ManageEngine EventLog Analyzer 10.8 Privilege Escalation
Posted on 12 February 2016
# ManageEngine EventLog Analyzer v10.8 # Date: 2/9/2016 # Exploit Author: @GraphX # Vendor Homepage: http://www.manageengine.com # Version: 10.8 1 Description: It is possible for a remote authenticated attacker using an unprivileged account to gain access to the admin account via parameter manipulation using the account settings tab and the browser developers console. By changing the userName field to be the name of the admin user, an attacker can successfully overwrite the admin user password and then login as the admin user. 2) Proof of Concept 1)Login to the eventlog analyzer as an unprivileged account. 2)Navigate to the settings tabs and click on the account settings link 3)With the developer's console open or using an interception proxy, change the userName field from "guest" to "admin" 4)Change the password and click submit (admin password will be overwritten) 5)login as admin with your new password </tr></tbody></table> <input name="addField" value="false"> <input name="userName" value="guest"> //Change the value of this field from guest to admin. <input name="userID" value="2"> <input name="changePassword" value="false"> <input name="domainName" value=""> <input name="isPlugin" value="false"> 3 Solution: Vendor states fix will be included in next service pack. Provided by ManageEngine: 1. Stop the EventLog Analyzer service. 2. Download and extract LogAnalyzerClient folder from the below link to <EventLog Home>\lib. http://bonitas2.zohocorp.com/zipUploads/2016_03_02_21_24_32_o_1aajte2mb1sri3ra1875gi312581.tar.gz 3. You will see a file " UserManagementAction.class " under the folder structure after extraction, <EventLog Home>\lib\LogAnalyzerClient\com\adventnet\la\webclient 4. Start the EventLog Analyzer service. This is very similar to http://seclists.org/bugtraq/2016/Feb/65 It appears that ManageEngine shares code across many of their products. This vulnerability has also been found in the ManageEngine Network Configuration. Timeline: 1/14/16 Initial Vendor Contact: Support ID [##2708539##] 2/3/16 patch provided for testing (see above) 2/8/16 Fix confirmed
