Zoho OpManager Cross Site Request Forgery / Cross Site Scripting
Posted on 04 June 2016
Reported these 27/08/2015 these were eventually fixed in version 12 because the entire application is based on emberjs now. There are no CVEs for these issues assigned nor is there any acknowledgement of the issues in any patches. Therefore only version 12 fixes these. Multiple stored and reflected XSS as well as CSRF. There are also multiple issues related to content-type and one related to overwriting local files that wasn't reported and passwords being disclosed. Basically prior to version 12 opmanager is riddled with security issues The following are stored XSS: /admin/ConfigURLMonitor.do [fieldname] /admin/MaintenanceTask.do [selectedAvailableDevices] /admin/MaintenanceTask.do [selectedDevicesToMove] /admin/ScheduleMgmt.do [repName] /api/json/admin/getSysLogForwarders [destHost] /api/json/device/getDeviceSummary [clName] /api/json/reports/getReportsList [repName] /devices/AddNewCF.do [fieldname] /devices/DeviceCustomFields.do [fieldname] /devices/manageUnmanage.do [fieldname] /devices/manageUnmanage.do [fieldname] /reports/ReportsIndex.do [repName] /reports/ReportsIndex.do [repName] The following are reflected XSS attacks /admin/AddDeviceTypeForm.do [oid] /admin/AddDeviceTypeForm.do [operationmode] /admin/ConfigURLMonitor.do [ipAddress] /admin/DependencyList.do [selectedTab] /admin/DependencyList.do [selectedTab] /admin/DeviceAssociation.do [selectedTab] /admin/EditDeviceGraph.do [operation] /admin/InvokeDeviceType.do [PAGE_NUMBER] /admin/MaintenanceTask.do [selectedAvailableDevices] /admin/MaintenanceTask.do [selectedDevicesToMove] /admin/MaintenanceTask.do [taskID] /admin/MibTool.do [selectedmib] /admin/SNMPTrapProcessors.do [PAGE_NUMBER] /admin/SNMPTrapProcessors.do [PAGE_NUMBER] /admin/SNMPTrapProcessors.do [operation] /admin/SNMPTrapProcessors.do [operation] /admin/SNMPTrapProcessors.do [operation] /admin/SNMPTrapProcessors.do [operation] /admin/ServiceConfiguration.do [operation] /admin/ServiceConfiguration.do [operation] /admin/ServiceConfiguration.do [operation] /admin/SetupSDesk.do [AutoSync] /admin/SetupSDesk.do [Merge] /admin/SetupSDesk.do [ticketType] /admin/SysLogRules.do [SysLogPort] /admin/SysLogRules.do [SysLogPort] /admin/SysLogRules.do [status] /admin/TrapConfiguration.do [PAGE_NUMBER] /admin/TrapConfiguration.do [status] /admin/ViewFailoverDetails.do [endDate] /admin/ViewFailoverDetails.do [endDate] /admin/ViewFailoverDetails.do [endHour] /admin/ViewFailoverDetails.do [endHour] /admin/ViewFailoverDetails.do [startDate] /admin/ViewFailoverDetails.do [startDate] /admin/ViewFailoverDetails.do [startHour] /admin/ViewFailoverDetails.do [startHour] /admin/ViewFailoverDetails.do [viewLength] /customDashboard.do [dashboardName] /devices/AddNewCF.do [fieldname] /devices/AddNewCF.do [type] /devices/CustomLinks.do [name] /devices/DeviceCustomFields.do [type] /devices/Search.do [searchTerm] /devices/deviceinfo.do [devicename] /devices/graphview.do [name] /devices/manageUnmanage.do [displayName] /devices/manageUnmanage.do [ipAddress] /devices/objectdetails.do [displayName] /devices/objectdetails.do [ipAddress] /devices/updateStatus.do [displayName] /devices/updateStatus.do [ipAddress] /fault/AlarmView.do [displayName] /map/AddFileMonitor.do [devicename] /map/AddFileMonitor.do [displayName] /map/AddFileMonitor.do [ipAddress] /map/AddNotification.do [devicename] /map/AddNotification.do [displayName] /map/AddNotification.do [ipAddress] /map/AddProcesses.do [deviceName] /map/AddProcesses.do [displayName] /map/AddProcesses.do [ipAddress] /map/AddServices.do [devicename] /map/AddServices.do [devicename] /map/AddServices.do [devicename] /map/EditMap.do [source] /map/FileMonitorTemplates.do [devicename] /map/FileMonitorTemplates.do [monitorType] /map/InvokeDeviceType.do [devicename] /map/InvokeDeviceType.do [devicename] /map/InvokeDeviceType.do [devicename] /map/InvokeMonitoring.do [devicename] /map/InvokeMonitoring.do [devicename] /map/MapView.do [displayName] /map/SnpUpdateServices.do [displayName] /map/SnpUpdateServices.do [ipAddress] /map/UpdateDeviceType.do [devicename] /modifyDashboard.do [dashboardName] /reports/Availability.do [bview] /reports/Availability.do [reportGroup] /reports/Availability.do [reportGroup] /reports/Availability.do [reportGroup] /reports/Availability.do [reportGroup] /reports/Availability.do [reportGroup] /reports/Availability.do [viewCount] /reports/NewReport.do [repName] /reports/NewReport.do [repName] /reports/NewReport.do [repName] /reports/NewReport.do [repName] /reports/deviceAvailability.do [deviceName] /reports/deviceAvailability.do [deviceName] /reports/deviceAvailability.do [deviceName] /reports/deviceAvailability.do [deviceName] /webclient/admin/jsp/DeviceQuery.jsp [oidtext] Vulnerable to CSRF: /SavePreferences.do /TabMenu.do /admin/AddCriteria.do /admin/AddIPSLAMonitor.do /admin/BenchmarkDataUpload.do /admin/BulkDeviceAssociation.do /admin/BulkEditDeviceGraph.do /admin/CategoryOperation.do /admin/ConfigureProfile.do /admin/DBManagement.do /admin/DependencyList.do /admin/DeviceAssociation.do /admin/EditInterfaceTemplates.do /admin/EditInterfaceTemplates1.do /admin/ImportWorkflow.do /admin/MaintenanceTask.do /admin/RebrandOPM.do /admin/SNMPTrapProcessors.do /admin/SaveInterfaceTemplates.do /admin/ScheduleMgmt.do /admin/ScriptMonitor.do /admin/ScriptTemplateImport.do /admin/SelectQCW.do /admin/ServiceConfiguration.do /admin/SetupSDesk.do /admin/ShareTemplate.do /admin/SysLogNotification.do /admin/SysLogRules.do /admin/TrapNotification.do /admin/UpdateAlarmEscalation.do /admin/ViewFailoverDetails.do /cctvConfig.do /devices/AddFromCSV.do /devices/CustomLinks.do /devices/switchPortMapTool.do /map/L2Map.do /map/SnmpDetails.do /reports/AuditReport.do /reports/GenerateReports.do /reports/SelectDevice.do /reports/deviceAvailability.do /topo/addNewNetwork.do Additionally GET /api/json/device/getDeviceSummary?name=localhost&apiKey=aaaa&_bbbb :false,"deviceName":"localhost","sysDescr":"","isNetwork":false,"responseTime":"001ms","ipAddress":"127.0.0.1","ramSize":"NA","vendorName":"Unknown","pollUsing":"ICMP","status":"L..schen","community":"public","dnsName":"localhost","availdata":{"Down":0,"Not Monitored":0,"Up":100,"Parent Down":0,"Dependent Unavailable":0,"On Hold":0,"On Maintenance":0},"customLinks":[],"isvCenter":false,"isSNMP":false,"snm This returns the community password for SNMP devices. This can allows someone malicious on the panel or via XSS collect SNMP passwords.
