CVE-2020-10532
published 2020-03-12CVE-2020-10532: The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI.
PriorityP352high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
2.79%
84.6th percentile
The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| watchguard | ad_helper_firmware | < 5.8.5.10317 | 5.8.5.10317 |
Detection & IOCsextracted from sources · hover to see the quote
- →HTTP GET request to /rest/domains/list?sortCol=fullyQualifiedName&sortDir=asc returns HTTP 200 with JSON body containing all four fields: fullyQualifiedName, logonDomain, username, and password — indicating successful credential disclosure. ↗
- →Response body must contain all four JSON keys simultaneously: 'fullyQualifiedName', 'logonDomain', 'username', and 'password' (AND condition) to confirm exploitation. ↗
- →No authentication is required; the endpoint is accessible by unauthenticated remote attackers, so absence of auth headers in the request is expected during exploitation. ↗
- ·Vulnerability is present in WatchGuard Fireware AD Helper component versions prior to 5.8.5.10317; only those versions are affected. ↗
- ·The vulnerable component is specifically the Threat Detection and Response (TDR) AD Helper service; the endpoint may only be exposed when TDR/AD Helper is installed and running. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
WatchGuard Fireware AD Helper Component - Credentials Disclosure
nuclei·CVSS 7.5
CVE-2020-10532 [HIGH] WatchGuard Fireware AD Helper Component - Credentials Disclosure
WatchGuard Fireware AD Helper Component - Credentials Disclosure
WatchGuard Fireware Threat Detection and Response (TDR) service contains a credential-disclosure vulnerability in the AD Helper component that allows unauthenticated attackers to gain Active Directory credentials for a Windows domain in plaintext.
Template:
id: CVE-2020-10532
info:
name: WatchGuard Fireware AD Helper Component - Credentials Disclosure
author: gy741
severity: critical
description: WatchGuard Fireware Threat Detection and Response (TDR) service contains a credential-disclosure vulnerability in the AD Helper component that allows unauthenticated attackers to gain Active Directory credentials for a Windows domain in plaintext.
impact: |
Remote attackers can retrieve cleartext passwords, leading to potential a
No writeups or analysis indexed.
https://www.redteam-pentesting.de/en/advisories/rt-sa-2020-001/-credential-disclosure-in-watchguard-fireware-ad-helper-componenthttps://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.htmlhttps://www.redteam-pentesting.de/en/advisories/rt-sa-2020-001/-credential-disclosure-in-watchguard-fireware-ad-helper-componenthttps://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/services/tdr/tdr_ad_helper_c.html
2020-03-12
Published