Software Engineering Institute

The SEC Consult Vulnerability Lab Security Advisory states:

The following vulnerability description has been categorized into the components where the vulnerabilities have been identified.

1) Insufficient authentication in many components: Many components of GroundWork are only "secured" by Referer-header checks. An attacker who uses a specific, known Referer-header of the GroundWork Apache configuration file is able to access parts of the administration interface without prior authentication. Only few components are additionally secured by the JOSSO Single-Sign-On system.

2) Foundation webapp admin interface:
2.1) Referer-check: The webapp is only "secured" by a referer check, an unauthenticated attacker is able to access the admin interface. The attacker also has write access and is able to manipulate settings as admin user and he can further exploit other vulnerabilities.
2.2) Unauthenticated file disclosure & file write/modification An unauthenticated attacker is able to read arbitrary files of the operating system with the access rights of the operating system user "nagios" (the only "security protection" is the weak Referer-check from 2.1).
2.3) Multiple permanent XSS vulnerabilities An unauthenticated attacker is able to store malicious JavaScript/HTML code in many places within the admin interface and hence further attack / take over admin users of GroundWork! If an administrator e.g. clicks on the "Administration" /"Foundation" menu within GroundWork, the JavaScript code will be executed automatically.

3) MONARCH component:
3.1) Direct OS command injection An attacker with a valid cookie (JOSSO SSO) with at least low-privileged "user" access rights is able to execute arbitary operating system commands. He is able to gain access to sensitive configuration files, e.g. passwords of Nagios (and hence of many services within the monitored network) in cleartext.
3.2) XML external entity injection & arbitrary XML file (over-)write The Monarch components suffer from XXE attacks where an attacker e.g. is able to read arbitrary files of the operating system (sensitive configuration files, etc.).
The vulnerability can be exploited by uploading a malicious XML file within the "Profile Importer" component and then view this uploaded file within the same module.

4) Nagios-App component
4.1) Access to sensitive files, A low privileged user is able to gain access to log files or nagios configuration files (e.g. clear text passwords) just by entering the corresponding URL and including the Referer-header from 1).

5) Performance component
5.1) Write files & execute operating system commands An unauthenticated attacker is able to write files (filename & path can be chosen arbitrarily) with pre-given XML content with the access rights of the "nagios" operating system user. The XML content is partially given by the application, but can be modified by the attacker for further injection attacks. In the end it is possible to execute operating system commands, e.g. by using SSI (server-side includes) injection.

Note there are additional vulnerabilities.

For detailed vulnerability information regarding the above listed vulnerabilities and additional vulnerabilities see SEC Consult Vulnerability Lab Security Advisory 1 and SEC Consult Vulnerability Lab Security Advisory 2.

A remote unauthenticated attacker may be able to modify the administrator web interface of the system, read sensitive configuration files, or execute arbitrary operating system commands with the permission's of the GroundWork Monitor Enterprise system.

Change configuration

GroundWork has released a technical bulletin addressing some of the vulnerabilities. Users are advised to read GroundWork's technical bulletin and apply the recommended changes.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent SQLi, unauthenticated file uploads, or denial of service attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing a web interface using stolen credentials from a blocked network location.