NTLM Hash Exposure via SMB Relay in TeamDavid Webbox

Executive Summary

TeamDavid's Webbox has a flaw in its email, fax, SMS, and similar functionality where it accepts an @@INCLUDE command with UNC paths (e.g., \Server\Share). The server processes these paths without validation, leading to outbound connections to attacker-controlled SMB servers. This allows attackers to trigger authentication attempts to arbitrary SMB endpoints, potentially exposing NTLM authentication details like hashes. Exploitation is possible without authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor outbound SMB connections (port 445) from TeamDavid's Webbox. Check logs for UNC path processing attempts or unexpected authentication requests to external servers. Use network sniffing tools like Wireshark to capture SMB traffic initiated by the application.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can expose NTLM authentication credentials (such as hashes) to attackers. If outbound SMB connections are allowed, attackers may perform SMB relay attacks or steal credentials. Unauthenticated attackers can exploit this to trigger server connections to malicious SMB servers, compromising sensitive authentication data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could expose NTLM authentication information, which may lead to credential theft. For GDPR, unauthorized access to personal data via credential theft could violate data protection principles. For HIPAA, compromised credentials might enable unauthorized access to protected health information, risking compliance with security requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update TeamDavid to the latest Rollout version beyond 524. Block outbound SMB traffic (port 445) at the firewall. Disable UNC path processing in TeamDavid's configuration. Monitor for unauthorized authentication attempts and restrict SMB relay capabilities.

Useful 0 Not Useful 0