SB2016101133 - Multiple vulnerabilities in AVTECH devices

Description

This security bulletin contains information about 9 secuirty vulnerabilities.

1) Cleartext storage of sensitive information (CVE-ID: N/A)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores passwords of all device users clear text. A local user can view contents of the file and recover credentials of other device users.

2) Cross-site request forgery (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

3) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions to scripts located in the "/cgi-bin/nobody" folder, e.g. "/cgi-bin/nobody/Machine.cgi". A remote non-authenticated attacker can send requests to the scrips in the folder and gain access to sensitive information.

4) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in "/cgi-bin/nobody/Search.cgi" script. A remote non-authenticated attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

5) OS Command Injection (CVE-ID: N/A)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in "/cgi-bin/nobody/Search.cgi". A remote unauthenticated attacker can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

6) Improper Authentication (CVE-ID: N/A)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to application allows unauthenticated requests to scripts, if request URI contains ".cab" or "/nobody" strings.  A remote non-authenticated attacker can append to URL ".cab" or "/nobody" string, bypass authentication process and gain unauthorized access to the application, as well as download source code of scripts on the device.

7) Session Fixation (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform session fixation attacks.

The vulnerability exists due to application is using base64-encoded username and password as the Cookie value instead of randomly generated session identifier. A remote attacker can obtain or brute-force such session token and gain unauthorized access to the device.

8) OS Command Injection (CVE-ID: N/A)

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in "/cgi-bin/supervisor/PwdGrp.cgi" and "/cgi-bin/supervisor/adcommand.cgi" scripts. A remote privileged user can pass specially crafted data to the application and execute arbitrary OS commands on the target system with root privileges.

9) Improper validation of certificate with host mismatch (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform a MitM attack.

The vulnerability exists due to software does not verify identity of the supplied HTTPS certificate in SyncCloudAccount.sh, QueryFromClient.sh and SyncPermit.sh scripts. A remote attacker can perform MitM attack and compromise the device by supplying a malicious firmware update.

Remediation

Install update from vendor's website.

References

• https://www.exploit-db.com/exploits/40500/