218 lines
No EOL
8.9 KiB
Text
218 lines
No EOL
8.9 KiB
Text
=====================================================================
|
|
BEGIN Foofus.net Security Advisory: foofus-20120817 BEGIN
|
|
=====================================================================
|
|
Title: IOServer "Root Directory" Trailing Backslash Web Server Vuln
|
|
Allows: Arbitrary File Access, Directory Listing, Directory Traversal
|
|
CVSS Base / Temporal / Overall Scores: 7.8 / 6.4 / 6.4
|
|
Advisory Version: 2 (first publicly released version is 2)
|
|
Advisory Release Date: 2012-08-17
|
|
Advisory Last Updated: 2012-08-17
|
|
Vendor: IOServer Pty Ltd. http://www.ioserver.com/
|
|
Affected Product: IOServer 1.0.18.0 (and earlier?)
|
|
Issue Status: fixed version and workarounds available
|
|
Link: http://www.foofus.net/?page_id=616
|
|
=====================================================================
|
|
|
|
1. Summary
|
|
== =======
|
|
|
|
IOServer is a piece of industrial control software that runs on Windows.
|
|
It contains a built-in web server to support the "XML Server" feature.
|
|
This web server can be abused to download any file on the file system
|
|
without authentication, if the "Root Directory" setting does not contain
|
|
a trailing backslash. Note that a sample configuration provided with the
|
|
product exhibits a vulnerable configuration.
|
|
|
|
2. Description
|
|
== ===========
|
|
|
|
The vendor's web site describes IOServer thusly:
|
|
|
|
"OPC (OLE for Process Control) Server for Windows NT 4.0 / 95 / 98 /
|
|
ME / 2000 / 2003 / XP / 2008 / 7. Interface to multiple protocols
|
|
through a single OPC Server. This software allows OPC clients such as
|
|
HMI (Human Machine Interface) and SCADA (Supervisory Control and Data
|
|
Acquisition) systems to exchange plant floor data with PLC (Programmable
|
|
Logic Controllers)."
|
|
|
|
If the "XML Server" feature is turned on (apparently by configuring a
|
|
valid "Root Directory" on the "XML Server" tab), the integrated web
|
|
server listens on the configured port (81 by default). If the "Root
|
|
Directory" configuration value does not contain a trailing backslash,
|
|
then these issues exist.
|
|
|
|
A directory traversal vulnerability exists such that the web server can
|
|
be tricked to serve up any file on the server, outside of the configured
|
|
"Root Directory". On Windows, one common thing to do with an issue like
|
|
this is to download the backup copy of the SAM, in order to retrieve
|
|
password hashes and mount an offline attack on them. Any other
|
|
potentially sensitive file on the server can be accessed this way as
|
|
well, if the attacker knows the path to it.
|
|
|
|
Note that directory traversal is only needed if you want to break out of
|
|
the "Root Directory". The web server will serve up files inside the
|
|
"Root Directory" just by asking it for them. This may or may not be
|
|
considered a vulnerability, depending on the expectations of the
|
|
administrator.
|
|
|
|
Also, the web server allows directory listings in some cases, whether
|
|
inside or outside the "Root Directory". Again, this may or may not be
|
|
considered a vulnerability depending on expectations.
|
|
|
|
Note also that the "XML Server Settings" tab contains fields for a "Read
|
|
Password" and "Write Password", which are apparently intended to only
|
|
restrict access to the devices via the XML web interface (they are not
|
|
intended to restrict access to other content served by the web server).
|
|
By default, they are set to blank. But due to their intended use of
|
|
resticting device access, they do nothing to stop access to the file
|
|
system as described here even if they are set to some value.
|
|
|
|
3. Proof of Concept / Steps to Reproduce
|
|
== ===== == ======= = ===== == =========
|
|
|
|
Install the software and use the sample Modbus Web Server configuration
|
|
from http://www.ioserver.com/mbtcp.io to get it working. This sample
|
|
configuration uses the "Root Directory" value of "C:\Program Files
|
|
\IOServer\Docs" (note the lack of a trailing backslash). This directory
|
|
does not exist unless you install the documentation package (isodoc.exe,
|
|
available from the vendor web site). You can get to a vulnerable
|
|
configuration if you leave the "Root Directory" alone and install the
|
|
documentation package, or just modify the "Root "Directory" value to
|
|
something valid (but lacking a trailing backslash) like "C:\Program
|
|
Files\IOServer". Note that the software or server may need to be
|
|
restarted, then you will see a web server listening on the configured
|
|
port (81 by default).
|
|
|
|
Note that more recent versions of the software default to "C:\IOServer"
|
|
rather than "C:\Program Files\IOServer". This does not affect the issues
|
|
discussed here.
|
|
|
|
To request files within the "Root Directory", just ask for them with a
|
|
browser or command-line tool like wget:
|
|
|
|
wget http://target-server:81/modbus.dll
|
|
|
|
To get a directory listing, just ask:
|
|
|
|
wget http://target-server:81/
|
|
|
|
To request files outside of the "Root Directory", use a standard
|
|
directory traversal trick with a client or browser that supports it.
|
|
Note that IE probably will not allow this type of malfeasance:
|
|
|
|
wget http://target-server:81/.../.../.../windows/repair/sam
|
|
|
|
To get a directory listing outside of the "Root Directory", ask for it
|
|
with the directory traversal trick:
|
|
|
|
wget http://target-server:81/.../.../.../windows/
|
|
|
|
Note that it is only this directory traversal issue that was fixed in
|
|
version 1.0.19.0. Accessing files and directory listings inside the
|
|
"Root Directory" is apparently intended operation.
|
|
|
|
4. Impact
|
|
== ======
|
|
|
|
Unexpected arbitrary access to the file system can lead to the
|
|
disclosure of sensitive information. Worst case, disclosure of the
|
|
system's password hashes can lead to compromise of the passwords, and
|
|
therefore, of the server.
|
|
|
|
5. CVSS Scoring
|
|
== ==== =======
|
|
|
|
Using http://nvd.nist.gov/cvss.cfm?calculator&version=2
|
|
|
|
CVSS Base Score: 7.8
|
|
Impact Subscore: 6.9
|
|
Exploitability Subscore: 10
|
|
CVSS Temporal Score: 6.4
|
|
Overall CVSS Score: 6.4
|
|
|
|
Access Vector: Network
|
|
Access Complexity: Low
|
|
Authentication: None
|
|
Confidentiality Impact: Complete
|
|
Integrity Impact: None
|
|
Availability Impact: None
|
|
Exploitability: Functional exploit exists
|
|
Remediation Level: Official fix
|
|
Report Confidence: Confirmed
|
|
|
|
Note that the CVSS calculation was based only on the directory traversal
|
|
issue, since it is the most obvious and serious vulnerability addressed
|
|
here.
|
|
|
|
6. Affected Products
|
|
== ======== ========
|
|
|
|
IOServer 1.0.18.0 (earlier versions are also assumed vulnerable)
|
|
|
|
This was downloaded from http://www.ioserver.com/driver18.exe, which was
|
|
the current version as of 23 April 2012. Older versions were not
|
|
available, but are assumed vulnerable.
|
|
|
|
(you can check your version in the IOServer GUI using Help, About
|
|
IOServer)
|
|
|
|
7. Workarounds / Solutions
|
|
== =========== = =========
|
|
|
|
Ensure that the "Root Directory" value has a trailing backslash. This
|
|
eliminates most of the issues, although you can still get a directory
|
|
listing of the "Root Directory" itself (but not subdirs) even with this
|
|
in place.
|
|
|
|
Of course, limit access to the web server port to only trusted
|
|
hosts/networks. Even a fixed version should probably not be exposed to
|
|
the Internet or other untrusted networks.
|
|
|
|
The directory traversal issue was fixed in version 1.0.19.0
|
|
(http://www.ioserver.com/driver19.exe), released on 2012-06-20. However,
|
|
arbitrary file access and directory listings inside the "Root Directory"
|
|
and its subdirs are still possible in this version, unless the trailing
|
|
backslash is in place. Note that even with the trailing backslash,
|
|
directory listing of the "Root Directory" itself is still possible.
|
|
|
|
It is recommended that all three of the above actions (use the trailing
|
|
backslash, limit access to trusted networks/hosts only, and upgrade to
|
|
1.0.19.0 or later) be taken in order to secure this web server as much
|
|
as possible.
|
|
|
|
8. Timeline
|
|
== ========
|
|
|
|
2012-04-23: First vendor contact
|
|
2012-04-23: Vendor sends proposed fix (that was fast!)
|
|
2012-04-27: Proposed fix found incomplete, feedback to vendor
|
|
2012-05-04: Vendor sends second proposed fix
|
|
2012-05-17: Verified that second proposed fix resolves all known
|
|
directory traversal issues
|
|
2012-05-17: Vendor informs that directory listing and arbitrary file
|
|
access issues inside the Root Directory are intended functionality
|
|
2012-05-18: This issue put on the back burner due to urgent project; I
|
|
then completely forget about it (oops, my bad)
|
|
2012-06-20: Vendor releases fixed version (1.0.19.0, aka "driver19.exe")
|
|
2012-08-08: I remember about this; recheck all information and retest
|
|
current version 1.0.19.0; edits to advisory; contact vendor about public
|
|
release date
|
|
2012-08-17: Public release
|
|
|
|
9. Credit
|
|
== ======
|
|
|
|
hinge, hinge () foofus net
|
|
|
|
Well, actually, this vulnerability was found by Nessus, plugin ID 10297
|
|
(which looks for generic web server directory traversal issues, not
|
|
specific to IOServer of course). All I did was see it in the scan
|
|
results, verify it, reproduce it for testing, report it to the vendor
|
|
and write this advisory.
|
|
|
|
Thanks to my friends at foofus.net, and to IOServer for being very
|
|
responsive and open.
|
|
|
|
=====================================================================
|
|
END Foofus.net Security Advisory: foofus-20120817 END
|
|
===================================================================== |