Multiple Vulnerabilities in SevOne Network Management System (NMS)

Project Description

SevOne Network Management System suffers from multiple vulnerabilties including command injection, SQL injection, and CSV formula injection. The traceroute functionality of SevOne allows authenticated users to input an IP address to perform traceroute command in the server with the user-supplied input but it doesn’t validate the user input which leads to command injection. Additionally, an authenticated user can exploit the SQL injections in the application due to insufficient input validation. Furthermore, the CSV export function is vulnerable to CSV injection which allows an attacker to input malicious formula which will be executed when it is exported as CSV and opened in a spreadsheet application.


Vendor description

“SevOne provides modern monitoring and analytics solutions that organizations need to monitor their networks today, tomorrow and beyond. SevOne simplifies the extraction and enrichment of metric, flow, and streaming telemetry data across multi-vendor networks enabling enterprises, carriers and managed services providers to ensure optimal network operations and performance.”

Source: https://www.sevone.com/company/about-us/

Business recommendation

The vendor did not respond to our communication attempts, hence no patch is available. It’s recommended to closely monitor any activities related to NMS. An in-depth security analysis performed by security professionals is highly advised, as the software may be affected from further security issues.

Vulnerability overview/description

In order to exploit the identified security issues an attacker needs at least the following privileges: “view alerts and manage devices” depending on the role assigned.

1) Command Injection in Traceroute Feature (Authenticated User)

There is a command injection vulnerability found in “traceroute.php”. Any OS command can be injected by an authenticated user who has access to the “SNMP Walk” page. This could lead to a full system compromise.

2) Multiple SQL Injection vulnerabilities (Authenticated User)

Due to insufficient input validation, the application allows the injection of direct SQL commands. The identified SQL Injection vulnerabilities can be exploited by an authenticated user who has access to the “Alert Summary” and “Alert Archive” pages.

3) CSV Formula Injection vulnerability (Authenticated User)

The “Device Manager” page of the application has a “CSV export all devices” feature which allows the export of device data (name, device ip, objects, and so on) as a CSV file. On the “Device Creator” page, it is possible to input a malicious formula that will be embedded inside an exported CSV file. This vulnerability can be exploited by an authenticated user who has access to the “Device Creator” page.

Proof of concept

PoC has been removed as no patch is available and the vendor is unresponsive.

Vulnerable / tested versions

SevOne Network Management System (NMS) version 5.7.2.22 has been tested. Previous versions may also be affected.

Vendor contact timeline

2020-08-04Contacting vendor through infosec-cases@sevone.com; no response
2020-08-12Follow-up with vendor; no response
2020-08-26Follow-up with vendor; no response
2020-09-14Follow-up with vendor; no response
2020-10-02Public release of the security advisory.

Solution

The vendor did not respond to our communication attempts, hence no patch is available.

Workaround

None.

Advisory URL

https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html

EOF Calvin Phang / @2020

Interested to work with the experts of SEC Consult? Send us your application
Want to improve your own cyber security with the experts of SEC Consult? Contact our local offices.

Project Details

  • TitleMultiple Vulnerabilities
  • ProductSevOne Network Management System (NMS)
  • Vulnerable version5.7.2.22
  • ImpactCritical
  • Homepagehttps://www.sevone.com/
  • Found2020-07-16
  • ByCalvin Phang (Office Singapore) | SEC Consult Vulnerability Lab