NetGain Enterprise Manager 7.2.730 Build 1034 Type information disclosure

Summaryinfo

A vulnerability classified as critical was found in NetGain Enterprise Manager 7.2.730 Build 1034. This impacts an unknown function of the component org.apache.jsp.u.jsp.designer.script_005fsamples_jsp Servlet. The manipulation of the argument Type as part of Parameter results in information disclosure. This vulnerability was named CVE-2017-16596. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in NetGain Enterprise Manager 7.2.730 Build 1034. It has been classified as critical. Affected is an unknown function of the component org.apache.jsp.u.jsp.designer.script_005fsamples_jsp Servlet. The manipulation of the argument type as part of a Parameter leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the org.apache.jsp.u.jsp.designer.script_005fsamples_jsp servlet, which listens on TCP port 8081 by default. When parsing the type parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator. Was ZDI-CAN-5119.

The bug was discovered 12/13/2017. The weakness was presented 01/23/2018 (Website). The advisory is shared for download at zerodayinitiative.com. This vulnerability is traded as CVE-2017-16596 since 11/06/2017. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability was handled as a non-public zero-day exploit for at least 40 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 7.2.730 eliminates this vulnerability.

See VDB-112312, VDB-112311, VDB-112310 and VDB-112309 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• NetGain

Name

• Enterprise Manager

Version

• 7.2.730 Build 1034

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion