bugtraq - CVE-2014-8487: Kony EMM insecurity Direct Object Reference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 22 Feb 2015 16:09:54 GMT
From: michael.hendrickx@...pag.com
To: bugtraq@...urityfocus.com
Subject: CVE-2014-8487: Kony EMM insecurity Direct Object Reference

------------------------------------------------------------------------
Product: Enterprise Mobile Management
Vendor: Kony
Vulnerable Version(s): Kony EMM 1.2 and probably older versions 
Tested Version: Drupal Kony EMM 1.2 
Advisory Publication: 24 December 2014 
Vendor Notification: 8 December 2014 
Vulnerability Type: Insecure Direct Object References 
CVE Reference: CVE-2014-8487 
Risk Level: Low Solution 
Status: Solution not yet released 
Discovered and Provided: Michael Hendrickx, Help AG
------------------------------------------------------------------------

About the vendor:
Kony EMM is a mobile management suite that allows organizations to manage employee's personal devices.  It enables users to use their own device, or as often called BYOD or "bring your own device".

About the vulnerability:
During a pentest we discovered that a logged in user can access arbitrary information such as messages and phone information about every phone that's enrolled ot the solution.  Often the user's colleagues:

1.) Arbitrary Message retrieval
By using the following URL:

https://<kony_emm>/emm/selfservice/managedevice/getMessageBody?messageId=<message ID>

Where <message ID> is an integer, an attacker can retrieve all messages sent to every mobile enrolled on the system.

2.) Information retrieval

By going to the following URL

https://<kony_emm>/emm/selfservice/devicemgmt/getDeviceInfoTab.htm?requestId=<request_id>&..."

An attacker can retrieve earlier "requests".  A request "task" is generated when a person requests more information about his/her phone, such as IMEI numbers, phone, last locations, etc.

-----------------------

Solution:

The vendor was notified, contact the vendor for the patch details

References:

[1] help AG middle East http://www.helpag.com/ 
[2] Kony https://kony.com/