SSD Advisory – TrustPort Management Unauthenticated Remote Code Execution

Credit to Author: SSD / Noam Rathaus| Date: Wed, 25 Apr 2018 08:36:14 +0000

Vulnerability Summary Multiple vulnerabilities in TrustPort’s management product allow remote unauthenticated attackers to cause the product to execute arbitrary code. TrustPort Management “offers you an effective and practical way to install centrally, configure and update antivirus software in your network and it enables mass administration of TrustPort products. Central administration from TrustPort brings you simple … Continue reading SSD Advisory – TrustPort Management Unauthenticated Remote Code Execution

Read more

SSD Advisory – Vigor ACS Unsafe Flex AMF Java Object Deserialization

Credit to Author: SSD / Noam Rathaus| Date: Wed, 18 Apr 2018 05:24:56 +0000

Vulnerability Summary A vulnerability in Vigor ACS allows unauthenticated users to cause the product to execute arbitrary code. VigorACS 2 “is a powerful centralized management software for Vigor Routers and VigorAPs, it is an integrated solution for configuring, monitoring, and maintenance of multiple Vigor devices from a single portal. VigorACS 2 is based on TR-069 … Continue reading SSD Advisory – Vigor ACS Unsafe Flex AMF Java Object Deserialization

Read more

SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities

Credit to Author: SSD / Maor Schwartz| Date: Wed, 03 Jan 2018 06:33:51 +0000

Vulnerabilities Summary The following advisory describes four (4) vulnerabilities found in Livebox Fibra router version AR_LBFIBRA_sp-00.03.04.112S. It is possible to chain the vulnerabilities into remote code execution. The “Livebox Fibra” router is “manufactured by Arcadyan for Orange and Jazztel in Spain” The vulnerabilities found in Arcadyan routers are: Unauthenticated configuration information leak Hard-coded credentials Memory … Continue reading SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities

Read more

SSD安全公告-vBulletin routestring未经验证的远程代码执行

Credit to Author: SSD / Maor Schwartz| Date: Sun, 31 Dec 2017 06:31:17 +0000

漏洞概要 以下安全公告描述了在vBulletin5中发现的一个未经身份验证的文件包含漏洞,成功利用该漏洞可造成远程代码执行。 vBulletin也称为vB,由vBulletin Solutions公司基于PHP和MySQL开发,广泛用于搭建网络论坛。 vBulletin为许多网络大型的社交网站提供技术支持,数量超过10万,其中包括财富500强和Alexa Top 1M公司的网站和论坛。根据最新的W3Techs1统计,vBulletin 4拥有超过55%的vBulletin市场份额,而vBulletin 3和vBulletin 5则占剩下的45%。 漏洞提交者 一位独立的安全研究人员向 Beyond Security 的 SSD 报告了该漏洞 厂商响应 自2017年11月21日起,我们多次尝试联系vBulletin,但是暂时没有得到回复。目前,漏洞暂时还没有解决方案。 漏洞详细信息 vBulletin存在一个漏洞,导致远程攻击者可以从vBulletin服务器中包含任意文件并执行PHP代码。 未经身份验证的用户可以向/index.php发送GET请求,然后使用参数routestring =触发文件包含漏洞。 该请求允许攻击者向安装在Windows操作系统上的Vbulletin服务器创建精心制作的请求,并在Web服务器上包含任意文件。 /index.php 部分代码: [crayon-5a496258a4faa266544584/] 让我们仔细看看vB5_Frontend_Application :: init — /includes/vb5/frontend/application.php部分代码: [crayon-5a496258a4fb1671370675/] 我们可以看到setRoutes()被调用 /includes/vb5/frontend/routing.php部分代码: [crayon-5a496258a4fb4744772041/] 因此,如果我们的字符串不以’.gif,‘.png’,’.jpg’,’.css’或者‘.js’结尾并且不包含’/’字符,vBulletin会从vB5_Frontend_Controller_Relay中调用legacy() /includes/vb5/frontend/controller/relay.php部分代码: [crayon-5a496258a4fbd144806678/] 如果我们从Api_Interface_Collapsed类中检查relay() /include/api/interface/collapsed.php部分代码: [crayon-5a496258a4fbf779937258/] 正如我们所看到的,攻击者无法在$文件中使用“/”,所以不能在Linux上更改当前目录。但是对于Windows而言,可以使用’’作为路径分隔符,通过PHP包含任意所需的文件(也可以使用’ .. ’技巧)。 如果我们想包含扩展名为’.gif’,’.png’,’.jpg’,’.css’或’.js’这样的文件,需要绕过setRoutes()方法里面的过滤,绕过很容易,可以通过添加点(’.’)或空格(’%20’)到文件名来绕过。 完整的漏洞证明 我们可以通过发送下面的GET请求来检查服务器是否有漏洞: /index.php?routestring=.\ 如果回显是: 那么服务器存在漏洞 如果我们想要在服务器上的任何文件中注入一个php代码,我们可以使用access.log例如: /?LogINJ_START=< ?php phpinfo();?>LogINJ_END … Continue reading SSD安全公告-vBulletin routestring未经验证的远程代码执行

Read more

SSD Advisory – Ichano AtHome IP Cameras Multiple Vulnerabilities

Credit to Author: SSD / Maor Schwartz| Date: Tue, 19 Dec 2017 07:31:42 +0000

Vulnerabilities Summary The following advisory describes three (3) vulnerabilities found in Ichano IP Cameras. AtHome Camera is “a remote video surveillance app which turns your personal computer, smart TV/set-top box, smart phone, and tablet into a professional video monitoring system in a minute.” The vulnerabilities found are: Hard-coded username and password – telnet Hard-coded username … Continue reading SSD Advisory – Ichano AtHome IP Cameras Multiple Vulnerabilities

Read more

SSD安全公告-QNAP QTS未经认证的远程代码执行漏洞

Credit to Author: SSD / Maor Schwartz| Date: Mon, 18 Dec 2017 08:04:57 +0000

漏洞概要 以下安全公告描述了QNAP QTS的一个内存损坏漏洞,成功利用该漏洞会造成QNAP QTS 4.3.x和4.2.x版本(包括4.3.3.0299)未经验证的远程代码执行。 威联通科技(QNAP Systems, Inc)专注于为企业,中小型企业,SOHO和家庭用户提供文件共享,虚拟化,存储管理和监控应用的网络解决方案。 QNAP QTS是标准的智能NAS操作系统,支持所有文件共享,存储,备份,虚拟化和多媒体QNAP设备。 漏洞提交者 一位安全研究者TRUEL IT(@truel_it)向 Beyond Security 的 SSD 报告了该漏洞 厂商响应 QNAP已被告知该漏洞,并回复:“我们已经确认这个问题与最近的另一份报告相同,并已经发布了CVE-2017-17033。 尽管这份报告是重复的,但我们仍然会在即将发布的安全公告中对两位报送者表示感谢。 同时,在即将发布的QTS 4.2.6和4.3.3版本中将修复该漏洞。” CVE: CVE-2017-17033 漏洞详细信息 由于缺乏适当的边界检查,可以通过特制的HTTP请求溢出堆栈缓冲区并劫持控制流以实现任意代码执行。 authLogin.cgi负责显示来自Web界面的系统信息,并且包含在用户提供的输入进行无限制的sprintf调用中。 authLogin.cgi二进制文件,位于QTS文件系统的/home/httpd/cgibin/目录中,可通过请求端点/cgi-bin/sysinfoReq.cgi进行访问。 该二进制文件是QTS的一部分,并充当几个功能的包装器。 易受攻击的调用位于handle_qpkg()(0x1C680)函数中,该函数由handle_sysInfoReq()(0x1D398)调用,以显示当前系统信息(型号名称,固件版本,ecc)。 [crayon-5a383ee2c6288334669193/] 通过向sysinfoReq.cgi发送一个HTTP请求,handle_sysInfoReq()(0x1D398)函数被触发,并且根据提供的参数,可以处理不同的进程步骤。 [crayon-5a383ee2c628f233726429/] 如果提供了qpkg HTTP参数,则调用handle_qpkg()(0x1C680)函数。 [crayon-5a383ee2c6292299287155/] handle_qpkg()函数不会验证用户提供的lang HTTP参数值。 正如上面的代码路径所示,未经身份验证的攻击者可以为所述参数提供任意大小的值,然后通过sprintf()函数调用将其连接到静态大小(堆栈)缓冲区上的现有字符串。 漏洞证明 通过发送以下POST请求,我们将使堆栈溢出并用XXXX覆盖qpkg_all_info缓冲区的值,并用YYYY覆盖handle_qpkg()参数返回地址的值,从而造成崩溃。 [crayon-5a383ee2c6295336007302/] 产生以下崩溃: [crayon-5a383ee2c629a114636077/]

Read more

SSD Advisory – vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion

Credit to Author: SSD / Maor Schwartz| Date: Wed, 13 Dec 2017 10:36:20 +0000

Vulnerability Summary The following advisory describes a unauthenticated deserialization vulnerability that leads to arbitrary delete files and, under certain circumstances, code execution found in vBulletin version 5. vBulletin, also known as vB, is “a widespread proprietary Internet forum software package developed by vBulletin Solutions, Inc., based on PHP and MySQL database server. vBulletin powers many … Continue reading SSD Advisory – vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion

Read more

SSD Advisory – vBulletin routestring Unauthenticated Remote Code Execution

Credit to Author: SSD / Maor Schwartz| Date: Wed, 13 Dec 2017 10:11:35 +0000

Vulnerability Summary The following advisory describes a unauthenticated file inclusion vulnerability that leads to remote code execution found in vBulletin version 5. vBulletin, also known as vB, is a widespread proprietary Internet forum software package developed by vBulletin Solutions, Inc., based on PHP and MySQL database server. vBulletin powers many of the largest social sites … Continue reading SSD Advisory – vBulletin routestring Unauthenticated Remote Code Execution

Read more

SSD Advisory – QNAP QTS Unauthenticated Remote Code Execution

Credit to Author: SSD / Maor Schwartz| Date: Mon, 11 Dec 2017 10:16:42 +0000

Vulnerability Summary The following advisory describes a memory corruption vulnerability that can lead to an unauthenticated remote code execution in QNAP QTS versions 4.3.x and 4.2.x, including the 4.3.3.0299. QNAP Systems, Inc. is “a Taiwanese corporation that specializes in providing networked solutions for file sharing, virtualization, storage management and surveillance applications to address corporate, SMB, … Continue reading SSD Advisory – QNAP QTS Unauthenticated Remote Code Execution

Read more

SSD Advisory – Dasan Unauthenticated Remote Code Execution

Credit to Author: SSD / Maor Schwartz| Date: Wed, 06 Dec 2017 06:42:29 +0000

Vulnerability Summary The following advisory describes a buffer overflow that leads to remote code execution found in Dasan Networks GPON ONT WiFi Router H640X versions 12.02-01121 / 2.77p1-1124 / 3.03p2-1146 Dasan Networks GPON ONT WiFi Router “is indoor type ONT dedicated for FTTH (Fibre to the Home) or FTTP (Fiber to the Premises) deployments. That … Continue reading SSD Advisory – Dasan Unauthenticated Remote Code Execution

Read more

SSD Advisory – Monstra CMS RCE

Credit to Author: SSD / Noam Rathaus| Date: Wed, 06 Dec 2017 06:35:44 +0000

Vulnerabilities Summary The following advisory describes a vulnerability found in Monstra CMS. Monstra is “a modern and lightweight Content Management System. It is Easy to install, upgrade and use.” The vulnerability found is a remote code execution vulnerability through an arbitrary file upload mechanism. Credit An independent security researcher, Ishaq Mohammed, has reported this vulnerability … Continue reading SSD Advisory – Monstra CMS RCE

Read more