SqlNow: SQL Injection in DeliverNow: CVE-2021-26837

During an internal penetration test for a client, I identified a noteworthy vulnerability in DeliverNow, a software solution developed by HelpSystems now Fortra. This particular finding has since been documented as CVE-2021-26837.

1. Software Overview:

DeliverNow is an automated document-distribution application. It operates in the background, locating documents on various operating systems, and then converts these documents to different formats. Once converted, it then dispatches them to platforms such as email, WebDocs, and PC directories, among others.

2. Details on Version & Environment:

• Software Version: DeliverNow 1.2.18 and earlier
• OS Tested On: Windows Server 2019 Datacenter10.0 (X64), SQL Server 2017 (RTM-CU20) -14.0.3294.2 (X64)
• Type of Vulnerability: SQL Injection
• CVSSv2 Score: 9.0 (AV:N/AC:L/Au:N/C:C/I:P/A:P)

My analysis highlighted that DeliverNow does not handle user data in POST body parameters as securely as it could. I identified a potential SQL injection point in a search box located in the application’s log section. The most notable aspect was that this vulnerability could be accessed without complex exploits.

Further analysis revealed that the “SearchTextbox” parameter is vulnerable to SQL injection. Additionally, the database operates under SA rights aka SysAdmin, indicating a potential need for tighter access control.

Exploited Form: http://x.x.x.x:1080/LogGrid.aspx

3. Potential Impact:

The real-world impact largely depends on the SQL server’s configuration. In certain scenarios, an individual could possibly use the SQL injection to gain access under the identity of the database’s user. Moreover, this might allow interception of password hashes, which can lead to more advanced attacks, especially if the database user possesses sysadmin rights.

Figure 1: Identifying SQL Injection

Figure 2: Exploiting SQL Injection to Force Authentication

Figure 3: Capturing Forced Authentication

Figure 4: Database User Enumeration

Figure 5: Exploit PoC

4. Exploitation:

Interestingly, I noted that intricate exploits aren’t needed to make use of this vulnerability. Common hacking tools such as Metasploit, Sqlmap, and Impacket can detect and potentially exploit it.

5. Suggested Fixes:

For remediation, I advised the use of prepared statements for SQL queries to prevent injection attacks. Additionally, integrating server-side logic to cleanse user inputs prior to executing SQL queries is advisable.

In closing, My observation during this routine testing brings CVE-2021-26837 to our attention, underlining the importance of continual software assessment and improvement.

Stay informed and keep security at the forefront