1. Introduction
The ManageEngine Firewall Analyzer application uses a default set of known credentials. This means an attacker could gain administrative access to systems running the software without valid user authentication. Businesses using this product are at risk of data breaches and system compromise. Affected systems typically include web servers hosting the application.
2. Technical Explanation
The remote ManageEngine Firewall web administration interface uses a hard-coded default username and password. An attacker can exploit this by attempting to log in with these credentials, bypassing normal authentication mechanisms. This vulnerability is not assigned a CVE at the time of writing but is widely known within the security community.
- Root cause: The application ships with pre-defined credentials that are not changed during installation or initial configuration.
- Exploit mechanism: An attacker attempts to log in to the web administration interface using default credentials (typically ‘admin’ / ‘admin’). If successful, they gain full administrative access.
- Scope: ManageEngine Firewall Analyzer versions prior to those with patched default credential behaviour are affected.
3. Detection and Assessment
- Quick checks: Access the web administration interface and check the ‘About’ page for the installed version.
- Scanning: Nessus plugin ID 10429 can detect this vulnerability. This is an example only; other scanners may also provide detection capabilities.
- Logs and evidence: Examine application logs for successful logins using the default credentials. Log files are typically located in the application’s installation directory.
# No command available to check version directly without access to the web interface. Accessing the 'About' page is required.4. Solution / Remediation Steps
Change the application’s default credentials immediately.
4.1 Preparation
- A change window may be required depending on your organization’s policies. Approval from a system administrator might be needed.
4.2 Implementation
- Step 1: Log in to the Firewall Analyzer web administration interface using the default credentials (‘admin’ / ‘admin’).
- Step 2: Navigate to Administration > Users > User Details.
- Step 3: Change the password for the ‘admin’ user to a strong, unique password.
- Step 4: Log out of the web administration interface and log back in using the new credentials to verify the change.
4.3 Config or Code Example
Before
# Default credentials are used: admin / adminAfter
# New, strong password set for 'admin' user. 4.4 Security Practices Relevant to This Vulnerability
Several security practices can help prevent this type of issue.
- Practice 1: Enforce strong passwords and regular password changes. This reduces the risk of successful brute-force attacks.
- Practice 2: Implement least privilege access control. Limit user permissions to only what is necessary for their role.
4.5 Automation (Optional)
No suitable automation script is available due to the need for interactive login and password change within the web interface.
5. Verification / Validation
- Post-fix check: Attempt to log in using ‘admin’ / ‘admin’. The login should fail.
- Re-test: Repeat step 1 from section 3 (attempting login with default credentials) and confirm it fails.
- Smoke test: Verify that you can still access reports, configure alerts, and perform other core functions of the application.
- Monitoring: Monitor application logs for failed login attempts using the default credentials as an indicator of potential attacks.
# Attempting to log in with 'admin' / 'admin' should result in a "Invalid username or password" error message.6. Preventive Measures and Monitoring
Update security baselines and implement checks in deployment pipelines.
- Baselines: Update your security baseline to include a requirement for changing default credentials on all new installations of ManageEngine Firewall Analyzer.
- Asset and patch process: Review configurations regularly to ensure default credentials haven’t been inadvertently reset.
7. Risks, Side Effects, and Roll Back
Changing the password incorrectly or losing access can impact service availability.
- Risk or side effect 1: Incorrectly changing the password could lock you out of the application. Ensure you have a documented recovery process.
- Risk or side effect 2: Service interruption if the new credentials are not properly saved or configured.
- Roll back: Restore from the pre-change backup to revert to the original configuration and default credentials.
8. References and Resources
Link only to sources that match this exact vulnerability.
- Vendor advisory or bulletin: ManageEngine Security Updates
- NVD or CVE entry: No specific CVE is currently assigned for this default credential issue.
- Product or platform documentation relevant to the fix: ManageEngine Firewall Analyzer User Management