id: dell-emc-ecom-default-login

info:
  name: Dell EMC ECOM Default Login
  author: Techryptic (@Tech)
  severity: high
  description: Dell EMC ECOM default login information "(admin:#1Password)" was discovered.
  remediation: To resolve this issue, perform a "remsys" and "addsys" with no other operations occurring (reference the appropriate SMI-S provider documentation) and specify the new password when re-adding the array. If there are issues performing the "addsys" operation, it is recommended to restart the management server on each SP.
  reference: https://www.dell.com/support/kbdoc/en-za/000171270/vipr-controller-operation-denied-by-clariion-array-you-are-not-privileged-to-perform-the-requested-operation
  tags: dell,emc,ecom,default-login
  classification:
    cwe-id: CWE-798

requests:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}

    payloads:
      username:
        - root
      password:
        - calvin
    attack: pitchfork

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Set-Cookie: ECOMSecurity"
        part: header

      - type: word
        words:
          - "Welcome to ECOM"

      - type: status
        status:
          - 200

# Enhanced by mp on 2022/03/03