Observium Network Monitor Feed /html/feed.php improper authentication

Summaryinfo

A vulnerability was found in Observium Network Monitor. It has been rated as problematic. This vulnerability affects unknown code of the file /html/feed.php of the component Feed. The manipulation leads to improper authentication. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Observium Network Monitor (version unknown) and classified as problematic. This issue affects an unknown function of the file /html/feed.php of the component Feed. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality.

The bug was discovered 09/01/2016. The weakness was shared 11/10/2016 by Ronald Volgers as [CT-2016-1110] Unauthenticated RCE in Observium network monitor as confirmed mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The vendor cooperated in the coordination of the public release. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The following code is the reason for this vulnerability:

if (isset($_GET['hash']) && is_numeric($_GET['id']))
{
 $key = get_user_pref($_GET['id'], 'atom_key');
 $data = explode('|', decrypt($_GET['hash'], $key)); // user_id|user_level|auth_mechanism

 $user_id    = $data[0];
 $user_level = $data[1]; // FIXME, need new way for check userlevel, because it can be changed
 if (count($data) == 3)
 {
   $check_auth_mechanism = $config['auth_mechanism'] == $data[2];
 } else {
   $check_auth_mechanism = TRUE; // Old way
 }

 if ($user_id == $_GET['id'] && $check_auth_mechanism)
 {
   session_start();
   $_SESSION['user_id']   = $user_id;
   $_SESSION['userlevel'] = $user_level;

The vulnerability was handled as a non-public zero-day exploit for at least 55 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:html/feed.php it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The entries VDB-93567, VDB-93568 and VDB-93570 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Observium

Name

• Network Monitor

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion