ManageEngine User Enumeration
While conducting a penetration test of a client’s external network, I discovered a way to enumerate users’ in ManageEngine’s ADSelfService Plus application. This allows an attacker to determine the system Admin username.
Product: ManageEngine ADSelfService Plus
Software Version: 5.7, build 5704
The login page is vulnerable to account enumeration.
The admin login page is accessed through the web UI at the following URI:
Proof of Concept:
Attempt to login with an account that doesn’t exist, and you receive a unique error message.
If you then attempt to login to an account that does exist, then you will not receive the “No such user account configured”.
In order to prove this, I have written a POC script that you can find here that automates the enumeration based on a list of users.
After reaching out to the vendor they decided that this was not an issue and responded with the following statement:
“We’ve investigated this report. The mentioned ‘adminLogin.cc’ request is protected with the Threshold. So, user enumeration is not easy to perform. Additionally, these messages could be customized in the customer environment. Hence, closing this report as N/A.”
The ”Threshold” that they are alluding to is that by default, the application will show a CAPTCHA after 3 invalid login attempts in order to slow brute forcing down, but this does not remedy the concern with disclosing which accounts exist.
2019-02-18 – Vulnerability Disclosed to Vendor
2019-02-18 – Vendor Replied and Started Investigating
2019-03-20 – Vendor Closed as Non-Issue
by Chase Dardaman | TEAMARES, CRITICALSTART
March 26, 2019
Senior Adversarial Engineer, TEAMARES
As a Senior Adversarial Engineer on TEAMARES, Charles brings numerous years of experience in both offensive and defensive security. He is an expert in both network and web application penetration testing, as well as reverse engineering and binary analysis. He is an active member of the local security community, and often speaks at cybersecurity meet-ups.
You may also be interested in…
- Consumer Education(39)
- Consumer Stories(2)
- Cybersecurity Consulting(10)
- Data Breaches(15)
- Data Privacy(43)
- Incident Response(9)
- MDR Services(64)
- Penetration Testing(16)
- Press Release(60)
- Research Report(9)
- Security Assessments(16)
- Thought Leadership(17)
- Threat Hunting(9)
- Vulnerability Disclosure(3)