Manage Engine Exchange Reporter v4.1 - Multiple Web Vulnerabilites

[Vulnerability Lab <research@xxxxxxxxxxxxxxxxxxxxx>]

Title:
======
Manage Engine Exchange Reporter v4.1 - Multiple Web Vulnerabilites


Date:
=====
2012-11-14


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=688


VL-ID:
=====
688


Common Vulnerability Scoring System:
====================================
4.5


Introduction:
=============
Microsoft Exchange Server is, by a distance, the most popular communication, 
collaboration and email messaging application today! 
MS Exchange serves as the hub of all email communications in most corporate 
environments that use the Microsoft Active Directory 
technology. It becomes a necessity to have an Exchange reporting tool that will 
equip and Exchange Administrator with precise, 
granular, comprehensive and actionable data on all aspects of the MS Exchange 
Server. Exchange Reporter Plus

ManageEngine Exchange Reporter Plus is a web-based analysis and reporting 
solution for Microsoft Exchange Servers.
Exchange Reporter Plus is a comprehensive and complete MS Exchange reporting 
software that provides over 70 different reports on 
every aspect of the Microsoft Exchange Server environment. The range includes 
reports of crucial importance.
A few of the many vital Exchange tasks that can be performed using Exchange 
Reporter Plus are listed below.
Track incoming and outgoing emails, monitor mailbox size and keep spam away 
from Active Directory mailboxes with Mailbox Traffic, 
Mailbox Content, and Mailbox Size Reports.
Keep a tab on the number of messages sent and received by each Exchange server 
using Server Traffic Reports.
Monitor the vital statistics of Exchange Server Public Folders with 
comprehensive Public Folder Reports.
Generate reports on Distribution Lists and also show the traffic for each 
distribution by running Distribution Lists Traffic Report!

Exchange Reporter Plus presents these reports in an easily comprehensible 
format, that even technically naive users will have no hassles 
in creating and interpreting them. In addition to generating these reports in 
the wink of an eye, also facilitates exporting these reports. 
The reports can be downloaded as xls, csv, pdf or html files for further 
activities. Curious to know more?? Try Exchange Reporter 
Plus hands-on in our Live Demo!

(Copy of the Vendor Homepage: 
http://www.manageengine.com/products/exchange-reports/index.html )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple web 
vulnerabilities in Exchange Reporter v4.1 Plus.


Report-Timeline:
================
2012-08-26:     Researcher Notification & Coordination
2012-08-27:     Vendor Notification 1
2012-10-30:     Vendor Notification 2
2012-11-07:     Vendor Response/Feedback
2012-11-14:     Public or Non-Public Disclosure


Status:
========
Published


Exploitation-Technique:
=======================
Remote


Severity:
=========
Medium


Details:
========
1.1
A persistent input validation vulnerability is detected in Exchange Reporter 
Plus v4.1, a web-based analysis and reporting solution. 
The bugs allow remote attackers to implement/inject malicious script code on 
the application side (persistent). The persistent vulnerability 
is located in Schedule New Report module with the bound vulnerable Schedule 
Name Schedule Description parameters. Successful exploitation of 
the vulnerability can lead to session hijacking (manager/admin) or stable 
(persistent) context manipulation. Exploitation requires low user 
inter action & privileged user account.

Vulnerable Module(s):
                        [+] Schedule New Report 

Vulnerable Parameter(s):
                        [+] Schedule Name 
                        [+] Schedule Description 

1.2
Multiple non persistent cross site scripting vulnerability is detected in 
Exchange Reporter Plus v4.1, a web-based analysis and reporting solution.
The vulnerability allows remote attackers to hijack website customer, moderator 
or admin sessions with medium or high required user inter action 
or local low privileged user account. The first vulnerability is located in 
ReportsIndex.do with the bound vulnerable reportCategoryID parameter. 
The second vulnerability is located in search box for reports. Successful 
exploitation can result in account steal, client site phishing & client-side 
content request manipulation.


Vulnerable Module(s):
                        [+] Reports


Vulnerable File(s):
                        [+] ReportsIndex.do


Vulnerable Parameter(s):
                        [+]  reportCategoryID
                        [+]  search report


Proof of Concept:
=================
1.1
The persistent input validation vulnerability can be exploited by remote 
attackers with low required user inter action & low 
privileged user account. For demonstration or reproduce ...

The attacker schedules a new report and inserts in schedule name and schedule 
description his own malicious javascript or html code.
Then inject the malicious script code i.e., <iframe src=www.vuln-lab.com 
onload=alert("VL")/>
When the user browses the alarms page in the control panel the persistent 
injected script code will be 
executed out of the web application context.

1.2
PoC:
http://exchangereporterplus.127.0.0.1:8080/exchange/ReportsIndex.do
?selectedTab=reports&reportCategoryID=3+>"<iframe src=http://www.vuln-lab.com 
onload=alert("VL")></iframe>

The attacker can go to reports and insert own malicious script code inside of 
the search report box to exploit the service application.


Risk:
=====
1.1
The security risk of the persistent input validation vulnerability is estimated 
as medium(+).

1.2
The security risk of the client side cross site vulnerabilities are estimated 
as low(+).


Credits:
========
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed (the_storm) 
[storm@xxxxxxxxxxxxxxxxxxxxx] [iel-sayed.blogspot.com]


Disclaimer:
===========
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability-Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, 
indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have 
been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential 
or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor 
licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com              
               - www.vulnerability-lab.com/register
Contact:    admin@xxxxxxxxxxxxxxxxxxxxx         - support@xxxxxxxxxxxxxxxxxxxxx 
               - research@xxxxxxxxxxxxxxxxxxxxx
Section:    video.vulnerability-lab.com         - forum.vulnerability-lab.com   
               - news.vulnerability-lab.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab 
               - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - 
vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file 
requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is 
granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All 
pictures, texts, advisories, sourcecode, videos and 
other information on this website is trademark of vulnerability-lab team & the 
specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or 
support@xxxxxxxxxxxxxxxxxxxxx) to get a permission.

                                        Copyright © 2012 | Vulnerability 
Laboratory

-- 
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx