Tales of Authentication Bypass Across ManageEngine Products

<filter>    
    <filter-name>Security Filter</filter-name>
    <filter-class>com.adventnet.iam.security.SecurityFilter</filter-class>

    <init-param>
        <param-name>config-file</param-name>
        <param-value>security-properties.xml,security-defaultresponseheaders.xml,__TRUNCATED__</param-value>
    </init-param>
</filter>

<filter-mapping>
    <filter-name>Security Filter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<url path="/internalconnectorapi/connector/[a-z0-9]+/db/[0-9]+/CANCREATESETUPFORORG" operation-type="read" authentication="required" app-roles="SUPERADMIN" resource="DB" resource-param="db" internal="true"  oauthscope="metadata">
    <param name="ORGID" regex="zrtext" secret="true" />
    <param name="ORGNAME" regex="zrtext" secret="true" />
</url>

<regex name="zrtext" value="[\p{L}\p{N}\p{P}\p{S}\p{C}\p{M}\p{Z}]+" />

String uri = request.getRequestURI();
if (uri.contains(";")) {
    logger.log(Level.SEVERE, "******INVALID******* Pathparameter value is present in the request : {0}", uri);
    throw new IAMSecurityException("URL_RULE_NOT_CONFIGURED");
}

if (this.securityFilterConfig.isDisablePathParameterURIDecodingCheck() || !uri.contains("%3b") && !uri.contains("%3B")) {
    if (DispatcherType.REQUEST.equals(request.getDispatcherType()) && (uri.contains(".") || uri.contains("%2e") || uri.contains("%2E"))) {
        for(String pattern : SecurityUtil.PATH_TRAVERSAL_PATTERNS) {
            if (uri.contains(pattern)) {
                logger.log(Level.SEVERE, "Dot Dot Slash is present in the request URI : {0}", uri);
                throw new IAMSecurityException("URL_RULE_NOT_CONFIGURED");
            }
        }
    }

<url path="${contextpath}/([_a-zA-Z0-9\-\.\/]+).(npng|jpg|js|css|eot|svg|ttf|otf|woff|gif|html|ico|cur|ttf|bmp|png)" app-roles="PUBLIC" operation-type="read" method="get" authentication="optional">

<servlet-mapping>
    <servlet-name>ZAAdminPageAudit</servlet-name>
    <url-pattern>/admintool/*</url-pattern>
</servlet-mapping>

ArrayList<> results = new ArrayList<>();
int b = wildcardWrappers.length;
for (int i = 0; i < b; i++) {
    results.add(wildcardWrappers[i].object.getServletClass());
}
results.stream().toArray();

<servlet>
    <servlet-name>ZACustomConnectorAdmin</servlet-name>
    <servlet-class>com.zoho.bi.zacustomconnector.connectoradmin.ZACustomConnectorAdminServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>ZACustomConnectorAdmin</servlet-name>
    <url-pattern>/connectoradmin/*</url-pattern>
</servlet-mapping>

public ClientAPIRequest(HttpServletRequest request, HttpServletResponse response) {
    super(request);
    this.response = response;
    String uri = request.getRequestURI().substring(1);
    String[] uriArray = uri.split("/");
    boolean isCustomInternal = uri.startsWith("internalconnectorapi/v2");
    this.uriParams.put("action", uriArray[uriArray.length - 1]);
    int sIndex = !uriArray[0].equals("reports") && !isCustomInternal ? 1 : 2;

    for(int i = sIndex; i < uriArray.length - 1; i += 2) {
        this.uriParams.put(uriArray[i], uriArray[i + 1]);
    }
}

public String getResourceValue(String resourceName) {
    return (String)this.uriParams.get(resourceName);
}

protected JSONObject executeAPIWithTxn(ClientAPIRequest req) throws Exception {
    String action = req.getZDBAction();
    try {
        Long connInfoId = req.getResourceValue("conndbinfoid") != null ? Long.parseLong(req.getResourceValue("conndbinfoid")) : null;
        if (connInfoId != null) {
            APIFactoryProvider.getThreadLocalAPI().setThreadLocalForGeneratedId(connInfoId);
    // truncated...

if (action.equals("UPDATECONNECTORMETA")) {

    JSONObject response = new JSONObject();
    Long connModId = req.getParam("CONNMODID") != null ? Long.parseLong(req.getParam("CONNMODID")) : null;
    Long connEntityId = req.getParam("CONNENTITYID") != null ? Long.parseLong(req.getParam("CONNENTITYID")) : null;
    String updColum = req.getRequiredParam("COLUMN");
    String updColumValue = req.getRequiredParam("VALUE");
    String table = req.getRequiredParam("TABLE");
    ZAConnConsumerUtil.updateTableValue(table, updColum, updColumValue, connInfoId, connModId, connEntityId); // [1]
    response.put("message", "Restored Successfully");
    JSONObject connPerms = response;
    return connPerms;
}

public static void updateTableValue(String tableName, String columnName, String columnValue, Long connInfoId, Long connModId, Long connEntitiyId) throws Exception {
    String sql = null;
    switch (tableName) {
        case "CustomConnectorInfo":
            sql = SQLQueryAPI.getSQLString("ZAUpdateTableColValueForConnInfo", new Object[][]{{"UPDATECOLUMN", columnName}, {"UPDATEDVALUE", columnValue}, {"CONNINFOID", connInfoId}});
            break;
        case "CustomConnectorModuleInfo":
            sql = SQLQueryAPI.getSQLString("ZAUpdateTableColValueForConnModInfo", new Object[][]{{"UPDATECOLUMN", columnName}, {"UPDATEDVALUE", columnValue}, {"CONNINFOID", connInfoId}, {"CONNMODID", connModId}});
            break;
        case "CustomConnectorEntityInfo":
            sql = SQLQueryAPI.getSQLString("ZAUpdateTableColValueForConnEntityInfo", new Object[][]{{"UPDATECOLUMN", columnName}, {"UPDATEDVALUE", columnValue}, {"CONNINFOID", connInfoId}, {"CONNENTITYID", connEntitiyId}});
            break;
        case "CustomConnectorModuleStatus":
            sql = SQLQueryAPI.getSQLString("ZAUpdateTableColValueForModuleStatus", new Object[][]{{"UPDATECOLUMN", columnName}, {"UPDATEDVALUE", columnValue}, {"CONNMODID", connModId}, {"CONNENTITYID", connEntitiyId}});
    }

    if (sql != null) {
        SQLQueryAPI.executeUpdate(sql, new RptSQLAdapter(connInfoId != null ? connInfoId : connModId));
    }

}

<sql name="ZAUpdateTableColValueForConnInfo"> <![CDATA[
    update CustomConnectorInfo set ${UPDATECOLUMN:STRING}= '${UPDATEDVALUE:STRING}' where CONNINFOID = ${CONNINFOID:LONG}
]]> </sql>

<!-- Login required for the following URLs -->
<security-constraint>
    <web-resource-collection>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>*</role-name>
    </auth-constraint>
</security-constraint>

<security-constraint>
	<web-resource-collection>
		<web-resource-name>Secured Core Context</web-resource-name>
		<!-- For static files URLs -->
		<url-pattern>/scripts/*</url-pattern>
		<url-pattern>/images/*</url-pattern>
		<url-pattern>/favicon.ico</url-pattern>
		<url-pattern>/fonts/*</url-pattern>
		<url-pattern>/zohocomponents/*</url-pattern>

		<!-- truncated... -->
	</web-resource-collection>
</security-constraint>

<url method="post" roles="SDSiteAdmin,SDAdmin" path="/api/v3/users/(\d+)/(_?)reset_password" >
<url method="post" roles="SDOrgAdmin" path="/api/v3/orgusers/(\d+)/(_?)reset_password"  user_type="all">

<servlet>
    <servlet-name>api/v3</servlet-name>
    <servlet-class>com.manageengine.servicedesk.sdpapi.v2.servlet.SDPAPIV2Servlet</servlet-class>
</servlet>

<servlet-mapping>
    <servlet-name>api/v3</servlet-name>
    <url-pattern>/api/v3/*</url-pattern>
</servlet-mapping>

<servlet>
    <servlet-name>apiv2</servlet-name>
    <servlet-class>com.manageengine.servicedesk.sdpapi.v2.servlet.SDPAPIV2Servlet</servlet-class>
</servlet>

<servlet-mapping>
    <servlet-name>apiv2</servlet-name>
    <url-pattern>/apiv2/*</url-pattern>
</servlet-mapping>

<filter>
    <filter-name>StateFilter</filter-name>
    <filter-class>com.adventnet.client.view.web.StateFilter</filter-class>
</filter>

<filter-mapping>
    <filter-name>StateFilter</filter-name>
    <url-pattern>/STATE_ID/*</url-pattern>
</filter-mapping>

public class StateFilter implements Filter, WebConstants {
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        try {
            StateParserGenerator.processState((HttpServletRequest)request, (HttpServletResponse)response); // [1]
            String forwardPath = ((HttpServletRequest)request).getRequestURI();
            if (WebClientUtil.isRestful((HttpServletRequest)request) && forwardPath.indexOf("STATE_ID") == -1) {
                chain.doFilter(request, response);
            } else {
                String path = this.getForwardPath((HttpServletRequest)request); // [2]
                RequestDispatcher rd = request.getRequestDispatcher(path);
                rd.forward(request, response); // [3]
            }
        // truncated
    }

    private String getForwardPath(HttpServletRequest request) {
        String path = request.getContextPath() + "/STATE_ID/";
        String forwardPath = request.getRequestURI();
        if (!forwardPath.startsWith(path)) {
            return forwardPath;
        } else {
            int index = forwardPath.indexOf(47, path.length());
            if (WebClientUtil.isRestful(request)) {
                forwardPath = forwardPath.substring(path.length() - 1);
            } else if (index > 0) {
                forwardPath = forwardPath.substring(index);
            }

            return forwardPath;
    }
}

<regexes>
    <regex name="meagentacceptall" value=".*"/>
</regexes>
<url path="/${meagentacceptall}/me-agent/${meagentacceptall}" method="get" threshold="30" duration="1" lock-period="5" >