Circontrol Raption Buffer Overflow / Command Injection

`Circontrol EV Charger vulnerabilities.  
  
1. CVE-2020-8006 Pre-Auth Stack Based Buffer Overflow  
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10)  
  
The server in Circontrol Raption through 5.11.2 has a pre-authentication  
stack-based buffer overflow that can be exploited to gain run-time control  
of the device as root.  
  
When the server parses the HTTP headers and finds the Basic-Authentication  
tag it will call a base64 decode function. This function takes 3 arguments:  
an input pointer, an output pointer and a length. During the authentication  
flow, the input pointer can be an attacker controlled string of  
approximately 4096 characters, and the output pointer is located on the  
stack, the length argument is 512. While the length of the stack based  
buffer is passed to the decoder it only verifies that it is not smaller than  
3.  
  
  
[Vendor of Product]  
  
https://circontrol.com/  
  
[Affected Product Code Base]  
  
Raption Server - Raption up to 5.11.2  
  
[Affected Component]  
  
OCCP 1.5, OCCP.1.6, PWRSTUDIO  
  
[Attack Type]  
  
Remote  
  
[Impact Code execution]  
  
true  
  
[Impact Denial of Service]  
  
true  
  
[Attack Vectors]  
  
Remote  
  
[Has vendor confirmed or acknowledged the vulnerability?]  
  
true  
  
[Discoverer]  
  
Abert Spruyt, Alex Salvetti, Dariusz Gońda  
  
[Reference]  
  
https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/  
  
  
2. CVE-2020-8007 - Command injection (RCE/authenticated)  
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L (9.1)  
  
The pwrstudio web application of EV Charger (in the server in Circontrol  
Raption through 5.6.2) is  
vulnerable to OS command injection via three fields of the configuration  
menu for ntpserver0, ntpserver1, and pingip.  
  
[VulnerabilityType Other]  
  
Command Injection  
  
[Vendor of Product]  
  
https://circontrol.com/  
  
[Affected Product Code Base]  
  
Raption Server - up to 5.6.2  
  
[Affected Component]  
  
pwrstudio  
  
[Attack Type]  
  
Remote  
  
[Impact Code execution]  
  
true  
  
[Attack Vectors]  
  
To exploit this issue authorization is required.  
  
  
[Has vendor confirmed or acknowledged the vulnerability?]  
  
true  
  
[Discoverer]  
  
Abert Spruyt, Alex Salvetti, Dariusz Gońda  
  
  
[Reference]  
  
https://circontrol.com/intelligent-charging-solutions/dc-chargers-series/raption-150/  
  
`