Circle with Disney check_torlist.sh Update Code Execution Vulnerability

Summary

An exploitable vulnerability exists in the torlist update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability.

Tested Versions

Circle with Disney 2.0.1

Product URLs

<https://meetcircle.com/&gt;

CVSSv3 Score

9.6 - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-73: External Control of File Name or Path

Details

Circle with Disney is a network device used to monitor and restrict internet use of children on a given network. When connected to a given network and configured, it immediately begins arp poisoning all other devices on the network, such that it can validate and restrict all traffic as is seen fit by the parent/administrator of the device.

Periodically, the device will query outbound towards the meetcircle.co domain, attempting to grab the latest list of known Tor addresses as a gunzipped tarball, shown below in the following snippet:

#!/bin/sh
MAC=`cat /tmp/MAC`;
TORVER=`cat /tmp/torlist.ver`
CIRCLE_ROOT=`cat /tmp/CIRCLE_ROOT`
rm -f /tmp/torlist.new.tgz
/tmp/wget -t 1 -T 30 -q -O /tmp/torlist.new.tgz "http://download.meetcircle.co/dev/firmware/get_torlist.php?      DEVID=$MAC&VER=$TORVER" || exit
if [ -s /tmp/torlist.new.tgz ]; then
    #sanity check tgz file size. size in kbytes
    gzsize=`du /tmp/torlist.new.tgz | cut -f 1`
    minsize=5
    if [ $gzsize -gt $minsize ]; then
        cd /tmp
        tar zxf /tmp/torlist.new.tgz
        if [ -s /tmp/torlist ]; then
            $CIRCLE_ROOT/ipsetload torlist /tmp/torlist
        fi
    fi
fi
rm -f /tmp/torlist.new.tgz

Unfortunately, since this wget request is not using HTTPS, it becomes trivial for an attacker to supply their own tarball, which would be extracted, allowing an attacker to overwrite any file in the “/tmp” directory. A sample exploit would be to zip up a script named ‘wget’, such that it would executed in subsequents run of this check_torlist.sh script, (which is scheduled via a cronjob).

Timeline

2017-08-02- Vendor Disclosure
2018-10-31 - Public Release