SmartNode SN200 3.21.2-23021 OS Command Injection

`Advisory ID: SYSS-2023-019  
Product: SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway  
Manufacturer: Patton LLC  
Affected Version(s): <= 3.21.2-23021  
Tested Version(s): 2.21.1-22041, 3.21.2-23021, 3.22.0-23083  
Vulnerability Type: OS Command Injection (CWE-78)  
Vulnerability Type: Improper Access Control (CWE-284)  
Risk Level: High  
Solution Status: Open  
Manufacturer Notification: 2023-07-05  
Public Disclosure: 2023-08-28  
CVE Reference: CVE-2023-41109  
Author of Advisory: Maurizio Ruchay, SySS GmbH  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
SmartNode SN200 is a VoIP appliance which is manufactured and  
distributed by Patton LLC.  
  
The manufacturer describes the product as follows (see [1]):  
  
"The SmartNode 200 Series of VoIP Analog Telephone Adapter and VoIP Phone  
Adapter Gateways support up to four telephone connections. VoIP Analog Phone  
Adapter integrates legacy Phones and Fax machines into a UCC Environment.  
High-quality voice and reliable fax over any IP network. All-IP does not end  
when analog terminals have to be integrated. Security and quality guaranteed."  
  
Due to an error in the authorization mechanism and improper input validation,  
the device allows unauthenticated adversaries to execute OS commands via  
the web interface.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
SySS GmbH found an unauthenticated OS command injection vulnerability in  
SmartNode 200 (SN200) devices.  
  
The SN200 devices offer a "Network Diagnostic Commands" feature to  
administrative users. This feature is designed to execute network diagnostic  
commands like ping. However, as SySS GmbH discovered, the feature can be  
used to execute arbitrary system commands.  
Furthermore, a flaw in the authorization mechanism was found. This issue allows  
unauthenticated adversaries to execute system commands via the affected feature.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
The following HTTP request shows how the system command "id" is executed  
on the device:  
  
===  
POST /rest/xxxxxxxxxxxxxxx/xxxxxxx?executeAsync HTTP/1.1  
Cookie: AuthToken=; AuthGroup=superuser; UserName=admin  
[... shortened ...]  
Connection: close  
  
{"cmd":"/usr/bin/id","arguments":[]}  
===  
  
The following output from the web interface shows that the command has  
been executed:  
  
===  
*** Command started ***  
[... shortened ...]  
uid=0(root) gid=0(root)  
  
PING 127.0.0.1 (127.0.0.1): 56 data bytes  
64 bytes from 127.0.0.1: seq=0 ttl=64 time=1.025 ms  
64 bytes from 127.0.0.1: seq=1 ttl=64 time=1.781 ms  
  
*** Command completed ***  
===  
  
Especially noteworthy is that an empty cookie "AuthToken" can be used in  
order to bypass the authorization checks.  
  
Since the vulnerability is still active, parts of the PoC have been redacted.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
A patch for this issue is not yet available. Therefore, it is recommended to  
disable the vulnerable "Network Diagnostic Commands" feature if possible.  
Furthermore, it is advised to block network access to the HTTP interface  
either on the device directly or via firewall.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2023-06-28: Vulnerability discovered  
2023-07-05: Vulnerability reported to manufacturer  
2023-08-28: Public disclosure of vulnerability  
2023-10-13: Vulnerability confirmation on the newly released update 3.22.0-23083  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Product website for SmartNode SN200  
https://www.patton.com/voip-gateway/sn200/  
[2] OWASP OS Command Injection Defense Cheat Sheet  
https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html  
[3] SySS Responsible Disclosure Policy  
https://www.syss.de/en/responsible-disclosure-policy  
[4] SySS Security Advisory SYSS-2023-019  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-019.txt  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Maurizio Ruchay of SySS GmbH.  
  
E-Mail: [email protected]  
Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Maurizio_Ruchay.asc  
Key ID: 0xEDA7235FA5478A8C  
Key Fingerprint: 9AA6 D02F C74F 3EDE C1CE AE51 EDA7 235F A547 8A8C  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"  
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS Web  
site.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: https://creativecommons.org/licenses/by/3.0/deed.en  
  
`