{"id":13181,"date":"2018-08-23T14:19:08","date_gmt":"2018-08-23T22:19:08","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/08\/23\/news-6948\/"},"modified":"2018-08-23T14:19:08","modified_gmt":"2018-08-23T22:19:08","slug":"news-6948","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/08\/23\/news-6948\/","title":{"rendered":"SSD Advisory \u2013 CloudByte ElastiStor OS Unauthenticated Remote Code Execution"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Thu, 23 Aug 2018 10:57:33 +0000<\/strong><\/p>\n

\n
\n

Vulnerabilities Summary<\/strong><\/p>\n

The following advisory describes two vulnerabilities found in ElastiCenter,
ElastiStor’s management console, File Injection that leads to unauthenticated remote code execution.<\/p>\n

ElastiCenter is the centralized management tool that you use to configure, monitor, manage, and deploy the services provided by CloudByte ElastiStor.
ElastiCenter lets you:<\/p>\n

    \n
  • Use the Graphical User Interface to manage the storage environment<\/li>\n
  • Generate statistical and configuration reports to help troubleshoot<\/li>\n
  • Delegate administration tasks<\/li>\n
  • Track events<\/li>\n
  • Globally control various settings<\/li>\n<\/ul>\n

    CVE<\/strong>
    CVE-2018-15675<\/p>\n

    Credit<\/strong>
    An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
    <\/span>
    Affected systems<\/strong>
    CloudByte ElastiStor OS 2.1.0.1269<\/p>\n

    Vendor Response<\/strong>
    After several attempts to email CloudByte, we couldn’t get any response from the vendor.<\/p>\n

    Vulnerability Details<\/strong>
    ElastiCenter is vulnerable to unrestricted File Upload vulnerability found in \u201cLicense\u201d section and also in the image handling servlet. The purpose of the “License” is for administrative users to update the elasticenter license. Image handling servlet is responsible for image upload. Both sections have an upload functionality which could be accessed by unauthenticated remote attackers. Both sections allow to upload any file in any arbitrary location on the elasticenter host OS.<\/p>\n

    By uploading a JSP file to the server, an attacker can execute it in the server context (in this case “root” user).<\/p>\n

    PoC<\/strong>
    The first poc Injects JSP web-shell through the image handling servlet:<\/p>\n

    \t\t<\/p>\n

    \n
    <\/span> \t\t\t<\/p>\n
    <\/span><\/p>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n
    <\/div>\n