TeamSpeak 3.0.0-beta25 – Multiple Vulnerabilities
####################################################################### Luigi Auriemma Application: TeamSpeak 3 http://www.teamspeak.com Versions: <= 3.0.0-beta23 2.x not affected Platforms: Windows, Mac OS X and Linux Bugs: A] execution of various admin commands B] various failed assertions C] various NULL pointer dereferences Exploitation: remote, versus server Date: 16 Jun 2010 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== TeamSpeak 3 is the latest and current version of one of the most popular VOIP softwares intended mainly for gamers where exists just a florid market of hosters for renting servers. ####################################################################### ======= 2) Bugs ======= First a small introduction and a little explanation about why the old 2.x versions aren't vulnerable. From the major version 3.x TeamSpeak has completely changed the whole protocol used by the Standard Port (UDP 9987) adding encryption with variable ivec (uses libtomcrypt) and using 7 channels for each type of packet, like channel 2 for the commands packets. All the vulnerabilities below are exploitable by unauthenticated users and even via one single UDP packet making it possible to spoof it and bypassing any possible IP based filter on the server. -------------------------------------- A] execution of various admin commands -------------------------------------- The commands available through channel 2 are exactly those available in the TeamSpeak 3 ServerQuery Manual (doc\ts3_serverquery_manual.pdf) and partially those available through the TCP port 10011. They can be used to change practically any aspect of the server and the hosted virtual servers but obviously they require some permissions. The problem is that through this particular way (the standard port's channel) and before any login/join on the server (so just the first packet) it's possible to execute even some of those commands that require permissions. The following is a list of commands that have been tested with success: banclient bandel channeladdperm/channeldelperm channelclientaddperm/channelclientdelperm channeldelete channeledit some others channelgroup* commands channelmove clientaddperm/clientdelperm clientdbdelete clientget* commands clientkick clientmove clientpoke messageadd sendtextmessage serveredit servergroupadd other servergroup* commands setclientchannelgroup tokenadd/tokendel various "view-only" commands but they don't print the output back ... other commands Who knows a bit how the configuration of TeamSpeak works or has given a quick look to the manual can understand the dangerousness caused by the execution of some of these commands. The following are some examples and scenarios: - serveredit through this command is possible to configure the server/virtual server modifying any possible option like adding a custom join password, setting the number of max clients to zero so that nobody can join, changing the admin group, setting a custom filebase (the disk location where are saved all the avatars of the clients and other files), setting custom banners and host message, disable logs, disable uploads and downloads, change the server's port, retrieving all the IPs and "suid" of any client in the server through the setting of virtualserver_hostbanner_gfx_url and other things - sendtextmessage it's possible to use this command for sending a message to the main channel or to specific channels and clients from the user "Server", good for social engineering and flooding (clients will freeze in some cases) - channel* it's possible to delete and move the channels created by the users - client* and ban* it's possible to kick and ban any client currently in the server and even unban any permanent and temporary ban or deleting the users from the database and so on - clientpoke this particular command spawns a dialog box on the client containing a message (annoyance) - messageadd sends offline messages from the server (possible social engineering) - token* and servergroup* these commands could be used for gaining more privileges anyway I have not understood and tested them much Note that, upon success, the output of the commands is not returned making the "view-only" commands available through this method (like version, permissionlist, clientgetids and the others) enough useless while a message is returned in case of errors and unavailable or incomplete commands. This could be enough ugly in some cases where are needed IDs and other numeric identificators for channels and clients but most of them can be retrieved probably from the protocol of a normal client and from the info available from there otherwise it's possible to brute force them. Note also that exist some commands not listed yet in the official ServerQuery manual because are commands used by the client for itself like clientsitereport, setwhisperlist and so on. Although "serveredit" is already a critical command I have not tested if it's possible to become superadmin (I mean to login in the server through a token or the TCP interface for administering it "normally" like a normal admin without using this vulnerability because "serveredit" is already a superadmin command) or causing more system damages like files reading and overwriting. UPDATE: the "serveraddgroupclient" command is the one for assigning superadmin privileges to users. It's also important to highlight the "virtualserver_hostbanner_gfx_url" parameter of "serveredit" because the client automatically loads that url at regular intervals or when it joins the server or each time it gets modified and http:// is not the only protocol handler that can be used (ftp://, file:// and any other one supported by the client's browser) so it "could" be used for exploiting particular clientside bugs (like freezing/crashing it with particular files) or for forcing the clients to exploit external web server vulnerabilities and other possible things. But yeah this is not related to this advisory or should require a separate bug section. ---------------------------- B] various failed assertions ---------------------------- Some of the available TeamSpeak 3 commands used via the standard's port method cause various failed assertions on the server that will terminate silently. The following is the list of the commands and relative assertions: banlist Assertion "invokerClientID != 0" failed at server\serverlib\virtualserver.cpp:7442; complainlist Assertion "client != 0" failed at server\serverlib\permission_manager.cpp:167; servernotifyunregister not implemented serverrequestconnectioninfo Assertion "client != 0" failed at server\serverlib\permission_manager.cpp:167; setconnectioninfo Assertion "clID != 0" failed at common\packethandler.cpp:367; servernotifyregister event=server not implemented ------------------------------------ C] various NULL pointer dereferences ------------------------------------ Exactly as above except that the following are all NULL pointers that cause a crash of the server: bandelall channelcreate channel_name=name channelsubscribe cid=1 channelsubscribeall banadd ip=1.2.3.4 clientedit clid=1 client_description=none messageupdateflag msgid=1 flag=1 complainadd tcldbid=1 message=none complaindelall tcldbid=1 ftinitupload clientftfid=1 name=file.txt cid=5 cpw= size=9999 overwrite=1 resume=0 ftgetfilelist cid=1 cpw= path=\/ ftdeletefile cid=1 cpw= name=\/ ftcreatedir cid=1 cpw= dirname=\/ ftrenamefile cid=1 cpw= tcid=1 tcpw=secret oldname=\/ newname=\/ ftinitdownload clientftfid=1 name=\/ cid=1 cpw= seekpos=0 ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/teamspeakrack.zip https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13959.zip (teamspeakrack.zip) ####################################################################### ====== 4) Fix ====== No fix. UPDATE: version 3.0.0-beta25 ####################################################################### |