Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 13 Sep 2018 07:48:28 +0200 (CEST)
From: Guillaume Quéré <guillaume@...re.eu>
To: oss-security@...ts.openwall.com
Subject: Cleartext passwords external services in Squash TM's web interface

SquashTM
--------
Squash TM is a web interface used to manage test cases. More at: https://www.squashtest.org/en

Description
-----------
There is a vulnerability in SquashTM's administration panel, where external services (a.k.a. automation servers) are defined: each service's HTML page contains the cleartext password of the service's account. These external services could be anything but a popular example is a Jenkins server.

I believe there is no reason that a service should display the password of another service, as this gives an attacker the opportunity to spread laterally. If *anything*, the password should be hashed but then again I fail to see any reason this information should be provided at all in this context. This is somewhat even more exploitable given the fact that Squash's default credentials are admin:admin.

Details
-------
Here's an example URL: http://localhost:8080/squash/administration/test-automation-servers/1
Here's an extract of the page's source code:
      <label for="ta-server-password">Password</label>
      <div id="ta-server-password" class="display-table-cell" style="font-weight: bold;">cleartext_password</div>

Scoring
-------
Attack vector: network
Attack complexity: low 
Authentication required: yes (admin)
Impacts: confidentiality
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Timeline
--------
2018-07-20: Vulnerability reported as a private security bug: https://ci.squashtest.org/mantis/view.php?id=7553
2018-09-11: ACK required from editor
2018-09-13: Disclosure to oss-sec


Unsure if I should request a CVE for this? Seems kinda trivial.

Guillaume Quéré

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.