Author

Calvin Phang

Risk

[

Security Risk Critical

]

0day-ID

0day-ID-35003

Category

web applications

Date add

03-10-2020

Platform

php

=======================================================================
              title: Multiple Vulnerabilities
            product: SevOne Network Management System (NMS)
 vulnerable version: 5.7.2.22
      fixed version:
         CVE number:
             impact: Critical
           homepage: https://www.sevone.com/
              found: 2020-07-16
                 by: Calvin Phang (Office Singapore)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult
                     Europe | Asia | North America

                     https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"SevOne provides modern monitoring and analytics solutions that organizations
need to monitor their networks today, tomorrow and beyond. SevOne simplifies
the extraction and enrichment of metric, flow, and streaming telemetry data
across multi-vendor networks enabling enterprises, carriers and managed services
providers to ensure optimal network operations and performance."

Source: https://www.sevone.com/company/about-us/


Business recommendation:
------------------------
The vendor did not respond to our communication attempts, hence no patch is
available. It's recommended to closely monitor any activities related to NMS.

An in-depth security analysis performed by security professionals is highly
advised, as the software may be affected from further security issues.


Vulnerability overview/description:
-----------------------------------
In order to exploit the identified security issues an attacker needs at
least the following privileges: "view alerts and manage devices"
depending on the role assigned.

1) Command Injection in Traceroute Feature (Authenticated User)
There is a command injection vulnerability found in "traceroute.php".
Any OS command can be injected by an authenticated user who has access to
the "SNMP Walk" page. This could lead to a full system compromise.

2) Multiple SQL Injection vulnerabilities (Authenticated User)
Due to insufficient input validation, the application allows the injection
of direct SQL commands. The identified SQL Injection vulnerabilities can
be exploited by an authenticated user who has access to the "Alert Summary"
and "Alert Archive" pages.

3) CSV Formula Injection vulnerability (Authenticated User)
The "Device Manager" page of the application has a "CSV export all devices"
feature which allows the export of device data (name, device IP, objects,
and so on) as a CSV file. On the "Device Creator" page, it is possible to
input a malicious formula that will be embedded inside an exported CSV file.
This vulnerability can be exploited by an authenticated user who has access to
the "Device Creator" page.


Proof of concept:
-----------------
PoC has been removed as no patch is available and the vendor is unresponsive.


Vulnerable / tested versions:
-----------------------------
SevOne Network Management System (NMS) version 5.7.2.22 has been tested.
Previous versions may also be affected.


Vendor contact timeline:
------------------------
2020-08-04: Contacting vendor through infosec-cases@sevone.com; no response
2020-08-12: Follow-up with vendor; no response
2020-08-26: Follow-up with vendor; no response
2020-09-14: Follow-up with vendor; no response
2020-10-02: Public release of the security advisory


Solution:
---------
The vendor did not respond to our communication attempts, hence no patch is
available.

#  0day.today [2024-11-15]  #