Netsweeper 4.0.8 - Authentication Bypass (New Profile Creation)

vendor:

Netsweeper

by:

Anastasios Monachos

9,8

CVSS

CRITICAL

Authentication Bypass

287

CWE

Product Name: Netsweeper

Affected Version From: 4.0.8

Affected Version To: 4.0.8

Patch Exists: Yes

Related CWE: CVE-2014-9618

CPE: a:netsweeper:netsweeper

Metasploit: N/A

Other Scripts: N/A

Tags: cve2014,netsweeper,auth-bypass,packetstorm,edb,cve

CVSS Metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nuclei References: https://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz, https://nvd.nist.gov/vuln/detail/CVE-2014-9618, https://www.exploit-db.com/exploits/37933/, http://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html

Nuclei Metadata: {'max-request': 1, 'vendor': 'netsweeper', 'product': 'netsweeper'}

Platforms Tested: None

2014

Netsweeper 4.0.8 – Authentication Bypass (New Profile Creation)

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL.

Mitigation:

Upgrade to latest version.

Source

Exploit-DB raw data:

+-----------------------------------------------------------------+
+ Netsweeper 4.0.8 - Authentication Bypass (New Profile Creation) +
+-----------------------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com
Version 	: 4.0.8 (and probably other versions)
Discovered by  	: Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched      	: Yes
CVE		: CVE-2014-9618

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
Netsweeper's 4.0.8 (and probably other versions) Client Filter Admin portal can be reached at http://netsweeper/webadmin/clientlogin/ and a username/password combination is required to Add a Profile, by setting the "action" parameter to "showdeny" it will force the admin interface to load and subsequently allow any non-authenticated user to create a new profile.

URL Path: http://netsweeper/webadmin/clientlogin/?srid=&action=showdeny&url=

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2
17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public
18-Dec-2014: Confirm fix
17-Jan-2015: CVE assigned CVE-2014-9618
11-Aug-2015: Public disclosure