A vulnerability, which was classified as critical, was found in Observium Network Monitor (unknown version). This affects an unknown code block of the file /includes/common.inc.php. The manipulation with an unknown input leads to a privileges management vulnerability (Unserialize). CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The bug was discovered 09/01/2016. The weakness was disclosed 11/10/2016 by Ronald Volgers as [CT-2016-1110] Unauthenticated RCE in Observium network monitor as confirmed mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The public release has been coordinated in cooperation with Observium. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK. The reason for this vulnerability is this part of code:

function var_decode($string, $method = 'serialize')
{
 $value = base64_decode($string, TRUE);
 if ($value === FALSE)
 {
   // This is not base64 string, return original var
   return $string;
 }

 switch ($method)
 {
   case 'json':
     if ($string === 'bnVsbA==') { return NULL; };
     $decoded = @json_decode($value, TRUE);
     if ($decoded !== NULL)
     {
       // JSON encoded string detected
       return $decoded;
     }
     break;
   default:
     if ($value === 'b:0;') { return FALSE; };
     $decoded = @unserialize($value);
     if ($decoded !== FALSE)
     {
       // Serialized encoded string detected
       return $decoded;
     }
 }

The vulnerability was handled as a non-public zero-day exploit for at least 55 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:includes/common.inc.php it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The entries 93568, 93569 and 93570 are pretty similar.

Productinfo

Vendor

• Observium

Name

• Network Monitor

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion