NetGain Enterprise Manager 7.2.699 Build 1001 script_test.jsp content format string

Summaryinfo

A vulnerability, which was classified as critical, was found in NetGain Enterprise Manager 7.2.699 Build 1001. This vulnerability affects unknown code of the file script_test.jsp. Executing a manipulation of the argument content as part of Parameter can lead to format string. The identification of this vulnerability is CVE-2017-17407. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in NetGain Enterprise Manager 7.2.699 Build 1001 and classified as critical. This vulnerability affects some unknown functionality of the file script_test.jsp. The manipulation of the argument content as part of a Parameter leads to a format string vulnerability. The CWE definition for the vulnerability is CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager v7.2.699 build 1001. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the content parameter provided to the script_test.jsp endpoint. A crafted content request parameter can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code under the context of the web service. Was ZDI-CAN-5080.

The bug was discovered 12/13/2017. The weakness was shared 01/23/2018 (Website). The advisory is shared for download at zerodayinitiative.com. This vulnerability was named CVE-2017-17407 since 12/05/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 40 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:script_test.jsp it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-112323, VDB-112322, VDB-112321 and VDB-112320 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• NetGain

Name

• Enterprise Manager

Version

• 7.2.699 Build 1001

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion