{"id":602,"date":"2020-11-19T20:35:03","date_gmt":"2020-11-19T20:35:03","guid":{"rendered":"https:\/\/www.attackdebris.com\/?p=602"},"modified":"2020-11-22T09:55:51","modified_gmt":"2020-11-22T09:55:51","slug":"parallels-ras-username-enumeration-flaw-cve-2017-9447-strikes-again","status":"publish","type":"post","link":"https:\/\/www.attackdebris.com\/?p=602","title":{"rendered":"Parallels RAS Username Enumeration Flaw (CVE-2017-9447 Strikes Again?)"},"content":{"rendered":"\n

Earlier in the year I was assessing a network that contained a Parallels Remote Application Server (RAS). Parallels RAS is a remote working solution that provides access to virtual desktops and applications. It can run on both Windows and Linux and is typically seen on the standard HTTPS port.<\/p>\n\n\n\n

The platform has previously been affected vulnerable by a directory traversal flaw. The issue allowing remote, unauthenticated attackers to exploit the flaw to read arbitrary files from vulnerable systems (CVE-2017-9447).<\/p>\n\n\n\n

In this scenario testing revealed that the RAS service was no longer vulnerable to the directory traversal flaw, the issue having been mitigated in RAS version 15.5 Update 4, released in September 2017.<\/p>\n\n\n\n

However, an issue that appears to be related to the fix for this previous flaw was identified. Whilst it was no longer possible to retrieve\/read files via the directory traversal flaw. It was found to be  possible to determine if a file or folder was present on the remote RAS server by leveraging the same payload. This could be achieved via the different server responses received:<\/p>\n\n\n\n

A HTTP 403 (Forbidden) response being received when a folder\/file is present<\/p>\n\n\n\n

A HTTP 404 (Not Found) response received when a files does not exist<\/p>\n\n\n\n

In relation to a Windows installation it is possible to leverage this issue from an unauthenticated perspective to enumerate valid local Windows usernames, assuming they have a home directory on the target system. Once account names have been enumerated, they can obviously be subjected to password guessing attacks.<\/p>\n\n\n\n

The following request is used to enumerate the \u201cadministrator\u201d user. A  HTTP \u201c403 Forbidden\u201d response from the server confirms the directory\/user is present:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

On the flip side the following HTTP request returns a HTTP \u201c404 Not Found\u201d which reveals the queried directory\/user does not exist:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

As a result of the above HTTP response discrepancies it is obviously possible to fuzz the username field to quickly enumerate any Windows users that may be present on the system.<\/p>\n\n\n\n

Versions affected:<\/p>\n\n\n\n

The original file directory traversal flaw CVE-2017-9447<\/a> was fixed in RAS version 15.5 Update 4, released in September 2017.<\/p>\n\n\n\n

The file presence\/username enumeration flaw discussed here, was fixed in RAS Version 17.1.2 released in July 2020. Ultimately as a result of a non-optimal fix this issue has been present for nearly 3-years.<\/p>\n\n\n\n

Despite being in communication with the vendor, unhelpfully they opted to report the fix for this new 2020 flaw under the original 2017 CVE, which ultimately relates to an issue with a different impact.<\/p>\n\n\n\n

Parallels Remote Application Server version 17 Release Notes<\/em><\/a><\/p>\n\n\n\n

Release Notes snip below:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\n
\n
\n

Timeline<\/strong>:<\/p>\n\n\n\n

2nd<\/sup> June 2020 – Parallels Informed about the issue<\/p>\n\n\n\n

15th<\/sup> July 2020 – Parallels released a patch<\/p>\n\n\n\n

19th<\/sup> November 2020 \u2013 File presence\/Username enumeration flaw publicly disclosed<\/p>\n<\/div><\/div>\n\n\n\n

<\/p>\n<\/div><\/div>\n<\/div><\/div>\n\n\n\n

I have created the following metasploit module to leverage this flaw, which will be pushed to the metasploit project in the coming days.<\/p>\n\n\n\n

Here is the module in progress:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Here are the final results from the current wordlist:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The msf module can be downloaded from the link below:<\/p>\n\n\n\n

parallels_ras_user_enum.rb<\/em><\/a>Download<\/a><\/div>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Earlier in the year I was assessing a network that contained a Parallels Remote Application Server (RAS). Parallels RAS is a remote working solution that provides access to virtual desktops and applications. It can run on both Windows and Linux and is typically seen on the standard HTTPS port. The platform has previously been affected … <\/p>\n

Continue reading<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[],"class_list":["post-602","post","type-post","status-publish","format-standard","hentry","category-tools","item-wrap"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p3MDvd-9I","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/posts\/602","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=602"}],"version-history":[{"count":13,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/posts\/602\/revisions"}],"predecessor-version":[{"id":623,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/posts\/602\/revisions\/623"}],"wp:attachment":[{"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=602"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=602"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=602"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}