1. Symantec/
  2. Security Response/
  3. Attack Signatures/
  4. Attack: WebNMS Framework Remote Code Execution CVE-2016-6603

Attack: WebNMS Framework Remote Code Execution CVE-2016-6603

Severity: High

This attack could pose a serious security threat. You should take immediate action to stop any damage or prevent further damage from happening.

Description

An attacker can exploit these issues using directory-traversal characters ('../') to access or read arbitrary files that contain sensitive information or to access files outside of the restricted directory or obtain sensitive information and impersonate arbitrary users and perform unauthorized actions. This may lead to further attacks.

Additional Information

WebNMS Framework is prone to following security vulnerabilities:

1. A directory-traversal vulnerability because it fails to properly sanitize user supplied input. Specifically, this issue affects the 'fileName' parameter of the 'FileUploadServlet'. An attacker can exploit this issue to upload a malicious file on the server.

2. A directory-traversal vulnerability because it fails to properly sanitize user supplied input. Specifically, this issue affects the 'fileName' parameter of the 'FetchFile' servlet. An attacker can exploit this issue to download arbitrary files from the server.

3. An information-disclosure vulnerability because it uses a weak encryption algorithm to store the passwords. Specifically, this issue affects the './conf/securitydbData.xml' file.

4. A user-impersonation vulnerability because it allows an unauthenticated attackers to impersonate legitimate users. An attacker can exploit this issue by sending a 'UserName' header in the HTTP request.

An attacker can exploit these issues using directory-traversal characters ('../') to access or read arbitrary files that contain sensitive information or to access files outside of the restricted directory or obtain sensitive information and impersonate arbitrary users and perform unauthorized actions. This may lead to further attacks.

Affected

  • WebNMS Framework 5.2 and 5.2 SP1 are vulnerable.
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube