**Introduction**
MajorDoMo, a beacon in Russian home automation and particularly favored by
Raspberry Pi aficionados, has been a trusted name for over a decade. With over
380 stars on its official GitHub repository at the time of writing
(https://github.com/sergejey/majordomo), its popularity is evident. However,
lurking within its `thumb.php` module is a severe unauthenticated Remote Code
Execution (RCE) vulnerability before 0662e5e.
NOTE: this is unrelated to the Majordomo mailing-list manager.
**Disclosure Timeline:**
- October 28, 2023: Initial discovery of the vulnerability (CVE-2023-50917).
- October 29, 2023: Contacted MajorDoMo team detailing the vulnerability.
- November 6, 2023: After no response from MajorDoMo's team for over a week,
submitted a CVE request to the appropriate CNA.
- November 14, 2023: New attempt to contact the MajorDoMo team. Received a
response from the team within a few hours. The patch has been applied.
- December 15, 2023: Public disclosure of CVE-2023-50917.
**Technical Background: The Vulnerable Code**
The script `/modules/thumb/thumb.php` is primarily designed for thumbnail
generation in MajorDoMo. It serves to facilitate the creation of thumbnails
from various media sources. But within this benign purpose lies a significant
vulnerability:
**Key Code Snippets and Analysis:**
1. **URL Decoding:**
PHP code: $url = base64_decode($url);
The script takes a base64 encoded `url` parameter and decodes it. This decoding
process is pivotal, as it allows attackers to obfuscate their payloads,
skirting around simple checks.
2. **Pattern Checks:**
PHP code: if (preg_match('/^rtsp:/is', $url) || preg_match('/\/dev/', $url)) {
... }
The script then checks if the decoded `url` adheres to specific patterns
(`rtsp:` or `/dev`). This is a rudimentary check to decide whether to process
the URL. With the help of base64 encoding, it becomes trivial for attackers to
bypass this verification.
3. **Direct Command Construction:**
PHP code: if ($_GET['transport']) { $stream_options = '-rtsp_transport ' .
$_GET['transport'] . ' ' . $stream_options; }
Here lies the crux of the vulnerability. The `transport` parameter is taken
directly and embedded within a system command without adequate sanitization.
This glaring oversight allows for arbitrary command injections. By crafting the
`transport` parameter, an attacker can introduce and execute arbitrary
commands. The subsequent command is executed via the `exec` function, which
poses a significant security risk.
**The Core Vulnerability**
The vulnerability's essence is the unchecked and unsanitized user input (from
the `transport` parameter) that gets directly incorporated into a system
command. This allows attackers to run arbitrary commands on the server,
potentially taking full control of the MajorDoMo instance.
**Exploitation Avenues:**
1. **Bypassing URL Validation:**
The script's initial validation checks for patterns such as `rtsp:` or `/dev`.
By using base64 encoded strings like `cnRzcDovL2EK` (decoding to `rtsp://a`),
these checks can be easily bypassed.
2. **Command Injection via the `transport` Parameter:**
The `transport` parameter is used directly within a system command. With no
sanitization in place, this can be exploited for command injections, leading to
RCE. For instance, the command `||echo; echo $(command_here)` can be used to
break out of the intended command and execute any arbitrary command.
**Potential Impact**
The severity of this RCE vulnerability is high. Given MajorDoMo's integral role
in home automation, successful exploitation can result in an attacker
compromising physical security systems, gaining access to surveillance cameras,
or even taking control of other connected IoT devices.
**Recommendations for Mitigation**
- Thorough Input Validation: It is essential to rigorously validate all inputs.
This can prevent malicious payloads from being processed.
- Sanitize Before Execution: Inputs should be sanitized before being
incorporated into any system commands.
- Limit Direct Command Execution: Prefer using built-in PHP functions or secure
APIs over direct system command execution.
**Conclusion**
This vulnerability underscores the importance of thorough code reviews and
robust input validation. Even established software projects like MajorDoMo are
not immune to critical vulnerabilities. The discovery serves as a reminder of
the ever-present need for diligence and a proactive approach to security in all
software development stages.
Please refer to https://nvd.nist.gov/vuln/detail/CVE-2023-50917
Valentin Lobstein
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
