CVE-2023-36624

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2023-004 Product: Miniserver Go Gen.2 Manufacturer: Loxone Affected Version(s): <14.0.3.28 Tested Version(s): 14.0.3.28, 13.1.11.17 Vulnerability Type: Execution with Unnecessary Privileges (CWE-250) Risk Level: Low Solution Status: Open Manufacturer Notification: 2023-04-19 Solution Date: tba Public Disclosure: 2023-06-30 CVE Reference: CVE-2023-36624 Author of Advisory: Tobias Jäger, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: Loxone Miniserver Go is a smart home hub. The manufacturer describes the product as follows (see [1]): “The Loxone Miniserver Go serves as central control unit for all kinds of automation tasks.” Due to a misconfiguration of the sudoers file, it is vulnerable to a local privilege escalation. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The Linux-based firmware uses the user “lx” as a low-privileged user. Sudo is used to execute commands with higher privileges. The user “lx” is granted these rights even without the need to insert the user’s password for several binaries. Some of these binaries allow the execution of code, like the archive tool tar. The user “lx” is allowed to execute the following binaries with root privileges without the need of entering their password: lx ALL=NOPASSWD: /usr/sbin/dumpe2fs -h /dev/mmcblk0p6, /usr/bin/ntpdate *, /usr/bin/lsof, \ /usr/bin/tee /proc/sys/vm/drop_caches, /usr/bin/tee -a /var/log/*, \ /usr/bin/openssl *, /usr/bin/tar *, \ /usr/bin/systemctl restart systemd-networkd.service, \ /usr/bin/updateflash /dev/mtd5 0x0 *, /usr/bin/systemctl reboot, \ /usr/bin/systemctl restart pure-ftpd.service, \ /usr/bin/systemctl stop starthomekit.service, \ /usr/bin/systemctl restart starthomekit.service, \ /usr/bin/systemctl restart avahi-daemon, \ /usr/bin/miniserverinit applytzdata *, \ /usr/bin/eebus, /usr/bin/ssh*, /usr/bin/ln *, /usr/bin/journalctl *, /usr/bin/tee /var/log/*, \ /usr/bin/hostnamectl *, /usr/bin/killall *, \ /usr/bin/chmod 644 /etc/factory/*, \ /usr/bin/systemctl is-active --quiet *, \ /usr/bin/cat /root/.ssh/known_hosts For example, /usr/bin/tar can be used to execute arbitrary system commands and therefore escalate privileges to the root user. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): With the following line, the user “lx” can execute the whoami command in the context of the root user: sudo tar -cf /dev/null /dev/null --checkpoint=1 -checkpoint-action=exec="whoami" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: - - ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2023-01-19: Vulnerability discovered 2023-04-19: Vulnerability reported to manufacturer tba: Patch released by manufacturer 2023-06-30: Public disclosure of vulnerability ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for the Loxone Miniserver Go https://www.loxone.com/dede/kb/miniserver-go/ [2] SySS Security Advisory SYSS-2023-004 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-004.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Tobias Jäger of SySS GmbH. E-Mail: [email protected] Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Tobias_Jaeger.asc Key ID: 0xABF0CF2F4D0220F9 Key Fingerprint: 5C9F 5312 F37E B9AB E87B 1212 ABF0 CF2F 4D02 20F9 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided “as is” and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXJ9TEvN+uavoexISq/DPL00CIPkFAmSdKeQACgkQq/DPL00C IPkboQ//aOBNlO7FCXTawgWoRXopVafie3zM1C/GgKt5cQNFqwmLNi8PB+3u6aO0 K2n4RtwCv7UYbpuV85nYe77OB4ApXQ7h0V2jRGzrekYGWOTZURsMfQ9EOtQfz6KX eehmMYlgLP1TOU96MaS9R95sxujkIg2hKZAEFrWmz2yq8q6aL9uwkye3FttXl9mx LKxP2CCKnzxmPezT9MyIdpOkVPnBn3uZQ2JvTrEe7NatTKHXqE1E72ZI/ur7X7D9 TCyBIr7ETGetHUqW/zFLNriruwjYilXiXahDV7jxwjOb+RtVv3MhkwVpyRjs1cOx QNSHij+Myspoqryly7XjOn7B5MNvaQ0mSqu0xtavnIf9XtVoLQMVXyZN0tWgEDD6 iEBBdf8QM2rb1ce8Q+2UAQDFUkCCKtLL6Q0q/Swn4I7bG/Vm+MrDkD0k1MAdX6Rt ukSU6+xFNbtT4zKcPdZCXTRk/aAZ9fQN1UATF8OkV1psGxEgXRZuleuLugt5c6+M Ub7qGklBYq7OVnv9c54L9HXpLOTOX6hN+5uhnc3b1+SIN3U5YAALkfWO0b30t8Yr ZC+XyrNcszTo7BqzO+/SRlHBAgigqoE7vNq74HV1o2T6MeYDZLWxF8RKTtJ9InpQ n3RRYcrIvKAUHYRH12LodTXUMB6WLQAEn7Nj4+ofhiNdN0YoRBU= =ev9p -----END PGP SIGNATURE-----