Privilege escalation Vulnerability in ManageEngine Network Configuration Management

Posted On // Leave a Comment

Privilege escalation Vulnerability in ManageEngine Network Configuration Management

Overview ======== Title:- Privilege escalation Vulnerability in ManageEngine Network Configuration Management Author: Kaustubh G. Padwad Vendor: ZOHO Corp Product: ManageEngine Network Configuration Manager Tested Version: : Network Configuration Manager Build 11000 Severity: HIGH
Advisory ID
============
2016-03-Manage_Engine

About the Product:
==================

Network Configuration Manager is a web–based, multi vendor network change, configuration and compliance management 
(NCCCM) solution for switches, routers, firewalls and other network devices. Trusted by thousands of network 
administrators around the world, Network Configuration Manager helps automate and take total control of the entire life 
cycle of device configuration management.

Description: 
============
This Privilege escalation vulnerability enables an Normal user to escalate privilege and become administrator of the 
application. 
Vulnerability Class:
====================
Top 10 2014-I2 Insufficient Authentication/Authorization 
https://www.owasp.org/index.php/Top_10_2014-I2_Insufficient_Authentication/Authorization

Mitigation
==========
* Please Stop Network configuration manager  service.
* Open Ncm\lib and cut AdvNCM.jar and paste it in to Desktop.
* Download the AdvNCM.jar file from below link and paste it under Ncm\lib 
* https://uploads.zohocorp.com/Internal_Useruploads/dnd/DeviceExpert/o_1ab396o1i1a6v8j1cr86uet581/AdvNCM.jar
* Open Ncm\logs and delete all the files inside it,
* Start the Ncm service and check the issue.

Disclosure: 
===========
* 31-JAN-2016 Repoerted to vendor
* 31-Feb-2016 Ack by Vendor
* 09-Feb-2016 Fixed By Vendor

credits:
========
* Kaustubh Padwad
* Information Security Researcher
* kingkaustubh () me com
* https://twitter.com/s3curityb3ast
* http://breakthesec.com
* https://www.linkedin.com/in/kaustubhpadwad