Multiple vulnerabilities in CoSoSys Endpoint Protector 4

SEC Consult Vulnerability Lab Security Advisory < 20140521-0 >


title: Multiple vulnerabilities

product: CoSoSys Endpoint Protector 4

vulnerable version: all - except issue #1

fixed version: none - except issue #1

impact: Critical


found: 2013-12-02

by: Stefan Viehböck

SEC Consult Vulnerability Lab


Vendor/product description:


"Protect your network from the threats posed by portable storage devices.

Portable devices such as USB flash drives and smartphones may cause severe

issues when it comes to controlling data use within and outside the company. As

a full DLP (Data Loss Prevention) product, Endpoint Protector 4 prevents users

from taking unauthorized data outside the company or bringing potential harmful

files on USB devices, files which can have a significant impact on your

network's health."



Vulnerability overview/description:


1) Unauthenticated access to statistics / information disclosure

Unauthenticated users can access server statistics. These statistics give

details about the webserver status (nginx_status) as well as system level

information (munin system monitoring).

2) Unauthenticated SQL injection

Unauthenticated users can execute arbitrary SQL statements via a vulnerability

in the device registration component. The statements will be executed with the

high-privileges of the MySQL user "root". This user has permissions to read and

write files from/to disk.

3) Backdoor accounts

Several undocumented operating system user accounts exist on the appliance.

They can be used to gain access to the appliance via the terminal but also

via SSH.


Proof of concept:


1) Unauthenticated access to statistics / information disclosure

The information can be accessed via the following URLs:

https:// <host>/nginx_status

https:// <host>/munin/


2) Unauthenticated SQL injection

The following POST request uses this vulnerability to write a file with the

content "TEST" to /tmp/test_outfile:

Detailed proof of concept exploits have been removed for this vulnerability.

To demonstrate impact of the issue, the following 2 POST requests will create

a MySQL trigger that adds the superadmin user "secconsult" (password:

"secconsult") to the user table. (A reboot mysqld/system is required before the

trigger is enabled.)

Detailed proof of concept exploits have been removed for this vulnerability.

Affected script: /wsf/webservice.php


3) Backdoor accounts

The passwd and shadow file show that the following accounts exist. The

password hashes have been removed from this advisory.




The "epproot" user can elevate privileges to root easily via the sudo command,

while the remaining users can get shell access and gain root privileges via

kernel exploits etc.


Vulnerable / tested versions:


The vulnerability has been verified to exist in CoSoSys Endpoint Protector

version, which was the most recent version at the time of discovery.


Vendor contact timeline:


2013-12-10: Sending responsible disclosure policy and requesting encryption


2013-12-10: Vendor provides encryption keys.

2013-12-10: Sending advisory via encrypted channel.

2013-12-17: Vendor confirms receipt of advisory.

2014-01-09: Requesting status update.

2014-01-13: Vendor states that issue

#1 has been fixed in version

#2 will be fixed in March

#3 "accounts for support are available by default on our appliances

but we remove them on customer requests"

2014-01-14: Stating that resolution of issue #3 is not sufficient.

2014-01-20: Vendor states that backdoor accounts are documented in latest

version and some will be removed in the future and functionality

to disable users is in development.

2014-04-04: Requesting status update regarding remaining issues (#2 and #3).

2014-05-16: Requesting status update regarding remaining issues (#2 and #3,

2nd try).

2014-05-21: (No answer) SEC Consult releases security advisory.




CoSoSys has _only_ patched the information disclosure vulnerability (issue #1).

The patched version is

There is no solution/patch for the remaining, critical vulnerabilities!




No workaround available.


Advisory URL:




SEC Consult Vulnerability Lab

SEC Consult

Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius


Mooslackengasse 17, 1190 Vienna, Austria

Phone: +43 1 8903043 0

Fax: +43 1 8903043 15

Mail: research at sec-consult dot com




EOF Stefan Viehböck / @2014