-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Louhi Networks Oy -= Security Advisory =- Advisory: Rittal CMC-TC Processing Unit II multiple vulnerabilities Release Date: 2009-03-23 Last Modified: 2009-03-22 Authors: Henri Lindberg, CISA [henri d0t lindberg at louhi d0t fi] Application: Rittal CMC-TC PU II Web management Devices: CMC-TC PU II DK 7320.100 SW: V2.45 HW: V3.01, possibly other Rittal products Attack type : XSS Type I, XSS Type II, Session prediction, Remote command execution in default configuration Severity: Moderate Vendor Status: Vendor notified. Patch already available for XSS vulnerabilities. Other vulnerabilities will be addressed in a future version, no release date set. References: http://www.louhinetworks.fi/advisory/Rittal_090323.txt Overview: Quote from http://www.rimatrix5.com/ : "The Computer Multi Control Top-Concept (CMC-TC) from Rittal is a complete security management for preventive protection to guard against consequential costs, and is the central organisational unit for linking to the facility management. ... Processing Unit II (PU II) the nerve centre of the CMC-TC monitoring system. The PU II is the coordinator between the sensor unit and the network. It is configured via the integral Web server." Details: Several vulnerabilities were identified from CMC-TC PU II web interface. These include XSS Type I, XSS Type II, weak session management and insecure default configuration. XSS Type 1: ----------- Web application fails to validate and/or htmlencode user input when handling erroneous requests. This allows attacker to inject HTML and client-side scripts to victim's browser by creating suitable links. This vulnerability cannot be used for session hijacking, because CMC-TC PU II requires each valid request to contain current session ID as URL parameter. Requests without session ID are redirected to the login page. Therefore only phishing-type attacks or attacks against user's browser are possible. Successful exploitation requires that attacker can lure or force the user to follow the malicious link. XSS Type 2: ----------- Web application fails to sanitize and/or htmlencode user input on system information page. This allows attacker to backdoor the device with HTML and browser interpreted content (such as ECMAscript dialects or other client-side scripts) as the content is displayed always after login. Persistent XSS allows attacker to modify displayed content or to change the victim's password (since old password is not required for password changes). Succesful exploitation requires access to the web management interface either with valid credentials or hijacked session. Weak session management: ------------------------ CMC-TC PU II uses unixtime from login moment as session identifier, thus having insufficient randomization. If administrator login time is known and session is still valid, it can be brute-forced with relatively little effort. Proof-of-concept tool is provided, but any web application security tool (such as Burp Intruder) can be used for this. Successful exploitation requires that administrator login time is known (or a reasonably accurate guess can be made) and the session is still active. Insecure default configuration: ------------------------------- If default administrator password is not changed, attacker can run arbitrary commands and modify the system software by uploading malicious update scripts via ftp. See update packet script contents for detailed information about the update process (eg update_l.sh). Software update packet expects user to have default password in place, since ftp-upload script contains hardcoded default password. The update will fail with no errors if it's been changed. What makes this interesting is the fact that the device does not offer operating system level access through any of the other management interfaces. Telnet and SSH both offer a menu based administration interface. Successful exploitation requires default administrator password and access to ftp port of the target device. Remediation: * Restrict unauthorized network access to device * Change default passwords (instructions provided in Operation Manual) * Install patched Version 2.60a * Update future patch version as soon as available * Configure web interface to 'view only' * Review device configuration after an administrator has been let go * Do not follow untrusted links Timeline: * 2008-xx-xx Issues discovered * 2009-02-25 Contacted vendor via e-mail * 2009-03-02 Contacted vendor via e-mail * 2009-03-02 Vendor response. XSS vulnerabilities were already fixed independently. http://www.rittal.de/downloads/Software/de/CMC_TC/18_update_processing_unit2/PU2_Update_v2.60a.zip http://www.rittal.de/downloads/Software/en/CMC_TC/12_CMC_TC_Processing_unit/7320100V33e.pdf Quote from vendor (sic): "thank you very much by the security information XXS. We have seen, your customer has check the PUII SW V2.45. Actual we have a better Version 2.60a with more seyurity. Our XXS-Check of that Version is OK. If you has by the basic more information for Rittal, we are fine to get . " * 2009-03-02 Contacted vendor via e-mail requesting information about weak session management and public disclosure of XSS vulnerabilities. * 2009-03-02 Discovered issues regarding default configuration from update packages * 2009-03-16 Contacted vendor via e-mail requesting information regarding vulnerabilities and stating intent to release the advisory * 2009-03-19 Vendor response. Promises to patch vulnerabilities in a future version. * 2009-03-19 Contacted vendor via e-mail requesting release date for the update. * 2009-03-20 Vendor response. Release date not set. * 2009-03-20 Contacted vendor via e-mail stating intent to release the advisory. Delivered draft version of advisory. Proof-of-Concept: 0) XSS Type 1 / Reflected http://cmc.example.com/cmclogin.cgi?Fredo=%3Cscript%3Ealert('You%20broke%20my%20heart.You%20broke%20my%20heart');%3C/script%3E http://cmc.example.com/cmcget.cgi?46010%3CSCRIPT%3Ealert('I%20know%20it%20was%20you.');%3C/SCRIPT%3E 1) XSS Type 2 / Persistent Setup - General - Location: <script src="http://l7.fi"></script> 1234567890 is the unixtime for administrator's login. <html> <head><title>42</title></head> <body onload="document.backdoor.submit()"> <form ACTION=http://1.1.1.1/cmcget.cgi?630101011234567890 METHOD=POST name="backdoor"> <input name="p001" value="Initech Datacenter CMC-TC PU #42"> <input name="p002" value="Compton, LA county"> <input name="p003" value="servicedesk_at_initech&#46;cpt"> <input name="p004" value="0"> <input name="p005" value="0"> <input name="p005" value="1"> <input name="p006" value="0"> <input name="p006" value="1"> <input name="p007" value="1"> <input name="p008" value="04.02.2000"> <input name="p009" value="04:20:00"> </form> </body> </html> 2) Session prediction Proof-of-concept brute force tool available at http://www.louhinetworks.fi/advisory/Louhi_CMC-brute_090323.zip Other information: * Default username and password is cmc * Default administrator username/password is admin * Device supports following protocols TCP/IP, SNMPv1, SNMPv3, FTP, SFTP, SMTP, HTTPS, NTP, SSH, PPP, DHCP. Further research is highly encouraged. "Six pints of bitter. And quickly please, the world's about to end." -- Ford Prefect Copyright 2009 Louhi Networks Oy. All rights reserved. No warranties, no liabilities, information provided 'as is' for educational purposes. Reproduction allowed as long as credit is given. Information wants to be free. -----BEGIN PGP SIGNATURE----- iEYEAREIAAYFAknHdIoACgkQ3TZNEGeZkm51ywCgurXjibfo7YnVo4w42652m/9l BiEAoJcIyGDmjrM0ebS+6ZYL6sniQ+qR =ic2o -----END PGP SIGNATURE-----