CVE-2020-16147 - Telmat - Unauthenticated root RCE

• Title : Telmat - Unauthenticated root Remote Code Execution
• Author : @podalirius_
• CVSS : 10 (Critical)
• CVSS Vector : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

An unauthenticated code injection on the login page of Telmat AccessLog, Gît@Box and Educ@Box with software version <= 6.0 (TAL_20180415) allows Remote Code Execution (RCE) as root.

Affected products

Exploitation

This vulnerability was tested on a Telmat AccessLog 6.0 (TAL_20180415):

During a pentest, I found the login page of the AccessLog. I tried to perform SQL injections on the login and password fields to bypass the authentication mechanism. I noticed that the login page had an unexpected behavior when the password contained a single quote '. The login page was replaced by a progress bar for about 10 to 15 minutes for all clients. (This could lead to a denial of service)

Using the Authenticated RCE I found earlier, I extracted the contents of the login page /authent.php. After analyzing how the authentication mechanism works, I found this interesting part (lines 56 to 72 in file /authent.php) :

if(isset($cpasswd)) {
  unset($res);
  if(strstr($cpasswd,"$apr1$")) {
    $dpsd = explode("$",$cpasswd);
    $salt = $dpsd[2];
    $cmd = "/usr/bin/openssl passwd -apr1 -salt '" . $salt . "' '" . $_POST['whois_pas'] . "'";
    exec($cmd,$res,$cr);
    $ccpasswd = trim($res[0]);
  } else {
    $salt = mb_substr($cpasswd,0,2);
    $cmd = "/usr/bin/openssl passwd -crypt -salt '" . $salt . "' '" . $_POST['whois_pas'] . "'";
    exec($cmd,$res,$cr);
    $ccpasswd = trim($res[0]);
  }
  // ...
}

We can see that the content of the whois_pas variable in the POST request is appended directly to the command line, unfiltered. We now only need to close the single quote ' and add a semicolon ; and we can inject shell commands directly. At the end of our injection, we add a # in order to comment out the rest of the command line.

Proof of concept reverse shell :

In order to get a reverse shell I used the following payload :

We now have an unauthenticated RCE, furthermore also running as root :

Mitigations

In order to patch this vulnerability you need to update your firmware to the latest version.