CVE-2014-9618
Description
The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Netsweeper 4.0.8 - Authentication Bypass (via New Profile Creation)
+-----------------------------------------------------------------+
+ Netsweeper 4.0.8 - Authentication Bypass (New Profile Creation) +
+-----------------------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com
Version : 4.0.8 (and probably other versions)
Discovered by : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched : Yes
CVE : CVE-2014-9618
+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.
+----------------------+
+ Exploitation Details +
+----------------------+
Netsweeper's 4.0.8 (and probably other versions) Client Filter Admin portal can be reached at http://netsweeper/webadmin/clientlogin/ and a username/password combination is required to Add a Profile, by setting the "action" parameter to "showdeny" it will force the admin interface to load and subsequently allow any non-authenticated user to create a new profile.
URL Path: http://netsweeper/webadmin/clientlogin/?srid=&action=showdeny&url=
+----------+
+ Solution +
+----------+
Upgrade to latest version.
+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2
17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public
18-Dec-2014: Confirm fix
17-Jan-2015: CVE assigned CVE-2014-9618
11-Aug-2015: Public disclosureApplication impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| netsweeper | netsweeper | {"endIncluding":"3.1.9"} | |
| netsweeper | netsweeper | 4.0.0 | |
| netsweeper | netsweeper | 4.0.1 | |
| netsweeper | netsweeper | 4.0.2 | |
| netsweeper | netsweeper | 4.0.3 | |
| netsweeper | netsweeper | 4.0.4 | |
| netsweeper | netsweeper | 4.0.5 | |
| netsweeper | netsweeper | 4.0.6 | |
| netsweeper | netsweeper | 4.0.7 | |
| netsweeper | netsweeper | 4.0.8 | |
| netsweeper | netsweeper | 4.1.0 | |
| netsweeper | netsweeper | 4.1.1 | |
References
CWEs
CWE-287
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.