CVE-2017-5496
📋 TL;DR
CVE-2017-5496 is an authentication bypass vulnerability in Sawmill Enterprise 8.7.9 that allows remote attackers to gain login access by using password hashes instead of actual passwords. This affects organizations using Sawmill Enterprise for log analysis and reporting. Attackers can bypass authentication entirely with knowledge of password hashes.
💻 Affected Systems
- Sawmill Enterprise
📦 What is this software?
Sawmill by Sawmill
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Sawmill Enterprise system, allowing attackers to access sensitive log data, modify configurations, and potentially pivot to other systems in the network.
Likely Case
Unauthorized access to log analysis data, potential exposure of sensitive information from logs, and ability to modify or delete log data.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to Sawmill interface.
🎯 Exploit Status
Exploit code is publicly available and requires only knowledge of password hashes, which can be obtained through other means or brute force.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.7.10 or later
Vendor Advisory: https://www.sawmill.net/
Restart Required: Yes
Instructions:
1. Download Sawmill Enterprise version 8.7.10 or later from vendor website. 2. Backup current configuration and data. 3. Install the updated version following vendor instructions. 4. Restart the Sawmill service.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to Sawmill Enterprise interface to only trusted IP addresses or internal networks.
Use firewall rules to restrict access to Sawmill port (typically 8000 or 80)
Change All Passwords
allChange all user passwords in Sawmill Enterprise to generate new password hashes.
Use Sawmill administration interface to change passwords for all user accounts
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to Sawmill interface
- Monitor authentication logs for suspicious login attempts and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check Sawmill version via web interface or configuration files. Version 8.7.9 is vulnerable.Check Version:
Check web interface or see version.txt in installation directoryVerify Fix Applied:
Verify version is 8.7.10 or later and test authentication with password hashes should fail.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful logins
- Multiple login attempts from same IP with different credentials
- Successful logins without corresponding password change events
Network Indicators:
- Unusual authentication traffic patterns
- Requests to authentication endpoints with hash-like parameters
SIEM Query:
source="sawmill" AND (event="authentication" AND result="success") AND NOT (user_changed_password="true" OR password_reset="true")🔗 References
- http://hyp3rlinx.altervista.org/advisories/SAWMILL-PASS-THE-HASH-AUTHENTICATION-BYPASS.txt
- http://packetstormsecurity.com/files/141177/Sawmill-Enterprise-8.7.9-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2017/Feb/46
- https://www.exploit-db.com/exploits/41395/
- http://hyp3rlinx.altervista.org/advisories/SAWMILL-PASS-THE-HASH-AUTHENTICATION-BYPASS.txt
- http://packetstormsecurity.com/files/141177/Sawmill-Enterprise-8.7.9-Authentication-Bypass.html
- http://seclists.org/fulldisclosure/2017/Feb/46
- https://www.exploit-db.com/exploits/41395/
