imm-default-login: Integrated Management Module - Default Login

id: imm-default-login

info:
  name: Integrated Management Module - Default Login
  author: jpg0mez
  severity: high
  description: |
    Integrated Management Module default login credentials were discovered.
  reference:
    - https://pubs.lenovo.com/x3650-m4/t_logging_web_interface
    - https://www.ibm.com/docs/en/tcs-service?topic=oip-logging-imm-web-interface
  classification:
    cwe-id: CWE-798
    cpe: cpe:2.3:h:ibm:integrated_management_module:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"ibmdojo"
    fofa-query: "integrated management module"
    product: integrated_management_module
    vendor: ibm
  tags: imm,ibm,default-login,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/data/login"
    body: "user=USERID&password=PASSW0RD"

    redirects: true
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<authResult>0</authResult>"
          - 'authResult":"0'
        condition: or

      - type: word
        words:
          - "index-console.php"
          - "home.php"
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402204d6176119d41a6754260c44a11f4d9502e30faa06b43615e8403460aec02ba1302204e35aca456c3a9899181ee3b103f4b2ed1aa9506bcd22d0721f8785dab6045f7:922c64590222798bb761d5b6d8e72950