id: emcecom-default-login

info:
  name: Dell EMC ECOM - Default Login
  author: Techryptic (@Tech)
  severity: high
  description: Dell EMC ECOM default login information "(admin:#1Password)" was discovered.
  remediation: To resolve this issue, perform a "remsys" and "addsys" with no other operations occurring (reference the appropriate SMI-S provider documentation) and specify the new password when re-adding the array. If there are issues performing the "addsys" operation, it is recommended to restart the management server on each SP.
  reference:
    - https://www.dell.com/support/kbdoc/en-za/000171270/vipr-controller-operation-denied-by-clariion-array-you-are-not-privileged-to-perform-the-requested-operation
  classification:
    cwe-id: CWE-798
  metadata:
    max-request: 1
  tags: dell,emc,ecom,default-login

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}

    payloads:
      username:
        - 'admin'
      password:
        - '#1Password'
    attack: pitchfork

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Set-Cookie: ECOMSecurity"
        part: header

      - type: word
        words:
          - "Welcome to ECOM"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100e9c2f8e6708a9da7937215196534a4c0503950da7b1756b81c9c9ffec704b8df022008b8a2b0e227eb22a0fe60c1c1be84a0aa77e2f9c1860e7dd6ddc2eefd0001a5:922c64590222798bb761d5b6d8e72950