Document Title: =============== SmarterTools Smarter Track 6-10 - Information Disclosure Vulnerability
References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1298 Tracking ID: 088-1B879F0C-0A22 Release Date: ============= 2014-09-22 Vulnerability Laboratory ID (VL-ID): ==================================== 1298 Common Vulnerability Scoring System: ==================================== 6.1 Product & Service Introduction: =============================== SmarterTrack is a powerful communications platform that acts as an online help desk for initiating, tracking, managing and reporting on a number of different communication channels. Whether it is a ticket submission via email or from the online portal, a live chat, a community post, comments made on a knowledge base article or more, SmarterTrack provides a centralized outlet for all communication channels and is an ideal solution for building your online community. ( Copy of the Vendor Homepage: http://www.smartertools.com/smartertrack/help-desk-software.aspx ) Abstract Advisory Information: ============================== An independent Vulnerability Laboratory Researcher discovered an Information Disclosure issue in the official SmarterTools Smarter Track v6,v7,v8,v9 & v10. Vulnerability Disclosure Timeline: ================================== 2014-08-23: Researcher Notification & Coordination (Ehsan Vahab ) 2014-08-23: Vendor Notification (Smartertools Security Team) 2014-08-25: Vendor Response/Feedback (Smartertools Security Team) 2014-09-21: Vendor Fix/Patch Notification (Smartertools - Developer Team) 2014-09-22: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ An Information Disclosure vulnerability has been discovered in the smarter track v(6,7,8,9,10) web-application. The information disclosure issue allows a remote attacker to gain unauthorized access to available mail conversations. The vulnerability allows remote attackers to get all of the mail messages that gets transfered between the customer and application owner. The vulnerability is located in the AvatarHandler.ashx file with vulnerable query string parameter `logoid`. remote attackers are able to change in the GET method request the logoid and can download the .zip files that contains the .eml (outlook extension) file. The .eml file impact admin or user messages. If the logoid was wrong the zip file capacity is 0 byte and download is not possible. Exploitation of the vulnerability requires no privileged web application user account and also no user interaction. Successful exploitation of the issue results in unauthorized access to private server communication via email support. Request method(s): [+] GET Vulnerable File(s): [+] AvatarHandler.ashx Vulnerabel ´Parameter(s): [+] logoid Proof of Concept (PoC): ======================= The vulnerability can be exploited by remote attackers without privileged application user account and also without user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Google Dork : inurl:/kb/root.aspx PoC : smartertrack.localhost.com/AvatarHandler.ashx?logoid=[vulnerable number] Wrong logoid: http://support.xxx.com/AvatarHandler.ashx?logoid=182206 Correct logoid: http://support.xxx.com/AvatarHandler.ashx?logoid=208758 http://support.xxx.com/AvatarHandler.ashx?logoid=208765 http://support.xxx.com/AvatarHandler.ashx?logoid=208766 Solution - Fix & Patch: ======================= 2014-09-21: Vendor Fix/Patch Notification (Smartertools - Developer Team) Security Risk: ============== The security risk of the information dsiclosure issue is estimated as medium(+). Credits & Authors: ================== Ehsan Vahab (https://www.linkedin.com/profile/view?id=305567696) Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: ad...@vulnerability-lab.com - resea...@vulnerability-lab.com - ad...@evolution-sec.com Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (ad...@vulnerability-lab.com or resea...@vulnerability-lab.com) to get a permission. Copyright © 2014 | Vulnerability Laboratory [Evolution Security] -- VULNERABILITY LABORATORY RESEARCH TEAM DOMAIN: www.vulnerability-lab.com CONTACT: resea...@vulnerability-lab.com _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
