There is also a full write up on
https://medium.com/@evstykas/remote-smart-car-hacking-with-just-a-phone-2fe7ca682162
<https://medium.com/@evstykas/remote-smart-car-hacking-with-just-a-phone-2fe7ca682162>
Vulnerability Security Advisory < 20180501 >
=======================================================================
title: Incorrect Privilege Assignment
product: lenderoutlook on colt.calamp-ts.com
<http://colt.calamp-ts.com/>
vulnerable version: latest
fixed version: -
CVE number: -
impact: critical
found: 2018-04-31
by: Vangelis Stykas & George Lavdanis
=======================================================================
Vendor description:
-------------------
Calamp is a telematics pioneer on M2M that manages more than 1.5M IoT devices.
Vulnerability overview/description:
-----------------------------------
1) Incorrect Privilege Assignment
When a user is logged in https://colt.calamp-ts.com/dashboard/login
<https://colt.calamp-ts.com/dashboard/login> , a service that is being used by
many vendors (such as viper smartstart and directed smartstart) it makes a
request to
https://reporting.calamp.com/jasperserver-pro/
<https://reporting.calamp.com/jasperserver-pro/> to login with the same
user.This server is used to generate reports regarding users vehicles using
TIBCO jaspersoft server.
When the reports are run from the dashboard they are limited to user owned
vehicles but this is not the case when accessing the jaspersoft server directly.
Any report on any user vehicle can run, making location / past whereabouts of
vehicles and users available.A lot of financial data reports are also available.
Data sources are also viewable / editable / exportable .After exporting clear
text passwords of data sources are available.
As data sources are editable a ddos can be caused just by editing them.
As data sources are correctly firewalled no direct access is possible.
We can manipulate by editing existing reports , adhoc views and queries to
access all the data on the underlying data sources and using it to lead to a
full compromise of the platform.
Exploiting this also gives access to connect.calamp.com
<http://connect.calamp.com/> database.
Proof of concept:
-----------------
1) Incorrect Privilege Assignment:
### Details
* Attack Vector: HTTP GET
* Prerequisites: None
* CWE: CWE-266: Incorrect Privilege Assignment
* Technical Impact: View reports of any user / vehicle / iot
device, query about any user / vehicle / iot device, access underlying data
sources.
* Vulnerable query URL: /
Vulnerable / tested versions:
-----------------------------
https://colt.calamp-ts.com/ <https://colt.calamp-ts.com/>
https://connect.calamp.com/ <https://connect.calamp.com/>
Vendor contact timeline:
------------------------
2018–05–01: Sent support request requesting proper disclosure steps
2018–05–01: Asked via twitter dm on @calamp for an email to sent report
2018–05–02: Reached out via linkedin to a cybersecurity employee at calamp for
direction on proper disclosure
2018–05–02: Reached out to CERT which guided us to the proper communication
channel
2018–05–02: Calamp answered and acknowledged issue
2018–05–03: Calamp updated us that their are working on a fix
2018–05–12: Calamp notified us that is is patched and after verification we are
releasing this.
Attachment:
signature.asc
Description: Message signed with OpenPGP
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/