Multiple vulnerabilities in Palo Alto Zingbox Inspector

1) Insufficient verification of data authenticity

EUVDB-ID: #VU21513

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1584

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

the vulnerability exists due to Zingbox Inspector accepts and executes commands sent from a trusted Zingbox cloud, authenticated with PKI. A remote attacker with ability to perform man-in-the-middle (MitM) attack can execute arbitrary commands on the affected system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280 - 1.293

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/164

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) OS Command Injection

EUVDB-ID: #VU21512

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15014

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists in the Zingbox Inspector CLI. A localuser can execute arbitrary OS commands on the target system within the product CLI console.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280 - 1.286

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/167

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) SQL injection

EUVDB-ID: #VU21511

Risk: Medium

CVSSv3.1: 4 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15016

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the Zingbox Inspector management interface. A remote authenticated user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280 - 1.288

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/173

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use of hard-coded credentials

EUVDB-ID: #VU21509

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15017,CVE-2019-15015

CWE-ID: CWE-798 - Use of Hard-coded Credentials

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain full access to vulnerable system.

The vulnerability exists due to presence of hard-coded credentials in application code for root and inspector user account. A remote unauthenticated attacker can access the affected system using the hard-coded credentials via SSH server that is also exposed by default.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280 - 1.294

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/170
http://securityadvisories.paloaltonetworks.com/Home/Detail/176

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Authentication

EUVDB-ID: #VU21507

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15018

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to absent authentication checks when binding tenants. A remote authenticated user can bind the Inspector instance to a different customer tenant.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/179

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Download of code without integrity check

EUVDB-ID: #VU21506

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15019

CWE-ID: CWE-494 - Download of Code Without Integrity Check

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system

The vulnerability exists due to software does not perform software integrity check when downloading firmware updates. A remote attacker with ability to perform man-in-the-middle (MitM) attack can supply a malicious firmware image and gain full control over the affected system after a successful software update.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280 - 1.294

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/182

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Download of code without integrity check

EUVDB-ID: #VU21505

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15020

CWE-ID: CWE-494 - Download of Code Without Integrity Check

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system

The vulnerability exists due to software does not perform software integrity check when downloading updates. A remote attacker with ability to perform man-in-the-middle (MitM) attack can supply a malicious software image and gain full control over the affected system after a successful software update.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280 - 1.293

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/185

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU21504

Risk: Medium

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15021

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted request to Zingbox Inspector and identify any running instances of Zingbox Inspector on a local area network.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280 - 1.294

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/188

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) ARP spoofing

EUVDB-ID: #VU21503

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15022

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to absence of protection against ARP spoofing. A remote attacker can spoof ARP packets and gain unauthorized access to Zingbox Inspector.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280 - 1.294

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/191

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Unprotected storage of credentials

EUVDB-ID: #VU21500

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-15023

CWE-ID: CWE-256 - Unprotected Storage of Credentials

Exploit availability: No

Description

The vulnerability allows a local user to gain access to other users' credentials.

The vulnerability exists due to application stored credentials in plain text in a configuration file on the system. A local user can view contents of the configuration file and gain access to passwords for 3rd party integration.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zingbox Inspector: 1.280 - 1.294

External links

http://securityadvisories.paloaltonetworks.com/Home/Detail/194

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.