Attack details ------------------- form name: "TechnicianConfiguration" form action: "" password input: "password" The impact of this vulnerability ----------------------------------- Possible sensitive information disclosure. How to fix this vulnerability ------------------------------------ The password field should be submitted through POST instead of GET. IV. BUSINESS IMPACT ------------------------- DEMO = Security Flaws REAL = ¿? ( D'OH ) V SOLUTION ------------------------ Write Secure Code FOR Security Tools VI. CREDITS ------------------------- This vulnerability has been discovered by Juan Carlos Garca(@secnight) VII. LEGAL NOTICES ------------------------- The Author accepts no responsibility for any damage caused by the use or misuse of this information.