Junglewise Threat Intelligence

CVE-2016-6602: Zoho WebNMS Framework weak password obfuscation in securitydbData.xml

CVE-2016-6602 · Severity: critical · CVSS 9.8 · Published 2017-01-23

Vendors: Zoho.

Executive brief

Zoho WebNMS Framework, a platform used by telecommunications and service providers to build network management systems, uses a weak method for protecting user passwords. An attacker who can access the system's configuration files can easily reverse this protection to obtain cleartext passwords for all users, including administrators. This could lead to full unauthorized access to the management platform and the network infrastructure it controls.

Technical details

Zoho WebNMS Framework 5.2 and 5.2 SP1 utilize a reversible, weak obfuscation algorithm rather than a secure cryptographic hash to store user credentials in the 'WEB-INF/conf/securitydbData.xml' file. An attacker with read access to this file can deobfuscate the 'password' attribute for any user, including the 'root' account. While the vulnerability itself is a cryptographic weakness (CWE-327), it is frequently exploited in conjunction with a directory traversal vulnerability (CVE-2016-6601) in the 'FetchFile' servlet, which allows unauthenticated remote attackers to download the configuration file. Successful exploitation results in the disclosure of all system credentials in cleartext. No official patch was confirmed at the time of disclosure; users are advised to restrict network access to the WebNMS server.

Affected products

  • Zoho WebNMS Framework 5.2, 5.2 SP1

Timeline

  • 2016-07-04: disclosed: Initial discovery and disclosure to vendor via SSD program
  • 2016-08-08: advisory: Public disclosure by security researcher Pedro Ribeiro
  • 2017-01-23: advisory: NVD publication date

References