Privilege escalation Vulnerability in ManageEngine oputils

Posted On // Leave a Comment

Privilege escalation Vulnerability in ManageEngine oputils

Overview
=======
Title:- Privilege escalation Vulnerability in ManageEngine oputils
Author: Kaustubh G. Padwad
Vendor: ZOHO Corp
Product: ManageEngine oputils
Tested Version: : oputils 8.0
Severity: HIGH

Advisory ID
============
2016-05-Manage_Engine

About the Product:
==================
OpUtils is a Switch Port & IP Address Management software that helps network engineers manage their Switches and IP Address Space with ease. With its comprehensive set of 30+ tools, it helps them to perform network monitoring tasks like detecting a rogue device intrusion, keep a check on bandwidth usage, monitoring availability of critical devices, backing up Cisco configuration files and more.

Description: 
============
This Privilege escalation vulnerability enables an Normal user to escalate privilege and become administrator of the application.

Vulnerability Class:
====================
Top 10 2014-I2 Insufficient Authentication/Authorization https://www.owasp.org/index.php/Top_10_2014-I2_Insufficient_Authenticati
on/Authorization

Disclosure: 
===========
04-Feb-2016 Repoerted to vendor
11-Feb-2016 Fixed By vendor

credits:
========
* Kaustubh Padwad
* Information Security Researcher
* kingkaustubh (at) me (dot) com [email concealed]
* https://twitter.com/s3curityb3ast
* http://breakthesec.com
* https://www.linkedin.com/in/kaustubhpadwad