title: Privilege escalation vulnerability product: MICROSENS Profi Line Modular Industrial Switch Web Manager (MS652119PM)
vulnerable version: Firmware version 10.3.1 fixed version: Firmware version 10.3.2 impact: High homepage: http://www.microsens.com/profi-line-modular/ found: 2013-08-21 by: Christian Kudera, Stefan Riegler SEC Consult Vulnerability Lab https://www.sec-consult.com =======================================================================
"The new Profi Line Modular switches, from MICROSENS, offer maximum performance and flexibility in smallest spaces. Robust, modular, expandable and designed for greatest reliability and shortest recovery times, the Profi Line Modular series has become the first-choice solution for Industrial Ethernet."
SEC Consult has identified a privilege escalation in the MICROSENS Web Manager in the course of a very limited infrastructure audit. Very little time was spent on the affected product.
The Web Manager can be used with read only permission to check the configuration on the device (e.g. VLANs, Port status). Additionally the Web Manager can be used with read and write permission to configure the device.
Using the identified vulnerability a low privileged user having read only permission can elevate his privileges to contain read and write permissions.
The Web Manager contains a login form to authenticate a user. The Web Manager offers different levels of privilege (e.g. read only permission, read and write permission, debugging permission).
The login generates the following request to the server: interf=WEB&bidx=1&unam=root&pawo=&plev=0
This request triggers a CGI binary, which validates the login attempt and returns the following response: <xml> <!-- last change: 17.04.2012 --> <!-- returned at uptime of 141056 seconds --> <header> <version>V0.1</version> <user>XYZ</user> <date>2012/05/29 17:28:00</date> </header>
<response> <par name="cmd" type="STRING" > <val>login</val> </par> <par name="result" type="UNSIGNED" > <val>255</val> </par> <par name="lunam" type="STRING" > <val>root</val> </par> <par name="liid" type="STRING" > <val>0</val> </par> <par name="rhost" type="STRING" > <val>184.108.40.206</val> </par> <par name="a_s_b" type="STRING" > <val>0_0_1</val> </par> </response> </xml>
The parameter "result" informs the client about the properness of the provided login credentials. The parameter can correspond to the following values: 255 login failed 1 login with read only permission 2 login with read and write permission 3 login with debugging permission
For example, if the value of the parameter "result" is changed to 3, the user gets logged in with debugging permissions.
2013-09-10: Contacting vendor 2013-09-11: Sending advisory and proof of concept exploit via encrypted channel. 2013-09-11: Vendor acknowledges receipt of advisory. 2013-10-18: Vendor responds and wants to release update on 2013-10-31. 2013-10-31: MICROSENS releases fixed version. 2014-02-07: Conference call: Clarifying pending questions regarding the fixed version. 2014-02-28: SEC Consult releases coordinated security advisory.
Update to the most recent firmware version 10.3.2
All accounts with read only permissions should be disabled on the device.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab
SEC Consult Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius
Headquarter: Mooslackengasse 17, 1190 Vienna, Austria Phone: +43 1 8903043 0 Fax: +43 1 8903043 15
Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult
Interested in working with the experts of SEC Consult? Write to firstname.lastname@example.org
EOF Christian Kudera / @2014