LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES- - Unauthenticated Access

From: LSE Leading Security Experts GmbH (Security Advisories) <>
To: Bugtraq <>,
Subject: LSE Leading Security Experts GmbH - LSE-2014-04-10 - Sitepark IES- - Unauthenticated Access

=== LSE Leading Security Experts GmbH - Security Advisory 2014-04-10 ===

Sitepark Information Enterprise Server (IES) - Unauthenticated Access

Affected Versions
Information Enterprise Server (IES) Version 2.9 until 2.9.6

Issue Overview
Technical Risk: high
Likelihood of Exploitation: medium
Vendor: Sitepark GmbH
Credits: LSE Leading Security Experts GmbH employees
  Markus Vervier and Sascha Kettler
Advisory URL:
Advisory Status: Public
CVE-Number: CVE-2014-3006

Issue Description
While conducting a penetration test LSE Leading Security Experts GmbH
discovered that the installer of the Information Enterprise Server (IES)
was available to unauthenticated users over HTTP.

When updating from previous versions of IES, an installation form was not
disabled after installation. In this case the servlet "/ies/install" was
exposed to unauthenticated users.

By accessing the servlet at URI "/ies/install/" on an affected IES server,
an unauthenticated attacker was able to set a new password for the manager
account. Additionally sensitive information regarding the IES
installation was displayed.

Temporary Workaround and Fix
LSE Leading Security Experts GmbH advises to prevent access to the
URI "/ies/install/" by configuring web servers or proxy servers accordingly.
For example using the Apache webserver a "Directory" directive would be

<Location /ies/install>
  Order Deny,Allow
  Deny from all
  Satisfy all

A hotfix is available from the vendor via the automatic update functionality
for IES versions 2.9 until 2.9.6.

An attacker is able to learn the license key and sensitive directory names
of the IES. Additionally the password for the account "manager" can be
reset which grants full access rights with the management role.

According to the vendor this issue affects only installations that are
updated from previous versions of IES to versions 2.9 until 2.9.6.

2014-04-02  Issue discovered
2014-04-03  Vendor informed by customer, Vendor released hotfix and
  updated managed installations
2014-04-16  Permission of customer for advisory
2014-04-16  Direct vendor contact
2014-04-22  Vendor reply
2014-04-27  CVE assigned
2014-04-30  Advisory publicly released

LSE Leading Security Experts GmbH, Postfach 100121, 64201 Darmstadt
Tel: +49 6151 86086-0, Fax: -299
Unternehmenssitz: Weiterstadt, Amtsgericht Darmstadt: HRB8649
Geschaeftsfuehrer: Oliver Michel, Sven Walther

Copyright © 1995-2019 All rights reserved.