CVE-2023-36622

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2023-012 Product: Miniserver Go Gen.2 Manufacturer: Loxone Affected Version(s): <14.0.3.28 Tested Version(s): 14.0.3.28, 13.1.11.17 Vulnerability Type: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) (CWE-78) Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2023-04-21 Solution Date: 2023-05-09 Public Disclosure: 2023-06-30 CVE Reference: CVE-2023-36622 Author of Advisory: Tobias Jäger, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: The Loxone Miniserver Go is a smart home hub. The manufacturer describes the product as follows (see [1]): “The Loxone Miniserver Go serves as central control unit for all kinds of automation tasks.” Due to missing validation of user input, it is vulnerable to authenticated OS command injection. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The Loxone Miniserver Go is not validating user input when setting the timezone of the device. Since the timezone is set in a Linux shell context creating a symlink, the user can break out of the command and execute arbitrary OS commands. Executing a command in a shell context can be achieved by using backticks (`). The timezone can only be modified when authenticated as an administrative user. Communicating with the Loxone Miniserver Go, a websocket connection needs to be established and cryptographic parameters need to be negotiated. This is described in “Communicating with the Loxone Miniserver” (see [4]). Commands sent to the authenticated WebSocket need to be encrypted in the way described in the paper. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): Follow the instructions in “Communicating with the Loxone Miniserver”(see [4]) to establish a WebSocket connection and authenticate as an administrative user. Setting the timezone to “Europe/`touch /lx/hacked;echo Vienna`” will execute the OS command to create an empty file in the folder /lx named "hacked". Setting the timezone can be achieved by encrypting and sending the following command to the WebSocket: jdev/sys/setconfiguration/?json={"ip":0,"mask":16777215,"gateway":23505088, "dns1":23505088,"dns2":134744072,"mtu":0,"port-http":80,"port-ftp":21, "port-monitor":7777,"confLocalOnly":false,"msName":"SySS","host":"hostname", "ntp":"","timezone":"Europe/`touch /lx/hacked;echo Vienna`","externHost":"", "port-extHttp":0,"port-extHttps":0,"useProxy":false}’ If the attack was successful, an empty file named “hacked” should be found in the folder reachable via FTP. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Install firmware version 14.1.5.9 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2023-04-20: Vulnerability discovered 2023-04-21: Vulnerability reported to manufacturer 2023-05-09: Patch released by manufacturer 2023-06-30: Public disclosure of vulnerability ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for the Loxone Miniserver Go https://www.loxone.com/dede/kb/miniserver-go/ [2] SySS Security Advisory SYSS-2023-012 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-012.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] Communicating with the Loxone Miniserver https://www.loxone.com/dede/wp-content/uploads/sites/2/2022/06/1300_Communicating-with-the-Miniserver.pdf ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Tobias Jäger of SySS GmbH. E-Mail: [email protected] Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Tobias_Jaeger.asc Key ID: 0xABF0CF2F4D0220F9 Key Fingerprint: 5C9F 5312 F37E B9AB E87B 1212 ABF0 CF2F 4D02 20F9 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided “as is” and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXJ9TEvN+uavoexISq/DPL00CIPkFAmSdKcIACgkQq/DPL00C IPlgIRAAmVs9+YOlJI/Zayq0N0L02MahU1DBXNEDRWUDTCyfF4egLxREPJOokxyf KbhRFTqBIhtHah1yWbY6o3A5n38fLZ0nHvdly1N3ZmTQVHTqhZtPvYTlKNVj6xQn nlWd/Z4K3aauNo4hV+sodYEwyf/T6WIn2N7/wpfLh1GjvWMPoo2ANIWaeHwjWVZD 5nzgLdrCRROCATsgwzIPLDP0DOXcFC/4Yccz8rGKCtJTVdGjEyXu8d+IrCIBStsI j/KMAmKsDfOagie5HCZWckZZ1KlEjusPUFZa2ZHe51OX4Joqhb9RLntWdTYLwn0O cMpzqPRoa2N2eLWcJyYLzGquhsew1n0iRHCzH9Hu/Q4aU7YxNhsb6oOVZEA1Pmg9 Og1EJEwjO80qq7A8FrxlKfC+ZEvNy9C66TZIQbhhZ+CDFTWMdJRAPFJJ0kDUaf7z u26WnwtbDTNroMIlSoNqpQKkRbavPcqrtRqRYCkHmunS5DsfeEQhQkpy5aNsDnYy TsXPCitoBtNBlIwUjTYHokxMZ9hkPqMyyuIylMZpB11SKsqpENtfLqJRPhKUVBdi mrKvqntconlVRwV9BZanrkxkySvhrl7s5kWVukmc5TLr7T5Rn/MuQx7ShZxU6iFn 07vhXTkPUE6os4DCWsXtgR5dAwG5T8asiqtSb+R+3Axj6nRLD0Q= =hxVd -----END PGP SIGNATURE-----