m-privacy TightGate-Pro Code Execution / Insecure Permissions

`SEC Consult Vulnerability Lab Security Advisory < 20231122-0 >  
=======================================================================  
title: Multiple Vulnerabilities  
product: m-privacy TightGate-Pro  
vulnerable version: Rolling Release, servers with the following package  
versions are vulnerable:  
tightgatevnc < 4.1.2~1  
rsbac-policy-tgpro < 2.0.159  
mprivacy-tools < 2.0.406g  
fixed version: Servers with the following package versions and higher:  
mprivacy-tools_2.0.406g  
tightgatevnc_4.1.2~1  
rsbac-policy-tgpro_2.0.159  
CVE number: CVE-2023-47250, CVE-2023-47251  
impact: high  
homepage: https://www.m-privacy.de/en/tightgate-pro-safe-surfing/  
found: 2023-08-18  
by: Daniel Hirschberger (Office Bochum)  
Steven Kurka (Office Essen)  
Marco Schillinger (Office Nürnberg)  
SEC Consult Vulnerability Lab  
  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
https://www.sec-consult.com  
  
=======================================================================  
  
Vendor description:  
-------------------  
"TightGate-Pro is a ReCoB system. ReCoBS stands for Remote-Controlled Browser  
System, literally translated 'remote-controlled web browser'. TightGate-Pro  
physically separates the web browser execution environment from the workstation.  
The system thus shields the internal network from the Internet and reliably  
and preventively prevents attacks via the web browser. TightGate-Pro is the  
strongest dedicated ReCoBS, because only physical outsourcing on a hardened  
system permanently withstands attacks. Local virtualisations, sandboxing  
systems or micro-virtualisations do not offer effective protection.  
TightGate-Pro is used in public authorities, financial institutions, industrial  
companies and critical infrastructures – in short, everywhere where “safe  
surfing on the Internet” is indispensable at the workplace and internal  
infrastructures must be reliably protected. TightGate-Pro is BSI-certified  
according to EAL3+."  
  
Source: https://www.m-privacy.de/en/tightgate-pro-safe-surfing/  
  
  
Business recommendation:  
------------------------  
The vendor provides a patch which should be installed immediately.  
  
SEC Consult highly recommends to perform a thorough security review of the product  
conducted by security professionals to identify and resolve potential further  
security issues.  
  
  
Vulnerability overview/description:  
-----------------------------------  
1) Code Execution  
Execution of single commands and scripts is possible with the privileges of  
the current user. Code execution is possible with any file type on the  
server and no specific permissions need to be set for the utilized file.  
  
Vendor response (translated):  
"It is intended behavior to execute arbitrary bash scripts. It is not possible  
to execute arbitrary programs and libraries. There is no privilege escalation  
possible with this vulnerability."  
  
We can confirm that it was not possible to escalate privileges during our test.  
  
  
2) Access to all Desktops (CVE-2023-47250)  
Multiple users are connecting to the same TightGate-Pro server, resulting in  
one instance of the X11 window system. Due to insecure permissions of the  
X11 sockets it is possible for any user to open arbitrary windows on the  
desktop of other users for phishing attacks or installing a keylogger  
directly.  
  
Vendor response (translated):  
"We acknowledge this issue as a important vulnerability. A fix with full  
RSBAC-Jail-Separation and changed Linux-Filesystem permissions is currently  
available in the "Prestable" packages:  
- mprivacy-tools_2.0.406g  
- tightgatevnc_4.1.2~1  
- rsbac-policy-tgpro_2.0.159  
These can be applied by the admin user "update". The updates will be provided  
automatically as Hotfix around 2023-10-24."  
  
  
3) File Transfer by Abusing the Print function (CVE-2023-47251)  
TightGate-Pro allows printing PDF documents on the host system. Documents are  
transferred to the host, printed and deleted afterwards. An attacker is able  
to control the path of the transferred file and to prevent the automatic  
deletion of the file.  
  
Vendor response (translated):  
"This is not a severe finding but we already fixed it. The fixes are available  
in the packages:  
- mprivacy-tools_2.0.406g  
- tightgatevnc_4.1.2~1  
  
Now the .spool directly is always scanned for malicious data and the VNC- client  
does not transfer files which contain path symbols (e.g. ../)."  
  
  
4) Outdated Update Server  
Based on disclosed version numbers the update server is running outdated software  
with known vulnerabilities. The criticality of this issue depends on the  
exploitability of these issues.  
  
Vendor response (translated):  
"The old version of thttpd is already known. This is not seen as security-relevant.  
The access to the updateserver requires a previous registration of a customer-  
provided SSH key, which is only available to administrators on the TightGate-Pro  
instance. thttpd is isolated on the updateserver and can only *read* files.  
  
Even if an attacker can write malicious updatepackages, these are still secured  
by a cryptographic signature and would not be installed on TightGate-Pro instances.  
We will eventually replace thttpd with lighthttpd which is still supported."  
  
  
Proof of concept:  
-----------------  
1) Code Execution  
Code execution is possible using the context menu of any file in the VNC session  
of TightGate-Pro. Selecting "Öffnen mit" (Open with) in the context menu of any  
file and selecting the "Benutzerdefinierte Befehlszeile" (custom commandline)  
section of the menu allows to provide a custom shell command to be executed:  
  
[advisory_ce_open_with.png]  
[advisory_ce_custom_command.png]  
  
At this point there are two possible options:  
In case the selected file is a bash script typing `/bin/bash` as custom command  
will execute the script. For this PoC the following script has been used:  
  
```  
#!bin/bash  
echo poc >> /home/user/testuser/Desktop/test/PoC2.txt  
```  
  
In case any other file is selected a complete command can be used as well.  
A possible example is listed below:  
`/bin/bash -c "echo poc >> /home/user/testuser/Desktop/test/PoC2.txt"`  
  
According to vendor, arbitrary code execution is not possible as programs and  
libraries won't be executed.  
  
  
2) Access to all Desktops (CVE-2023-47250)  
A normal user without special permissions has read and write access to all X11  
sockets stored in the temp folder of the user TightGate-Pro, visible in the  
following screenshot:  
  
[advisory_desktop_access_x11_perms.png]  
  
This allows any user for example to open dialogue boxes on the desktop of the  
currently connected users as shown in the following screenshots. The command  
used is listed below.  
  
`/bin/bash -c 'for i in $(ls /home/tmpdir/tmp510/.X11-unix | cut -b 2-); do  
DISPLAY=unix:"$i".0 zenity --password --username & done;'`  
  
[advisory_desktop_access_gui_triggered.png]  
  
As it can be seen in the following screenshot any input to the dialogue boxes  
can be read by the attacker.  
  
[advisory_desktop_access_result.png]  
  
  
3) File Transfer by Abusing the Print function (CVE-2023-47251)  
File transfers can be triggered for PDF files which are stored in the  
`/home/user/.spool/<username>` directory. By setting a relative path as file  
name, the file can be stored in any user directory on the host system.  
In case the file name contains Unicode characters, deletion of the file is  
not executed after transfer and closing of the print prompt. To store a file  
on the user's desktop, the name `..\\..\\..\\..\\..\\Desktop\\Ỻeicar.pdf`  
can be used. The transfer can then be triggered by sending the  
signal `SIGUSR2` to the `Xtightgatevnc` process:  
  
```  
cp eicar.pdf '/home/user/.spool/<username>/..\\..\\..\\..\\..\\Desktop\\Ỻeicar.pdf'  
pkill -u $USER --signal SIGUSR2 Xtightgatevnc  
```  
  
In addition, this file transfer does not check if any malicious files are  
transferred to the host system. The following screenshot shows the warning of  
a malware scanner after an eicar testfile was transferred. It is therefore  
possible to circumvent the malware scanner of TightGate-Pro which only runs  
if the intended way of transfer, namely the TightGate-Schleuse, is used.  
  
[advisory_file_transfer_mal_file.png]  
  
  
4) Outdated Update Server  
Access to the update server is possible with the ssh key stored at  
`/etc/cu/id_ed25519` and ssh port forwarding. The ssh key is customized  
for each customer. Root access is needed to retrieve the key.  
The command used for the forwarding is listed below:  
  
```  
ssh -N -L 8000:localhost:85 [email protected] -i id_ed25519 -v  
```  
  
Afterwards access is possible at `http:127.0.0.1:8000`.  
The server headers return the version of the webserver:  
`thttpd/2.25b 29dec2003`  
  
[advisory_outdated_server.png]  
  
This version has in sum four known vulnerabilities (high and medium) listed:  
* CVE-2006-1078  
* CVE-2006-1079  
* CVE-2007-0664  
* CVE-2009-4491  
  
  
Vulnerable / tested versions:  
-----------------------------  
A TightGate-Pro server with the following package versions was used  
for testing:  
  
* tightgatevnc < 4.1.2~1  
* rsbac-policy-tgpro < 2.0.159  
* mprivacy-tools < 2.0.406g  
  
  
Vendor contact timeline:  
------------------------  
2023-10-11: Contacting vendor through [email protected] via GPG  
2023-10-13: CEO of m-privacy phones us and thanks us for the advisory,  
a developer will send us a written statement next week.  
2023-10-16: Received a written statement of their lead developer;  
the vulnerabilities #2 (Access to all Desktops) and  
#3 (File Transfer by Abusing the Print function) are  
confirmed and a fix is available  
#1 is seen as a feature not a bug, #4 is claimed to be  
prevented by hardening measures on the server, also  
thttpd will be replaced by lighthttpd in the future.  
2023-10-24: We ask for some clarifications regarding software  
versions and advisory publication date.  
2023-10-29: Vendor provides software version information and asks us  
to publish the advisory after 2023-11-06.  
2023-11-22: Public release of security advisory.  
  
  
Solution:  
---------  
Install the "Prestable" packages or wait until they are available as hotfix:  
* mprivacy-tools_2.0.406g  
* tightgatevnc_4.1.2~1  
* rsbac-policy-tgpro_2.0.159  
  
  
Workaround:  
-----------  
None  
  
  
Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
SEC Consult Vulnerability Lab  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia  
  
About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Eviden business. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/  
  
Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: https://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
  
EOF Daniel Hirschberger, Steven Kurka, Marco Schillinger / @2023  
`