[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 13 Sep 2018 07:48:28 +0200 (CEST)
From: Guillaume Quéré <guillaume@...re.eu>
To: oss-security@...ts.openwall.com
Subject: Cleartext passwords external services in Squash TM's web interface
SquashTM
--------
Squash TM is a web interface used to manage test cases. More at: https://www.squashtest.org/en
Description
-----------
There is a vulnerability in SquashTM's administration panel, where external services (a.k.a. automation servers) are defined: each service's HTML page contains the cleartext password of the service's account. These external services could be anything but a popular example is a Jenkins server.
I believe there is no reason that a service should display the password of another service, as this gives an attacker the opportunity to spread laterally. If *anything*, the password should be hashed but then again I fail to see any reason this information should be provided at all in this context. This is somewhat even more exploitable given the fact that Squash's default credentials are admin:admin.
Details
-------
Here's an example URL: http://localhost:8080/squash/administration/test-automation-servers/1
Here's an extract of the page's source code:
<label for="ta-server-password">Password</label>
<div id="ta-server-password" class="display-table-cell" style="font-weight: bold;">cleartext_password</div>
Scoring
-------
Attack vector: network
Attack complexity: low
Authentication required: yes (admin)
Impacts: confidentiality
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Timeline
--------
2018-07-20: Vulnerability reported as a private security bug: https://ci.squashtest.org/mantis/view.php?id=7553
2018-09-11: ACK required from editor
2018-09-13: Disclosure to oss-sec
Unsure if I should request a CVE for this? Seems kinda trivial.
Guillaume Quéré
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
