var-201512-0022
Vulnerability from variot
eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. eWON is an industrial router product of the Belgian eWON company. A security vulnerability exists in eWON using firmware prior to 10.1s0, which was caused by the program using an unsafe GET HTML command instead of a POST command. An attacker could exploit the vulnerability to perform unauthorized actions. eWON are prone to the following security vulnerabilities: 1. Weak session management vulnerability 2. A cross-site request forgery vulnerability 3. HTML-injection vulnerability 5. Plain text password information disclosure vulnerability 6. A security weakness An attacker can exploit these issues to bypass the authentication mechanism and gain unauthorized access, execute attacker-supplied HTML or JavaScript code in the context of the affected site, steal cookie-based authentication credentials, obtain sensitive information, and perform certain unauthorized actions. This may aid in further attacks. eWON sa Industrial router - Multiple Vulnerabilities
eWON connects the machine across the Internet
Breaking the barrier between industrial applications and IT standards, the mission of eWON is to connect industrial machines securely to the Internet, enabling easy remote access and gathering all types of technical data originating from industrial machines.
Typical applications within the scope of our mission include remote maintenance, predictive maintenance, remote services, asset management, remote metering, multi-site building management, M2M, and more.
AFFECTED PRODUCTS
The following eWON router firmware versions are affected: All eWON firmware versions prior to 10.1s0
Reference https://ics-cert.us-cert.gov/advisories/ICSA-15-342-01
Vulnerabilities
WEAK SESSION MANAGEMENT - FIXED by eWON
CVE-2015-7924
Session remains active even after user performs log off. Session is destroyed only after browser is exited.
CROSS-SITE REQUEST FORGERY ATTACKS - NOT FIXED by eWON
CVE-2015-7925
There is no CSRF token set by the application in any of the forms / pages. Any & all functions can be executed silently without getting validated from authorized user, if / when this issue is exploited.
…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..
eWON saysVerified but won't fix. The current implementation is done by design (the user must be able to submit forms using GET only).
As CSRF attack suggests, the user must be already logged on the eWON using its internet browser and the session must thus be valid on user's browser. However eWON IP must also be known by the attacker knowing that the VPN will set another IP each time the victim connects to eWON.
The connection to an eWON device is only possible by a secured VPN, a point- to-point LAN or a secured LAN.
On their website, eWON describes this issue as following: http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01
Mitigating factors:
Many requirements have to be met for a successful attack:
The attacker needs a valid login to the eWON.
The attacker needs HTTP access to the eWON (e.g. eWON web server exposed to the public Internet).
Also connections to eWON devices should in standard use cases only occur through:
-
a point-to-point LAN, a secured LAN (sniffing the victim IP is not really achievable in these two cases)
-
or a secured VPN (VPN allocated IP address is then defined by the VPN server). —> eWON team just doesn't understand how CSRF works. And continue to assume the device mgmt portal is accessible ONLY over the VPN, P2P LAN or secured LAN. They clearly have not looked at Shodan and / or publicly accessible portals. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..
WEAK RBAC CONTROLS - FIXED by eWON
CVE-2015-7926
The software allows an unauthenticated user to gather information and status of I/O servers through the use of a forged URL.
NOTE: It should be - An unauthorized / low-privileged user can perform several unauthorized actions such as reading, updating, & deleting I/O servers, configurations, enabling/disabling I/O servers, & accessing, deleting valid users. Scenario
Two users
- adm - Default privileged user - can perform all administrative functions
- full rights - [ v o a c f e h j ]
- test - newly created user - no rights - no [ v o a c f e h j ]
Issue 1
It is possible to enumerate valid I/O servers I/O Server list is a set defined list: MEM cbIOSrvList=0 EWON cbIOSrvList=1 MODBUS cbIOSrvList=2 NETMPI ... SNMP cbIOSrvList=4 DF1 ... FINS ... so on ... & others
An unauthorized / unprivileged user can gather information and status of these IO servers in the following manner:
Logged in as ‘test'
Access - http:///rcgi.bin/Edit1IOSrvForm?cbIOSrvList=0&Ac2on=edit
If Response says -> Not Configurable. -> Implies Not a valid I/O
If Response says -> Access Denied -> Implies a valid I/O -> Window Title reveals the I/O server type - example, Modbus IO Server Config, DF1 1O Server Config, n so on
Issue 2
It is possible to modify parameter values of I/O servers directlyUpdating the values when logged in as 'test'
Change POST request to GET Modify param values
http:///rcgi.bin/EditUsrIOSrvForm?edCfgData=MinInterval%3A10%0D %0AMaxInterval%3A268435459%0D%0AReverseCount %3A0&B1=Update&AST_IOSrvNdx=1
Response -> IO Server config updated.
Similarly, other I/O server configuration can be updated. In case an I/O server is not Enabled, it can be enabled and configured with custom values.
Following poc for SNMP I/O Server settings (This IO server communicates with any SNMP device) Enabling and configuring SNMP I/O server (logged in as test)
http:///rcgi.bin/EditAdvUsrIOSrvForm? edEnabledA=1&edGlobAddrA=&edPeriodA=&edGlobAddrB=&edPeriodB=&edGlo bAddrC=&edPeriodC=&B1=Update+Config&IOServer=SNMP
-> IO Server config updated.
Issue 3
Deleting All Users It is possible for a user with no rights to:
- Enumerate configured users
- Delete any & all users.
HTTP GET request to delete a user (when logged in as 'test') (unauthorized request)
http:///rcgi.bin/EditForm?CB2=3&NbCB=4&Opera2onType=DeleteUser
This brings up a confirmation prompt validating if we really want to delete the user.
It presents the username and offers two options - Option 1 - Cancel and Confirm/Delete Option 2 - Select Confirm/Delete ..... Users List test Please confirm you want to delete these items Select Confirm/Delete .....
Next, the url redirects to DeleteForm which then shows Access denied twice ..... -> But the user gets deleted anyway. :) Verify by Refreshing User List
Enumerating Users In order to enumerate valid users, we only need to submit the first DeleteUser request
http:///rcgi.bin/EditForm?CB2=4&NbCB=3&Opera2onType=DeleteUser
It will show the username.
This process can of course be automated to view all valid application usernames. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..
eWON considered WEAK RBAC issue a minor one. Apparently, they didn’t understood the impact at all. eWON said: It's a minor issue as these informations are already available through eWON User Manual. We will however completely block the page in a future eWON firmware release when user credentials don't meet the requirements to avoid any ambiguity regarding eWON security.
—> Regardless, the new firmware says this issue has been fixed..
…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..
STORED CROSS-SITE SCRIPTING - NOT FIXED by eWON CVE-2015-7927
Vulnerable functions / parameters Create / Edit User User First Name User Last Name User information Create / Edit Tag Tag Description …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says
Verified. Won't fix: We left the possibility to include HTML tags or javascript in form fields and form url parameters to meet some specific final user needs. Note that this kind of injection is achievable through FTP upload as everything is saved in the eWON config files. Furthermore all theses XSS exploit also require valid user authentication and rights.
—> Yeah, it’s a feature and input validation is a useless practice anyway.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..
Reflected XSS - NOT FIXED by eWON Vulnerable parameter - AST_ErrorMsg
http:///rcgi.bin/wsdForm?sys_Csave=1&AST_ErrorMsg=Successalert("xss-AST_ErrorMsg")</ script>&sys_IpMbsSrvPort=502&sys_IpEipSrvPort=44818&sys_IpIsoSrvPort=102& sys_IpFinsSrvPort=9600&sys_TagPollMode=0&sys_IOTcpDefTO=1000&btUpdate= Update
PASSWORDS NOT SECURED - PARTIAL FIX by eWON CVE-2015-7928
Passwords are passed in plain text allowing a malicious party to retrieve them from network traffic. The autocomplete setting of some eWON forms also allows these passwords to be retrieved from the browser. Compromise of the credentials would allow unauthenticated access. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says
- Won't fix as the final user is supposed to configure eWON through VPN. —> Yeah, supposed to.. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. GET is less secure because data that are sent are part of the URL. …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. eWON says Won't fix. This could be a problem regarding CRSF (issue B) but the final user is supposed to configure eWON through VPN (and thus https).
Mitigating factors:
This could be an issue regarding the CSRF attacks described above. However as already mentioned the eWON firmware exposure to CSRF attacks is really limited. Thus having equivalent POST and GET parameters handling for each request sent to the eWON webserver is by extension not problematic.
—> Yeah, supposed to.. Not problematic... …..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..…..….. -- Best Regards, Karn Ganeshen
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201512-0022",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ewon",
"scope": "lte",
"trust": 1.0,
"vendor": "ewon",
"version": "10.0s0"
},
{
"model": "ewon",
"scope": "lte",
"trust": 0.8,
"vendor": "ewon",
"version": "10.1s0"
},
{
"model": "\u003c10.1s0",
"scope": null,
"trust": 0.6,
"vendor": "ewon",
"version": null
},
{
"model": "ewon",
"scope": "eq",
"trust": 0.6,
"vendor": "ewon",
"version": "10.0s0"
},
{
"model": "ewon",
"scope": "eq",
"trust": 0.3,
"vendor": "ewon",
"version": "0"
},
{
"model": "10.1s0",
"scope": "ne",
"trust": 0.3,
"vendor": "ewon",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"db": "BID",
"id": "79625"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
},
{
"db": "NVD",
"id": "CVE-2015-7929"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:ewon:ewon_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2015-006509"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Karn Ganeshen",
"sources": [
{
"db": "BID",
"id": "79625"
},
{
"db": "PACKETSTORM",
"id": "135069"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
}
],
"trust": 1.0
},
"cve": "CVE-2015-7929",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2015-7929",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2015-08455",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-85890",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitabilityScore": 2.8,
"id": "CVE-2015-7929",
"impactScore": 1.4,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2015-7929",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2015-7929",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2015-08455",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201512-551",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-85890",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2015-7929",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"db": "VULHUB",
"id": "VHN-85890"
},
{
"db": "VULMON",
"id": "CVE-2015-7929"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
},
{
"db": "NVD",
"id": "CVE-2015-7929"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history. eWON is an industrial router product of the Belgian eWON company. A security vulnerability exists in eWON using firmware prior to 10.1s0, which was caused by the program using an unsafe GET HTML command instead of a POST command. An attacker could exploit the vulnerability to perform unauthorized actions. eWON are prone to the following security vulnerabilities:\n1. Weak session management vulnerability\n2. A cross-site request forgery vulnerability\n3. HTML-injection vulnerability\n5. Plain text password information disclosure vulnerability\n6. A security weakness\nAn attacker can exploit these issues to bypass the authentication mechanism and gain unauthorized access, execute attacker-supplied HTML or JavaScript code in the context of the affected site, steal cookie-based authentication credentials, obtain sensitive information, and perform certain unauthorized actions. This may aid in further attacks. *eWON sa Industrial router - Multiple Vulnerabilities*\n\neWON connects the machine across the Internet\n\nBreaking the barrier between industrial applications and IT standards, the\nmission of eWON is to connect industrial machines securely to the Internet,\nenabling easy remote access and gathering all types of technical data\noriginating from industrial machines. \n\nTypical applications within the scope of our mission include remote\nmaintenance, predictive maintenance, remote services, asset management,\nremote metering, multi-site building management, M2M, and more. \n\n*AFFECTED PRODUCTS*\n\nThe following eWON router firmware versions are affected:\n*All eWON firmware versions prior to 10.1s0*\n\n\n*Reference*\nhttps://ics-cert.us-cert.gov/advisories/ICSA-15-342-01\n\n*Vulnerabilities*\n\n*WEAK SESSION MANAGEMENT - FIXED by eWON*\n\nCVE-2015-7924\n\nSession remains active even after user performs log off. Session is destroyed only after browser is exited. \n\n\n*CROSS-SITE REQUEST FORGERY ATTACKS - NOT FIXED by eWON*\n\nCVE-2015-7925\n\nThere is no CSRF token set by the application in any of the forms / pages. \nAny \u0026 all functions can be executed silently without getting validated from\nauthorized user, if / when this issue is exploited. \n\n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. \n\n*eWON says*Verified but won\u0027t fix. The current implementation is done by\ndesign (the user must be able to submit forms using GET only). \n\nAs CSRF attack suggests, the user must be already logged on the eWON using\nits internet browser and the session must thus be valid on user\u0027s browser. \nHowever eWON IP must also be known by the attacker knowing that the VPN\nwill set another IP each time the victim connects to eWON. \n\nThe connection to an eWON device is only possible by a secured VPN, a\npoint- to-point LAN or a secured LAN. \n\nOn their website, eWON describes this issue as following:\nhttp://ewon.biz/support/news/support/ewon-security-enhancement-7529-01\n\nMitigating factors:\n\nMany requirements have to be met for a successful attack:\n\nThe attacker needs a valid login to the eWON. \n\nThe attacker needs HTTP access to the eWON (e.g. eWON web server exposed to\nthe public Internet). \n\nAlso connections to eWON devices should in standard use cases only occur\nthrough:\n\n- a point-to-point LAN, a secured LAN (sniffing the victim IP is not really\nachievable in these two cases)\n\n- or a secured VPN (VPN allocated IP address is then defined by the VPN\nserver). \n\u2014\u003e eWON team just doesn\u0027t understand how CSRF works. And continue to assume\nthe device mgmt portal is accessible ONLY over the VPN, P2P LAN or secured\nLAN. They clearly have not looked at Shodan and / or publicly accessible\nportals. \n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. \n\n*WEAK RBAC CONTROLS - FIXED by eWON*\n\nCVE-2015-7926\n\nThe software allows an unauthenticated user to gather information and\nstatus of I/O servers through the use of a forged URL. \n\n*NOTE*: It should be -\n*An unauthorized / low-privileged user can perform several unauthorized\nactions such as reading, updating, \u0026 deleting I/O servers, configurations,\nenabling/disabling I/O servers, \u0026 accessing, deleting valid users.*\n*Scenario*\n\nTwo users\n\n1. adm - Default privileged user - can perform all administrative functions\n- full rights - [ v o a c f e h j ]\n2. test - newly created user - no rights - no [ v o a c f e h j ]\n\n*Issue 1*\n\n\n*It is possible to enumerate valid I/O servers*\nI/O Server list is a set defined list:\nMEM cbIOSrvList=0\nEWON cbIOSrvList=1\nMODBUS cbIOSrvList=2\nNETMPI ... \nSNMP cbIOSrvList=4\nDF1 ... \nFINS ... \nso on\n... \n\u0026 others\n\nAn unauthorized / unprivileged user can gather information and status of\nthese IO servers in the following manner:\n\n*Logged in as \u2018test\u0027*\n\nAccess -\nhttp://\u003cIP\u003e/rcgi.bin/Edit1IOSrvForm?cbIOSrvList=0\u0026Ac2on=edit\n\nIf Response says\n-\u003e Not Configurable. \n-\u003e Implies Not a valid I/O\n\nIf Response says\n-\u003e Access Denied\n-\u003e Implies a valid I/O\n-\u003e Window Title reveals the I/O server type - example, Modbus IO Server\nConfig, DF1 1O Server Config, n so on\n\n*Issue 2*\n\n*It is possible to modify parameter values of I/O servers directly*Updating\nthe values when logged in as \u0027test\u0027\n\nChange POST request to GET Modify param values\n\nhttp://\u003cIP\u003e/rcgi.bin/EditUsrIOSrvForm?edCfgData=MinInterval%3A10%0D\n%0AMaxInterval%3A268435459%0D%0AReverseCount %3A0\u0026B1=Update\u0026AST_IOSrvNdx=1\n\nResponse\n-\u003e IO Server config updated. \n\nSimilarly, other I/O server configuration can be updated. In case an I/O\nserver is not Enabled, it can be enabled and configured with custom values. \n\n\n*Following poc for SNMP I/O Server settings (This IO server communicates\nwith any SNMP device)*\nEnabling and configuring SNMP I/O server (logged in as test)\n\nhttp://\u003cIP\u003e/rcgi.bin/EditAdvUsrIOSrvForm?\nedEnabledA=1\u0026edGlobAddrA=\u0026edPeriodA=\u0026edGlobAddrB=\u0026edPeriodB=\u0026edGlo\nbAddrC=\u0026edPeriodC=\u0026B1=Update+Config\u0026IOServer=SNMP\n\n-\u003e IO Server config updated. \n\n*Issue 3*\n\n*Deleting All Users*\nIt is possible for a user with no rights to:\n\n1. Enumerate configured users\n2. Delete any \u0026 all users. \n\nHTTP GET request to delete a user (when logged in as \u0027test\u0027) (unauthorized\nrequest)\n\nhttp://\u003cIP\u003e/rcgi.bin/EditForm?CB2=3\u0026NbCB=4\u0026Opera2onType=DeleteUser\n\nThis brings up a confirmation prompt validating if we really want to delete\nthe user. \n\nIt presents the username and offers two options -\nOption 1 - Cancel and Confirm/Delete\nOption 2 - Select Confirm/Delete\n..... \nUsers List test\nPlease confirm you want to delete these items Select Confirm/Delete\n..... \n\nNext, the url redirects to DeleteForm which then shows Access denied twice\n..... \n-\u003e But the user gets deleted anyway. :) Verify by Refreshing User List\n\n\n*Enumerating Users*\nIn order to enumerate valid users, we only need to submit the first\nDeleteUser request\n\nhttp://\u003cIP\u003e/rcgi.bin/EditForm?CB2=4\u0026NbCB=3\u0026Opera2onType=DeleteUser\n\nIt will show the username. \n\nThis process can of course be automated to view all valid application\nusernames. \n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. \n\n*eWON considered WEAK RBAC issue a minor one. Apparently, they didn\u2019t\nunderstood the impact at all.*\neWON said:\nIt\u0027s a minor issue as these informations are already available through eWON\nUser Manual. We will however completely block the page in a future eWON\nfirmware release when user credentials don\u0027t meet the requirements to avoid\nany ambiguity regarding eWON security. \n\n\u2014\u003e Regardless, the new firmware says this issue has been fixed.. \n\n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. \n\n*STORED CROSS-SITE SCRIPTING - NOT FIXED by eWON*\nCVE-2015-7927\n\n\n*Vulnerable functions / parameters*\nCreate / Edit User\nUser First Name\nUser Last Name\nUser information\nCreate / Edit Tag\nTag Description\n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. \neWON says\n\nVerified. \nWon\u0027t fix: We left the possibility to include HTML tags or javascript in\nform fields and form url parameters to meet some specific final user needs. \nNote that this kind of injection is achievable through FTP upload as\neverything is saved in the eWON config files. Furthermore all theses XSS\nexploit also require valid user authentication and rights. \n\n\u2014\u003e Yeah, it\u2019s a feature and input validation is a useless practice anyway.. \n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. \n\n\n*Reflected XSS - NOT FIXED by eWON*\nVulnerable parameter - AST_ErrorMsg\n\nhttp://\u003cIP\u003e/rcgi.bin/wsdForm?sys_Csave=1\u0026AST_ErrorMsg=Success\u003cscript\u003ealert(\"xss-AST_ErrorMsg\")\u003c/\nscript\u003e\u0026sys_IpMbsSrvPort=502\u0026sys_IpEipSrvPort=44818\u0026sys_IpIsoSrvPort=102\u0026\nsys_IpFinsSrvPort=9600\u0026sys_TagPollMode=0\u0026sys_IOTcpDefTO=1000\u0026btUpdate=\nUpdate\n\n*PASSWORDS NOT SECURED - PARTIAL FIX by eWON*\nCVE-2015-7928\n\nPasswords are passed in plain text allowing a malicious party to retrieve\nthem from network traffic. The autocomplete setting of some eWON forms also\nallows these passwords to be retrieved from the browser. Compromise of the\ncredentials would allow unauthenticated access. \n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. \neWON says\n\n2. Won\u0027t fix as the final user is supposed to configure eWON through VPN. \n\u2014\u003e Yeah, *supposed to*.. \n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. GET is less secure because data that are sent are part of the URL. \n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. \neWON says\nWon\u0027t fix. This could be a problem regarding CRSF (issue B) but the final\nuser is supposed to configure eWON through VPN (and thus https). \n\nMitigating factors:\n\nThis could be an issue regarding the CSRF attacks described above. However\nas already mentioned the eWON firmware exposure to CSRF attacks is really\nlimited. Thus having equivalent POST and GET parameters handling for each\nrequest sent to the eWON webserver is by extension not problematic. \n\n\u2014\u003e Yeah, *supposed to*.. Not problematic... \n\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026..\u2026.. \n-- \nBest Regards,\nKarn Ganeshen\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2015-7929"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"db": "BID",
"id": "79625"
},
{
"db": "VULHUB",
"id": "VHN-85890"
},
{
"db": "VULMON",
"id": "CVE-2015-7929"
},
{
"db": "PACKETSTORM",
"id": "135069"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2015-7929",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-15-351-03",
"trust": 2.9
},
{
"db": "BID",
"id": "79625",
"trust": 2.7
},
{
"db": "PACKETSTORM",
"id": "135069",
"trust": 1.3
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006509",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201512-551",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2015-08455",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-85890",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2015-7929",
"trust": 0.1
},
{
"db": "ICS CERT",
"id": "ICSA-15-342-01",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"db": "VULHUB",
"id": "VHN-85890"
},
{
"db": "VULMON",
"id": "CVE-2015-7929"
},
{
"db": "BID",
"id": "79625"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"db": "PACKETSTORM",
"id": "135069"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
},
{
"db": "NVD",
"id": "CVE-2015-7929"
}
]
},
"id": "VAR-201512-0022",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"db": "VULHUB",
"id": "VHN-85890"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-08455"
}
]
},
"last_update_date": "2024-11-23T21:54:47.315000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "eWON Security Enhancement (FW 10.1s0)",
"trust": 0.8,
"url": "http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01"
},
{
"title": "eWON Information Disclosure Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/68900"
},
{
"title": "eWON Repair measures for information disclosure vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=59318"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-85890"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"db": "NVD",
"id": "CVE-2015-7929"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.0,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-351-03"
},
{
"trust": 2.4,
"url": "http://www.securityfocus.com/bid/79625"
},
{
"trust": 1.9,
"url": "http://ewon.biz/support/news/support/ewon-security-enhancement-7529-01"
},
{
"trust": 1.2,
"url": "http://seclists.org/fulldisclosure/2015/dec/118"
},
{
"trust": 1.2,
"url": "http://packetstormsecurity.com/files/135069/ewon-xss-csrf-session-management-rbac-issues.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7929"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7929"
},
{
"trust": 0.3,
"url": "http://ewon.biz"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://\u003cip\u003e/rcgi.bin/deleteform"
},
{
"trust": 0.1,
"url": "http://\u003cip\u003e/rcgi.bin/edit1iosrvform?cbiosrvlist=0\u0026ac2on=edit"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7927"
},
{
"trust": 0.1,
"url": "http://\u003cip\u003e/rcgi.bin/editform?cb2=4\u0026nbcb=3\u0026opera2ontype=deleteuser"
},
{
"trust": 0.1,
"url": "http://\u003cip\u003e/rcgi.bin/wsdform?sys_csave=1\u0026ast_errormsg=success\u003cscript\u003ealert(\"xss-ast_errormsg\")\u003c/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7925"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7926"
},
{
"trust": 0.1,
"url": "http://\u003cip\u003e/rcgi.bin/editusriosrvform?edcfgdata=mininterval%3a10%0d"
},
{
"trust": 0.1,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-15-342-01"
},
{
"trust": 0.1,
"url": "http://\u003cip\u003e/rcgi.bin/editform?cb2=3\u0026nbcb=4\u0026opera2ontype=deleteuser"
},
{
"trust": 0.1,
"url": "http://\u003cip\u003e/rcgi.bin/editadvusriosrvform?"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7929"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2015-7928"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"db": "VULHUB",
"id": "VHN-85890"
},
{
"db": "VULMON",
"id": "CVE-2015-7929"
},
{
"db": "BID",
"id": "79625"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"db": "PACKETSTORM",
"id": "135069"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
},
{
"db": "NVD",
"id": "CVE-2015-7929"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"db": "VULHUB",
"id": "VHN-85890"
},
{
"db": "VULMON",
"id": "CVE-2015-7929"
},
{
"db": "BID",
"id": "79625"
},
{
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"db": "PACKETSTORM",
"id": "135069"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
},
{
"db": "NVD",
"id": "CVE-2015-7929"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-12-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"date": "2015-12-23T00:00:00",
"db": "VULHUB",
"id": "VHN-85890"
},
{
"date": "2015-12-23T00:00:00",
"db": "VULMON",
"id": "CVE-2015-7929"
},
{
"date": "2015-12-17T00:00:00",
"db": "BID",
"id": "79625"
},
{
"date": "2015-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"date": "2015-12-24T20:35:19",
"db": "PACKETSTORM",
"id": "135069"
},
{
"date": "2015-12-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201512-551"
},
{
"date": "2015-12-23T11:59:05.220000",
"db": "NVD",
"id": "CVE-2015-7929"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-12-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"date": "2016-12-07T00:00:00",
"db": "VULHUB",
"id": "VHN-85890"
},
{
"date": "2016-12-07T00:00:00",
"db": "VULMON",
"id": "CVE-2015-7929"
},
{
"date": "2015-12-17T00:00:00",
"db": "BID",
"id": "79625"
},
{
"date": "2015-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2015-006509"
},
{
"date": "2015-12-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201512-551"
},
{
"date": "2024-11-21T02:37:41.080000",
"db": "NVD",
"id": "CVE-2015-7929"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "eWON Information Disclosure Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2015-08455"
},
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201512-551"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.