KL-001-2017-015 : Solarwinds LEM Hardcoded Credentials

--1nw5sR63cKwgMmRWdpSOhkBNgSuCTX3ex
Content-Type: multipart/mixed; boundary="1DiBMXPVMVPPs1MDn0WaRlngBodBegH1X";
 protected-headers="v1"
From: KoreLogic Disclosures <disclosures@korelogic.com>
To: fulldisclosure@seclists.org, bugtraq@securityfocus.com
Message-ID: <14c4a1ac-dfe0-106b-5677-41b5aab2bdcb@korelogic.com>
Subject: KL-001-2017-015 : Solarwinds LEM Hardcoded Credentials

--1DiBMXPVMVPPs1MDn0WaRlngBodBegH1X
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

KL-001-2017-015 : Solarwinds LEM Hardcoded Credentials

Title: Solarwinds LEM Hardcoded Credentials
Advisory ID: KL-001-2017-015
Publication Date: 2017.07.06
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-20=
17-015.txt


1. Vulnerability Details

     Affected Vendor: Solarwinds
     Affected Product: Log and Event Manager Virtual Appliance
     Affected Version: v6.3.1
     Platform: Embedded Linux
     CWE Classification: CWE-798: Use of Hard-coded Credentials
     Impact: Unintended Access
     Attack vector: Local

2. Vulnerability Description

     The appliance contains multiple hardcoded passwords and hash
     digests.

3. Technical Description

     # grep "password" /usr/local/jetty/scripts/certs/openssl.cnf
     output_password			=3D QDXTCDD2nJIU

     # grep "password" /usr/local/jetty/scripts/certs/openssl.cnf.org
     output_password			=3D QDXTCDD2nJIU

     # grep "password" /usr/local/contego/scripts/certs/openssl.cnf
     output_password			=3D QDXTCDD2nJIU

     # grep -i "password" /usr/local/jetty/etc/jetty-ssl.xml
             <Set name=3D"password">q4ROVdYYsV5M</Set>
             <Set name=3D"keyPassword">q4ROVdYYsV5M</Set>
             <Set name=3D"trustPassword">q4ROVdYYsV5M</Set>

     # grep -i "password" /usr/local/contego/scripts/indepth-backup.pl
     my $PASSWORD =3D "omgcontegorox";

     # grep -i "password" /usr/local/contego/scripts/database/pgsql/flow.=
sql
     CREATE ROLE trigeo      WITH CREATEDB LOGIN PASSWORD rootme;
     CREATE ROLE contego     WITH CREATEDB LOGIN PASSWORD reports;

     //Empty Password
     # grep -i "password" /usr/local/contego/run/manager/toolconfig/tools=
tore.script
     CREATE USER SA PASSWORD DIGEST d41d8cd98f00b204e9800998ecf8427e

     # grep -i "password" /usr/local/contego/run/indepth.conf
     InDepthMaintenPassword=3DtVyf+rPBho7S0WOd/29MPg=3D=3D
     InDepthManagerPassword=3DzhZi52gTxKbMKTzgdfBtMQ=3D=3D

     // cracks to "welcome" without quotes
     # grep -i "password" /usr/local/contego/run/tomcat/conf/tomcat-users=
=2Exml
     		<user username=3D"manager" password=3D"c0b137fe2d792459f26ff763cce=
44574a5b5ab03" roles=3D"manager"/>
             <user username=3D"administrator" password=3D"c0b137fe2d79245=
9f26ff763cce44574a5b5ab03" roles=3D"admin"/>
             <user username=3D"auditor" password=3D"c0b137fe2d792459f26ff=
763cce44574a5b5ab03" roles=3D"audit"/>
             <user username=3D"monitor" password=3D"c0b137fe2d792459f26ff=
763cce44574a5b5ab03" roles=3D"alerts_only"/>
             <user username=3D"contact" password=3D"c0b137fe2d792459f26ff=
763cce44574a5b5ab03" roles=3D"notify_only"/>
             <user username=3D"user" password=3D"c0b137fe2d792459f26ff763=
cce44574a5b5ab03" roles=3D"user"/>

     # grep -i "password" /usr/local/contego/run/system.conf
     archive.password=3Domgcontegorox
     backup.password=3Domgcontegorox
     logbackup.password=3Domgcontegorox

     # grep -i "password" /usr/local/contego/run/daemon-args.pl
     my $tls =3D "-Djavax.net.ssl.keyStore=3D/usr/local/contego/scripts/c=
erts/.keystore
-Djavax.net.ssl.keyStorePassword=3Dq4ROVdYYsV5M -Djavax.net.ssl.trustStor=
e=3D/usr/local/contego/scripts/certs/.truststore
-Djavax.net.ssl.trustStorePassword=3Dq4ROVdYYsV5M";

     # grep -i "password" /usr/local/contego/run/manager.conf
     PSQLPassword=3DaNErCbdTvwaXxnusqVsNCQ=3D=3D
     ForensicPassword=3DBosMXyGmaT/ej+S3GU6fRQ=3D=3D

     # grep -i "password" /var/rawdata/cores/solr.conf
     query_password=3DtObzgVmmszuKGZ40W+PO/Q=3D=3D

     //hardcoded md5
     # grep -i "password" /var/alertdata/hsql/alertdb.script
     CREATE USER SA PASSWORD DIGEST fe42a787c40ad4110affab25e8bad4ae
     CREATE USER "trigeo" PASSWORD DIGEST 54837f887425d1eda4d0ddcee6c2d3=
fc

4. Mitigation and Remediation Recommendation

     The vendor has released a Hotfix to remediate this
     vulnerability. Hotfix and installation instructions are
     available at:

     https://support.solarwinds.com/Success_Center/Log_Event_Manager_(LEM=
)/Log_and_Event_Manager_LEM_6-3-1_Hotfix_5_ReadMe
     http://downloads.solarwinds.com/solarwinds/Release/HotFix/SolarWinds=
-LEM-v6.3.1-Hotfix5.zip

5. Credit

     This vulnerability was discovered by Matt Bergin (@thatguylevel)
     of KoreLogic, Inc. and Joshua Hardin.

6. Disclosure Timeline

     2017.04.06 - KoreLogic submits vulnerability report and PoC to
                  Solarwinds contact.
     2017.05.15 - Solarwinds notifies KoreLogic that a hotfix
                  addressing this issue will be available at the end
                  of June.
     2017.05.18 - 30 business days have elapsed since this issue was
                  reported.
     2017.06.09 - 45 business days have elapsed since this issue was
                  reported.
     2017.06.29 - Solarwinds releases hotfix.
     2017.07.06 - KoreLogic public disclosure.

7. Proof of Concept

     See 3. Technical Description


The contents of this advisory are copyright(c) 2017
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:
https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Polic=
y.v2.2.txt


--1DiBMXPVMVPPs1MDn0WaRlngBodBegH1X--

--1nw5sR63cKwgMmRWdpSOhkBNgSuCTX3ex
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQFOBAEBCAA4FiEE+cSrtp5jQJEtra70TWWaLA4ZiQwFAllejhkaHGRpc2Nsb3N1
cmVzQGtvcmVsb2dpYy5jb20ACgkQTWWaLA4ZiQxFeAgAlgUbGySzevyvXAmxGQHR
P1gYba1wNfPpwHXwDy53P6tQ2V4bl2Hw9IhhgXdHalbMB8KHQ/dQteSQfWESWukn
1FyHuQUU2Qco5XAncmGFXTh/clM3eqCwG5InbL+g0N3M9flkiZIOUmLRAPhXO5ta
X9gAo3XStDJJEFKegATb1t/XvWK0CLnObiW0hmtmjQsdBlICJtmN1Be0G1ARZkWo
W2jvmW78CnhudzBmbviUK3517uxZm7AZvk0ZzJJ3MmffJyMPpqtLPG31YyxOoL+n
3ZKcVm0nDBUAamjTjwxt75A6mIEsGmREBAk2JShmsZ498rCzpmABguwiz2Ndm2HP
EA==
=L+78
-----END PGP SIGNATURE-----

--1nw5sR63cKwgMmRWdpSOhkBNgSuCTX3ex--