143 lines
No EOL
4.6 KiB
Text
143 lines
No EOL
4.6 KiB
Text
SEC Consult Vulnerability Lab Security Advisory < 20140228-0 >
|
|
=======================================================================
|
|
title: Privilege escalation vulnerability
|
|
product: MICROSENS Profi Line Modular Industrial Switch Web
|
|
Manager (MS652119PM)
|
|
vulnerable version: Firmware version 10.3.1
|
|
fixed version: Firmware version 10.3.2
|
|
impact: High
|
|
homepage: http://www.microsens.com/profi-line-modular/
|
|
found: 2013-08-21
|
|
by: Christian Kudera, Stefan Riegler
|
|
SEC Consult Vulnerability Lab
|
|
https://www.sec-consult.com
|
|
=======================================================================
|
|
|
|
Vendor description:
|
|
-------------------
|
|
"The new Profi Line Modular switches, from MICROSENS, offer maximum
|
|
performance and flexibility in smallest spaces. Robust, modular, expandable
|
|
and designed for greatest reliability and shortest recovery times, the Profi
|
|
Line Modular series has become the first-choice solution for Industrial
|
|
Ethernet."
|
|
|
|
Source: http://www.microsens.com/profi-line-modular/
|
|
|
|
Business recommendation:
|
|
------------------------
|
|
SEC Consult has identified a privilege escalation in the MICROSENS Web Manager
|
|
in the course of a very limited infrastructure audit. Very little time was
|
|
spent on the affected product.
|
|
|
|
The Web Manager can be used with read only permission to check the
|
|
configuration on the device (e.g. VLANs, Port status). Additionally the Web
|
|
Manager can be used with read and write permission to configure the device.
|
|
|
|
Using the identified vulnerability a low privileged user having read only
|
|
permission can elevate his privileges to contain read and write permissions.
|
|
|
|
Vulnerability overview/description:
|
|
-----------------------------------
|
|
The Web Manager contains a login form to authenticate a user. The Web Manager
|
|
offers different levels of privilege (e.g. read only permission, read and
|
|
write permission, debugging permission).
|
|
|
|
The login attempt is checked through a CGI binary, but the response of the
|
|
binary is validated at the client side via JavaScript. An attacker can
|
|
intercept and modify the response of the binary, thus achieving authentication
|
|
and the desired level of authorization. No further validation is performed by
|
|
the Web Manager.
|
|
|
|
Proof of concept:
|
|
-----------------
|
|
The login generates the following request to the server:
|
|
interf=WEB&bidx=1&unam=root&pawo=&plev=0
|
|
|
|
This request triggers a CGI binary, which validates the login attempt and
|
|
returns the following response:
|
|
<xml>
|
|
<!-- last change: 17.04.2012 -->
|
|
<!-- returned at uptime of 141056 seconds -->
|
|
<header>
|
|
<version>V0.1</version>
|
|
<user>XYZ</user>
|
|
<date>2012/05/29 17:28:00</date>
|
|
</header>
|
|
|
|
<response>
|
|
<par name="cmd" type="STRING" >
|
|
<val>login</val>
|
|
</par>
|
|
<par name="result" type="UNSIGNED" >
|
|
<val>255</val>
|
|
</par>
|
|
<par name="lunam" type="STRING" >
|
|
<val>root</val>
|
|
</par>
|
|
<par name="liid" type="STRING" >
|
|
<val>0</val>
|
|
</par>
|
|
<par name="rhost" type="STRING" >
|
|
<val>192.10.100.136</val>
|
|
</par>
|
|
<par name="a_s_b" type="STRING" >
|
|
<val>0_0_1</val>
|
|
</par>
|
|
</response>
|
|
</xml>
|
|
|
|
The parameter "result" informs the client about the properness of the provided
|
|
login credentials.
|
|
The parameter can correspond to the following values:
|
|
255 login failed
|
|
1 login with read only permission
|
|
2 login with read and write permission
|
|
3 login with debugging permission
|
|
|
|
For example, if the value of the parameter "result" is changed to 3, the user
|
|
gets logged in with debugging permissions.
|
|
|
|
Vendor contact timeline:
|
|
------------------------
|
|
2013-09-10: Contacting vendor
|
|
2013-09-11: Sending advisory and proof of concept exploit via encrypted
|
|
channel.
|
|
2013-09-11: Vendor acknowledges receipt of advisory.
|
|
2013-10-18: Vendor responds and wants to release update on 2013-10-31.
|
|
2013-10-31: MICROSENS releases fixed version.
|
|
2014-02-07: Conference call: Clarifying pending questions regarding the fixed
|
|
version.
|
|
2014-02-28: SEC Consult releases coordinated security advisory.
|
|
|
|
Solution:
|
|
---------
|
|
Update to the most recent firmware version 10.3.2
|
|
|
|
Workaround:
|
|
-----------
|
|
All accounts with read only permissions should be disabled on the device.
|
|
|
|
Advisory URL:
|
|
-------------
|
|
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
SEC Consult Vulnerability Lab
|
|
|
|
SEC Consult
|
|
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius
|
|
|
|
Headquarter:
|
|
Mooslackengasse 17, 1190 Vienna, Austria
|
|
Phone: +43 1 8903043 0
|
|
Fax: +43 1 8903043 15
|
|
|
|
Mail: research at sec-consult dot com
|
|
Web: https://www.sec-consult.com
|
|
Blog: http://blog.sec-consult.com
|
|
Twitter: https://twitter.com/sec_consult
|
|
|
|
Interested in working with the experts of SEC Consult?
|
|
Write to career (at) sec-consult (dot) com [email concealed]
|
|
|
|
EOF Christian Kudera / @2014 |