-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2023-019 Product: SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway Manufacturer: Patton LLC Affected Version(s): <= 3.21.2-23021 Tested Version(s): 2.21.1-22041, 3.21.2-23021, 3.22.0-23083 Vulnerability Type: OS Command Injection (CWE-78) Vulnerability Type: Improper Access Control (CWE-284) Risk Level: High Solution Status: Open Manufacturer Notification: 2023-07-05 Public Disclosure: 2023-08-28 CVE Reference: CVE-2023-41109 Author of Advisory: Maurizio Ruchay, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: SmartNode SN200 is a VoIP appliance which is manufactured and distributed by Patton LLC. The manufacturer describes the product as follows (see [1]): "The SmartNode 200 Series of VoIP Analog Telephone Adapter and VoIP Phone Adapter Gateways support up to four telephone connections. VoIP Analog Phone Adapter integrates legacy Phones and Fax machines into a UCC Environment. High-quality voice and reliable fax over any IP network. All-IP does not end when analog terminals have to be integrated. Security and quality guaranteed." Due to an error in the authorization mechanism and improper input validation, the device allows unauthenticated adversaries to execute OS commands via the web interface. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: SySS GmbH found an unauthenticated OS command injection vulnerability in SmartNode 200 (SN200) devices. The SN200 devices offer a "Network Diagnostic Commands" feature to administrative users. This feature is designed to execute network diagnostic commands like ping. However, as SySS GmbH discovered, the feature can be used to execute arbitrary system commands. Furthermore, a flaw in the authorization mechanism was found. This issue allows unauthenticated adversaries to execute system commands via the affected feature. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The following HTTP request shows how the system command "id" is executed on the device: === POST /rest/xxxxxxxxxxxxxxx/xxxxxxx?executeAsync HTTP/1.1 Cookie: AuthToken=; AuthGroup=superuser; UserName=admin [... shortened ...] Connection: close {"cmd":"/usr/bin/id","arguments":[]} === The following output from the web interface shows that the command has been executed: === *** Command started *** [... shortened ...] uid=0(root) gid=0(root) PING 127.0.0.1 (127.0.0.1): 56 data bytes 64 bytes from 127.0.0.1: seq=0 ttl=64 time=1.025 ms 64 bytes from 127.0.0.1: seq=1 ttl=64 time=1.781 ms *** Command completed *** === Especially noteworthy is that an empty cookie "AuthToken" can be used in order to bypass the authorization checks. Since the vulnerability is still active, parts of the PoC have been redacted. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: A patch for this issue is not yet available. Therefore, it is recommended to disable the vulnerable "Network Diagnostic Commands" feature if possible. Furthermore, it is advised to block network access to the HTTP interface either on the device directly or via firewall. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2023-06-28: Vulnerability discovered 2023-07-05: Vulnerability reported to manufacturer 2023-08-28: Public disclosure of vulnerability 2023-10-13: Vulnerability confirmation on the newly released update 3.22.0-23083 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for SmartNode SN200 https://www.patton.com/voip-gateway/sn200/ [2] OWASP OS Command Injection Defense Cheat Sheet https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] SySS Security Advisory SYSS-2023-019 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-019.txt ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Maurizio Ruchay of SySS GmbH. E-Mail: maurizio.ruchay@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Maurizio_Ruchay.asc Key ID: 0xEDA7235FA5478A8C Key Fingerprint: 9AA6 D02F C74F 3EDE C1CE AE51 EDA7 235F A547 8A8C ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: https://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEmqbQL8dPPt7Bzq5R7acjX6VHiowFAmUpCQMACgkQ7acjX6VH iow0cQ/7Bun84Ilirdj5OnriQtkaSU5zuEGRK/PJ4UsDm03mj1tqN8dLIACtFPoj 1Q6dVW3lLCQfRRjy0ffXrzL0z5C+n/VO9NW9KAgzfcbIYabjTA4DypyZjt+kcBbm I1PSIutzy/1o1boP0XjF/PS3rFpmDS9jRRg1EWhXNMiR/C4NxJMwqXFuiOkqdqFg bJC5dvYvse8344OvmOaqgjzrrOlk0OGEfgvSm0fjMRi11dpQ8cBWbty7q5a5Duig OZCOyVN/JaXUc5IL6w9BeluNEVwMtlstZPcKzk8lQdb8n6SvE8esyUgdlFLI7Av2 3sHxQsAff3470vjV2Ix+yYsxN9mbdFFh0A0ekr0nVmaXU+6/gguGuZxp28tHAiF5 5a0IcMVJWv2M1mr2tZNUtlRHOhpEIa8Pjy/JmAjM1gTMtLmIvGd5BbE3jZ7n0nuI 4jBge/Ox4yrIbCHci6YOEtqy8d9vQVimPEdAbAgVZSqMnfAoziSu2ZrSMqGVcP5x oyl3mbEvIScDT7C9JP4KOi50IDxVFK/zK6HsXF0yqTYRDMah6QFZcJ1CC+3LZAcn WuysocN4O4JdoDQ2TN/Ib1vX1HlUEFfeHQY+weuExyi1+MZyDaF0LOyD+qdIpe+U 4JymVJLoAyz+mQi0LEnQ7CodU4S7Oq1UlElwQZWrs7C1YD3++vA= =Eqnd -----END PGP SIGNATURE-----