NetGain Enterprise Manager 7.2.730 Build 1034 ID File input validation

Summaryinfo

A vulnerability described as critical has been identified in NetGain Enterprise Manager 7.2.730 Build 1034. The impacted element is an unknown function of the component org.apache.jsp.u.jsp.db.save_005fimage_jsp Servlet. Executing a manipulation of the argument ID as part of Parameter can lead to input validation (File). This vulnerability is handled as CVE-2017-16594. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in NetGain Enterprise Manager 7.2.730 Build 1034 and classified as critical. This vulnerability affects an unknown code block of the component org.apache.jsp.u.jsp.db.save_005fimage_jsp Servlet. The manipulation of the argument id as part of a Parameter leads to a input validation vulnerability (File). The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

This vulnerability allows remote attackers to create arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.db.save_005fimage_jsp servlet, which listens on TCP port 8081 by default. When parsing the id parameter, the process does not properly validate user-supplied data, which can allow for the upload of files. An attacker can leverage this vulnerability to execute code under the context of Administrator. Was ZDI-CAN-5117.

The bug was discovered 12/13/2017. The weakness was released 01/23/2018 (Website). The advisory is available at zerodayinitiative.com. This vulnerability was named CVE-2017-16594 since 11/06/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 40 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-112310, VDB-112309, VDB-112308 and VDB-112307. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• NetGain

Name

• Enterprise Manager

Version

• 7.2.730 Build 1034

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion