A vulnerability was found in Observium Network Monitor (version unknown) and classified as problematic. This issue affects an unknown function of the file /html/feed.php of the component Feed. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality.

The bug was discovered 09/01/2016. The weakness was shared 11/10/2016 by Ronald Volgers as [CT-2016-1110] Unauthenticated RCE in Observium network monitor as confirmed mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The vendor cooperated in the coordination of the public release. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The following code is the reason for this vulnerability:

if (isset($_GET['hash']) && is_numeric($_GET['id']))
{
 $key = get_user_pref($_GET['id'], 'atom_key');
 $data = explode('|', decrypt($_GET['hash'], $key)); // user_id|user_level|auth_mechanism

 $user_id    = $data[0];
 $user_level = $data[1]; // FIXME, need new way for check userlevel, because it can be changed
 if (count($data) == 3)
 {
   $check_auth_mechanism = $config['auth_mechanism'] == $data[2];
 } else {
   $check_auth_mechanism = TRUE; // Old way
 }

 if ($user_id == $_GET['id'] && $check_auth_mechanism)
 {
   session_start();
   $_SESSION['user_id']   = $user_id;
   $_SESSION['userlevel'] = $user_level;

The vulnerability was handled as a non-public zero-day exploit for at least 55 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:html/feed.php it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The entries 93567, 93568 and 93570 are related to this item.

Productinfo

Vendor

• Observium

Name

• Network Monitor

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion