Woran leakts? ÆPIC Leak – Mikroarchitektur-Schwachstelle bedroht sichere Enklaven

Die durch Forschende u. a. der Universität Sapienza Rom und der TU Graz entdeckte Schwachstelle „ÆPIC Leak“ (CVE-2022-21233) erlaubt erstmals, über die Mikroarchitektur geheime Daten aus Intel-CPUs zu stehlen, ohne dabei einen verrauschten Seitenkanal wie Meltdown oder Spectre zu benötigen. ÆPIC („Architecturally Leaking Uninitialized Data from the Microarchitecture“) funktioniert auf allen aktuellen Sunny-Cove-basierten Intel-CPUs. ÆPIC Leak kommt über einen sogenannten „uninitialized read“ – also ein Lesen von Speicherbereichen, in denen ein anderer Prozess Datenreste hinterlassen hat – in der CPU an Informationen, die zwischen dem L2- und dem Last-Level-Cache übertragen werden. User mit privilegiertem Zugriff können diese so extrahieren, etwa auch aus SGX-Enklaven, die eigentlich die Daten genau vor diesen Root-Usern schützen sollen.

Normale User können ÆPIC Leak nicht ausnutzen, da sie keinen Zugriff auf die physische APIC MMIO haben; auch VMs wird dieser Zugriff durch die Hypervisoren verwehrt. So wird die Lücke insgesamt nur als mittel eingestuft.

Insbesondere Systeme mit CPUs, die sich auf sichere Enklaven verlassen, um Daten vor privilegierten Angreifern zu schützen, sollten dringend gepatcht werden.

https://aepicleak.com/

HiSolutions Research

HAFNIUM Exchange-Schwachstellen: Überblick

Die hochkritischen HAFNIUM-Lücken (CVE-2021-26855 aka ProxyLogon), CVE-2021-26857, CVE-2021-26858 und CVE-2021-27065) bedrohen weiterhin IT-Infrastrukturen weltweit. Auf dieser Seite haben wir die wichtigsten Informationen und Hilfsmittel für Sie zusammengestellt.

Update 14.4.2021: Durch neue kritische Exchange-Schwachstellen könnte eine weitere Hafnium-ähnliche Welle drohen.

Wie Sie den Medien entnehmen konnten oder in nicht wenigen Fällen auch in der eigenen Betroffenheit bemerkt haben, beherrscht das Thema der kritischen Microsoft Exchange Lücke zur Zeit die IT. Bei HiSolutions haben wir aus allen Bereichen Ressourcen zusammengezogen, um den sprunghaft gestiegenen Bedarf an Incident Response und Forensik auffangen zu können. Wir bitten um Verständnis, wenn der Zeitplan des einen oder anderen Projektes aktuell darunter leidet und danken vor allem für das große Verständnis – und dafür, dass wir alle gemeinsam an der Bewältigung dieser Krise arbeiten!

In den letzten Wochen konnten wir daher viele Anfragen zur Security nicht sofort annehmen. Sobald sich die aktuelle Lage beruhigt, würden wir uns gerne bei Ihnen zurückmelden, um Verbesserungen anzugehen.

ProxyLogon-Logo

Letzte Beiträge

  • Hafnium – Überwachen Ihrer Systeme mit Loki
    Auch mehr als ein Jahr nach der gravierenden Hafnium-Schwachstelle sind immer noch nicht alle Systeme abgesichert. Wir haben nun unsere Handreichung Hafnium – Überwachen Sie Ihre Systeme aktualisiert, um aufgrund der Lizenzbedingungen den Scanner Loki (statt Loki und Thor) zu empfehlen.
  • Hafnium Reloaded – Wieder kritische Schwachstellen in Microsoft Exchange
    Und täglich grüßt das Murmeltier? Nicht ganz. Trotzdem erleben wir aktuell ein Déjà-vu mit Microsoft Exchange: Am 13.04.2021 19 Uhr MESZ wurden vier neue hochkritische Schwachstellen samt dazugehörigem Patch veröffentlicht. Das BSI warnt bereits vor der Schwachstelle und fordert dazu auf, sehr zeitnah die eigenen Systeme zu patchen. Die Cybersecurity and Infrastructure Security Agency (CISA) des US Department of Homeland Security (DHS) geht sogar noch einen Schritt weiter und wird am Freitag, den 16.04.2021 alle nicht gepatchten Systeme aus dem […]
  • HAFNIUM/ProxyLogon: Self-Help Guide To Securing Microsoft Exchange
    Due to the high demand for current, in-depth information on how to mitigate the HAFNIUM/ProxyLogon vulnerabilities in Microsoft Exchange we translated our free German HiSolutions Self-Help Guide into English.
  • HAFNIUM-Schwachstellen: Office 365/Microsoft 365/AD FS indirekt auch bedroht
    Von Inés Atug, Markus Drenger und Daniel Jedecke. Nach der Veröffentlichung des Out-of-Band-Patches für die als HAFNIUM bekannt gewordenen Schwachstellen in Exchange Servern haben viele Admins, die zuvor eine Migration nach Office 365 (jetzt Microsoft 365) durchgeführt hatten, aufgeatmet. Denn Microsoft zufolge ist Exchange Online von Hafnium nicht betroffen. Hiermit meint der Hersteller jedoch das Produkt an sich: Exchange Online ist weiterhin nicht direkt angreifbar. Aber Vorsicht: Es kann je nach Aufbau dennoch möglich sein, dass Angreifer auf den Cloud-Dienst […]
  • HAFNIUM Exchange-Schwachstellen: Überblick
    Die hochkritischen HAFNIUM-Lücken (CVE-2021-26855 aka ProxyLogon), CVE-2021-26857, CVE-2021-26858 und CVE-2021-27065) bedrohen weiterhin IT-Infrastrukturen weltweit. Auf dieser Seite haben wir die wichtigsten Informationen und Hilfsmittel für Sie zusammengestellt. Update 14.4.2021: Durch neue kritische Exchange-Schwachstellen könnte eine weitere Hafnium-ähnliche Welle drohen. Wie Sie den Medien entnehmen konnten oder in nicht wenigen Fällen auch in der eigenen Betroffenheit bemerkt haben, beherrscht das Thema der kritischen Microsoft Exchange Lücke zur Zeit die IT. Bei HiSolutions haben wir aus allen Bereichen Ressourcen zusammengezogen, um den […]
HiSolutions Research

High-Impact Vulnerabilites In Multiple USB Network Servers

Within the scope of a recent penetration test and through individual research effort, HiSolutions‘ security consultants discovered multiple previously unknown high-impact vulnerabilities in USB network server firmwares (see individual issues for the CVE IDs). Devices of multiple vendors were affected by similar vulnerabilities. HiSolutions responsibly disclosed the vulnerabilities to the vendors and additionally provided feedback on the implemented patches.

Background Information

USB network servers or USB network MTP and printer servers are devices that can be used to make USB devices accessible to multiple users via the network. Users install a software on their client and can then access USB devices without the need to physically plug the device into the local system. If devices are used by multiple users the devices do not have to be transfered between different systems each time the user changes. Use cases include shared USB network drives, USB Printers, or USB license dongles that can be used by authenticated users on the local network. All of the investigated devices were provided with an individual client software that runs on the local systems. All systems also exposed a web server that could be used to make administrative changes to the system.

The Vulnerabilities

HiSolutions consultants discovered four noteable vulnerabilities in each of the investigated devices.
The devices were:

  • TP-Link TL-PS310U (version v2.000, fixed in 2.079.000.t0210)
  • Digitus da-70254 (version 2.073.000.E0008)
  • Lindy No. 42633 (version v.2.078.000)
  • one other reviewed device of an (at this time) undisclosed vendor

Exposure of the Administrative Password Over Network Broadcast

The following CVE IDs were issued for this vulnerability: CVE-2020-15054 (TP-Link), CVE-2020-15058 (Lindy), CVE-2020-15062 (Digitus).

The USB network servers send the password of the local administrator account repeatedly and without request across the local Network via UDP broadcast. Every system on that network can read the password from these unencrypted broadcasts. The password is sent in UDP packets to the broadcast address 255.255.255.255 as can be seen in the following packet capture:

wireshark packet capture screenshot of administrative password in udp network traffic
Figure 1: UDP broadcast of the administrative password „PASSWORDABC“.

All systems in the local network receive the administrative password. In theory, the password is then used to locally check against the password entered by the client on the local system. In practice, an attacker can easily retrieve the password from the UDP broadcast messages and thus
circumvent the access restrictions to the administrative interface. The attacker then can use all functions provided by the USB network server, including restricted ones. If the password is reused (which is strongly discouraged but often the case) this design error could give an attacker access to other systems that use the same password.

Authentication Bypass in Web Administration Interface

The following CVE IDs were issued for this vulnerability: CVE-2020-15055 (TP-Link), CVE-2020-15059 (Lindy), CVE-2020-15063 (Digitus).

In some cases the password authentication requirement in the web interface can be bypassed when the password parameter is removed from the request. This enables an unauthenticated user to access privileged functions on the interface.
As an example, the following request will change the server name, a functionality that would normally only be available if the configured password was provided:

POST /csystem33.htm HTTP/1.1
Host: 192.168.0.10
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.10/csystem33.htm
Content-Type: application/x-www-form-urlencoded
Content-Length: 53
Connection: close
Upgrade-Insecure-Requests: 1
%24A0%24=New+Name+No+Password&%24B2%24=38&%24B3%24=39 

As is visible in the request, no password is provided and the corresponding Parameter is removed entirely. Without the password parameter the authentication does not fail, but instead the server simply implies that no password was set, thus allowing the operation without any user authentication.

Because of that, unauthenticated users can access administrative functions on the system without knowledge of the administrative password, therefore bypassing the authentication. This effectively disables the access control for the entire administrative interface.

Persistent Cross-Site Scripting

The following CVE IDs were issued for this vulnerability: CVE-2020-15056 (TP-Link), CVE-2020-15060 (Lindy), CVE-2020-15064 (Digitus).

The parameter for the server name is vulnerable to a stored Cross-Site Scripting (XSS) attack. This results in the possibility for an attacker to execute JavaScript code in the context of the victims browser.

If the corresponding request is sent to the server, the server name gets embedded into the JavaScript file unfiltered and unescaped:

var myServer = new Server();
myServer.model = '';
myServer.manuf = '';
myServer.name = 'TestName';alert('Successful XSS');//';
myServer.hw = 'V. 2.000';
//myServer.tempFW = '2.255.255';
tempFWVersion = '';
myServer.fw = tempFWVersion.substring(0,1) + '.' +
tempFWVersion.substring(1,3);
myServer.mac = '34:e8:94:20:47:78';

The vulnerability allows attackers to execute JavaScript code in the context of the browser of the victim by manipulating the stored server name. Attackers in the local network could insert a custom script that is loaded each time an administrator visits the web administration interface. They can thereby gain persistent access to the web interface and attack other systems in the local network through the browser of the victim.
Normally, administrative access to the web interface would be needed to exploit this vulnerability, which would lower the impact. In combination with other vulnerabilities (like the authentication bypass) this exploit works for all users with access to the system.

Denial of Service

The following CVE IDs were issued for this vulnerability: CVE-2020-15057 (TP-Link), CVE-2020-15061 (Lindy), CVE-2020-15065 (Digitus).

Users can crash the USB network servers by sending long input values. For some lengths, the servers hang or act unexpectedly. while longer input values (e.g. 1103 characters) will crash them entirely. A reboot or sometimes reset of the device is needed to clear the issue.

After receiving too long input values the system no longer responds to network requests. The UDP broadcasts show that when setting a long server name other variables were most likely overwritten:

Wireshark packet capture screenshot of the buffer overflow from the server name
Figure 2: Buffer overflow from the server name (top: normal, bottom: after attack)

An attacker can use the buffer overflow vulnerability to impact the availability of the server. The shown behaviour indicates that the buffer overflow could also be used to execute functions or code on the system. This possibility was not investigated during the project.

Remediation

The vendors TP-Link and Lindy provided an updated firmware that fixes the vulnerabilities.

When using a device for which no patch is available, make sure that the chosen password is not reused on any other system or application.
Access to the devices could also be restricted on network level to limit the possibility of an attacker accessing the web interface or sniffing the broadcast traffic.

Responsible Disclosure Timeline

The vulnerabilities were reported to each of the vendors via e-mail. It was made clear that HiSolutions will follow defined responsible disclosure policy and aims to release information about the vulnerabilities in coordination with the vendor.
Each but one vendor reacted to the initial contact and in the following dialogue was provided with additional information on the vulnerabilities.
The vendors named in this advisory provided patches to mitigate the security issues. Hisolutions tested the patches for their effectiveness until the discovered vulnerabilities were closed and follow-up problems solved adequately.

Web vulnerabilities are coming to the Desktop – Template Injections lead to RCE in Teamwire

TL;DR (Teamwire users): A vulnerability has been found in Teamwire which can allow malicious users to execute commands on victim’s computers by sending a crafted Teamwire message. Upgrade Teamwire to the newest version as soon as possible to fix this vulnerability.

TL;DR (Technical): Template injections are a common vulnerability in web applications. If a desktop application built on a web engine is vulnerable to template injection, this can result in remote code execution on the client system.

Background

Template injection refers to a class of vulnerabilities that exploit the insecure embedding of user controllable data into template engines like AngularJS. Template engines use template files to define the design of a user interface by inserting special placeholders into a text. The template engine then dynamically replaces the placeholders with data at runtime, referred to as “rendering” the template. Many modern template engines even support carrying out complex computations inside the templates themselves. If an attacker embed one of these placeholders into a template, he can often execute functions in the underlying programming language.

To help support cross-platform compatibility, software vendors started embedding web engines into client desktop applications, thus removing the need to develop native applications for all different client platforms. NW.js is a technology that combines the browser engine WebKit with the JavaScript framework Node.js, and is often used to create cross-platform applications. This combination enables users to call Node.js functions directly from the DOM of the embedded Chromium browser.

For web applications, template injections are well known problem. Due to the increasing use of web technologies for the rapid development of client applications, this class of vulnerabilities has begun to manifest itself on the desktop too.

Teamwire is a “fast, intuitive and secure enterprise messaging app” for businesses. Teamwire clients are available for iPhone, iPad, Android, Windows Phone, Windows PC, Mac OS and Linux.

HiSolutions researchers have found two distinct template injection vulnerabilities during an internal security assessment of the Teamwire messaging platform (clients on Windows and the administrative interface), which could be used to target end users or platform administrators.

Technical Background

Teamwire is built on AngularJS. Angular implements a secure sandbox to attempt to prevent attacks even if user input is insecurely embedded in templates. As the sandbox was repeatedly bypassed, AngularJS developers decided that the effort was futile and shifted the responsibility back to  application developers. Currently, bypasses exist for all AngularJS Versions that enable an attacker to escape from the sandbox and execute arbitrary JavaScript commands.

Template injections in AngularJS can be illustrated as follows: If an attacker succeeds in inserting placeholder string, delineated with double curly brackets ( “{{…}}” ) into a template inside the application, any operations inside the brackets will be carried out when the template is rendered. In this case, inserting {{77*77}} into the name field (left) results in the product (5929) being displayed in the rendered display (right).

The expression „77*77“ evaluates to „5929“ when the template is rendered.

To bypass the sandbox in AngularJS 1.6.8, which is used by Teamwire, the following template string can be used:

{{constructor.constructor(‚###JavaScript-Code-Here###‘)()}}

Vulnerability Details

Stored XXS in Admin Web Interface – CVE-2018-17560

Users can change their displayed usernames in the Teamwire clients without any restrictions. A user could therefore change his username to include a template string:

his {{constructor.constructor(‚document.body.style.backgroundColor = „green“;‘)()}}

Our researchers found that when an administrator views the user inside the administrative web panel, the username is embedded insecurely (i.e. without encoding the placeholder to prevent execution) into the web page and the JavaScript code in the string is executed.

The example payload above only changes the background color of the HTML page, but a malicious user could insert arbitrary JavaScript code to be executed in the browser. An attacker could for example try to take over an administrator’s session or try to execute actions with admin rights in the web portal.

Attempting to delete the “malicious” user also triggers the vulnerability, as the admin must first view the user in the web interface to be able to delete them.

Desktop Client RCE – CVE-2018-17170

Another template injection was found inside the Teamwire desktop client. The vulnerable field was the name of a group chat. A malicious user must first create a chat with a crafted name including the template string. They can exploit this vulnerability to execute code on the victim’s system. If another user included in the chat writes a message to the attacker by selecting him from his contact list, the client merges the chats and the payload is executed on the victim’s system. Because the victim selects the other user from the contact list, he cannot see the manipulated chat name before the JavaScript is executed.

That only the first character of the chat names is displayed in the overview further helps to hide  malicious payloads.


Only the first part of the chat name is shown (left), hiding the malicious part.

The same code execution vulnerability is exploitable when the victim starts a chat with another user with a specially crafted username.

Because the Teamwire desktop client uses NW.js and the embedded Node.js has the ability to spawn arbitrary processes, template injection actually results in remote code execution on the client system.

This example payload opens the windows calculator on the client system:

{{constructor.constructor(„const x=require(‚child_process‘).spawn; x(‚calc.exe‘);“)()}}

The template injection can even lead to code execution on the receiving client.

Due to the internal structure of the code, the payload is executed four times when the vulnerability is triggered by sending a message.

Impact and Mitigations

The impact of the vulnerabilities is limited by the fact that a valid user account attributed to the organization is needed to perform the attack. If an attacker has obtained access to an account, no mitigation against the attack in the web interface (apart from not using it) exist. Preventing the code execution attack against the clients requires not accepting any messages from other accounts, obviating the purpose of a messaging application.

The vulnerabilities described above have been fixed in the backend version prod-2018-11-13-15-00-42  and in the desktop client version 1.9.0 released on 16.11.2018. To fully mitigate the vulnerabilities and continue the use of the product, these updates should be installed as soon as possible.

The vulnerability CVE-2018-17170 has been verified for the desktop client version 1.5.1, it affects most likely all versions prio to 1.9.0. The vulnerability CVE-2018-17560 affects all backend version prior to prod-2018-11-13-15-00-42.

Disclosure Timeline

16. October 2018 – Initial contact with the vendor

16. October 2018 – Submission of vulnerability details to the vendor

22. October 2018 – Further communication with vendor

16. November 2018 – Update released

21.  June 2019 – Public disclosure (the vendor asked for a postponed publication of the details, which we agreed on)

Credits

The vulnerabiliy was found by Julian Beier, Lars Burhop, Benjamin Braun, Viktor Schlüter and Denis Werner (HiSolutions).