Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT Security Bulletin
ASB-2017.0023
Product Security Advisory – PSA0002 – dnaLIMS
10 March 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: dnaLIMS
Operating System: Mac OS
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Access Privileged Data -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Unauthorised Access -- Remote with User Interaction
Resolution: Mitigation
CVE Names: CVE-2017-6529 CVE-2017-6528 CVE-2017-6527
CVE-2017-6526
Member content until: Sunday, April 9 2017
OVERVIEW
Multiple vulnerabilities have been identified in dnaLIMS from
dnaTools.
"Shorebreak Security penetration testers discovered seven serious
vulnerabilities in the dnaLIMS web application during the course of
a blackbox penetration test for a customer. This was by no means a
comprehensive review of the web application, and it should be
assumed that many other vulnerabilities exist in the application.
Shorebreak notified the vendor, who appears to have no interest in
fixing his flawed software that is in use on the Internet at several
other organizations." [1]
IMPACT
The researcher has provided the following summary regarding the
vulnerabilities:
"An unauthenticated attacker has the ability to execute system
commands in the context of the web server process, hijack active
user sessions, retrieve system files (including the plaintext
password file), and inject untrusted html or JavaScript into the
dnaLIMS application. An attacker could use these vulnerabilities
together in order to gain control of the application as well as the
operating system hosting the dnaLIMS software. If this software is
being hosted publicly or in a DMZ this could act as a pivot point to
launch further attacks or move laterally into trusted network(s).
Vulnerabilities
Seven individual vulnerabilities were identified. The following is a
technical description of each individual vulnerability.
1) Improperly Protected Web Shell [CVE-2017-6526]
dnaLIMS requires authentication to view cgi-bin/dna/sysAdmin.cgi,
which is a web shell included with the software running as the web
user. However, sending a POST request to that page bypasses
authentication checks, including the UID parameter within the POST
request. This finding requires urgent attention as it is possible
for any attacker on the internet to remotely control the server with
only a trivial amount of web traffic.
sysadmin sysadmin2
A Metasploit module has been developed to exploit this
vulnerability.
2) Unauthenticated Directory Traversal [CVE-2017-6527]
The viewAppletFsa.cgi seqID parameter is vulnerable to a null
terminated directory traversal attack. This allows an
unauthenticated attacker to retrieve files on the operating system
accessible by the permissions of the web server. This page also does
not require authentication, allowing any person on the Internet to
exploit this vulnerability.
seqID
A Metasploit module has been developed to exploit this
vulnerability.
Additional Information
For more information about this type of issue, please visit the
following URLs:
https://www.owasp.org/index.php/Category:Path_Traversal_Attack
3) Insecure Password Storage [CVE-2017-6528]
An option, which is most likely the default, allows the password
file (/home/dna/spool/.pfile) to store clear text passwords. When
combined with the unauthenticated directory traversal vulnerability,
it is possible to gain the username and password for all users of
the software and gain complete control of the software.
dnalims_password_file
A more secure option, which was not tested, allows for the hashing
of passwords, which we believe uses an insecure MD5 algorithm. If
true, this option should be upgraded to PBKDF2 or stronger (bcrypt
or Argon2).
Additional Information
For more information about this type of issue, please visit the
following URLs
https://www.owasp.org/index.php/Password_Plaintext_Storage
4) Session Hijacking [CVE-2017-6529]
Each user of the dnaLIMS software is assigned a unique four-digit
user identification number(UID) upon account creation. These numbers
appear to be assigned sequentially. Multiple pages of the dnaLIMS
application require that this UID be passed as a URL parameter in
order to view the content of the page. Consider the following
example:
The URL ‘http://<SERVER NAME
REDACTED>/cgi-bin/dna/seqreq2N.cgi?username=61685578,2410’ is a
valid URL to view the page for sequencing requests for the user with
the UID of 2410.
seq_req
The username parameter of the URL is the mechanism for
authentication to the system. The first eight-digit number of the
username parameter appears to be a session identifier as it changes
every time the user logs in from the password.cgi page, however this
value is not checked by the seqreq2N.cgi page. This allows an
attacker to guess the four-digit UID of valid user accounts that
have an active session. The user with the UID of 2419 currently has
an active session, so we can simply hijack this user’s session by
requesting this page and specifying the UID 2419.
seq_req2
This allows an attacker to guess UID’s and hijack active user
sessions.
Additional Information
For more information about this type of issue, please visit the
following URLs:
https://www.owasp.org/index.php/Session_Prediction
https://www.owasp.org/index.php/Session_hijacking_attack
https://www.owasp.org/index.php/Session_fixation
5) Cross-Site Scripting
The seqID parameter of the viewAppletFsa.cgi page is vulnerable to a
reflected cross site scripting attack via GET request as seen in the
URL, in the example below.xss_1
Additional Information
For more information about this type of issue, please visit the
following URLs:
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
6) Cross-Site Scripting
The navUserName parameter of the seqTable*.cgi page is vulnerable to
a reflected cross site scripting attack via POST request as seen in
the example below. The * reflects a short name for a client, (ie
Shorebreak Security may be seqTableSS.cgi or seqTableshorebreak.cgi)
and may not be vulnerable for all dnaLIMS installs.xss_2
Additional Information
For more information about this type of issue, please visit the
following URLs:
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
7) Improperly Protected Content
Many of the pages within the admin interface are not properly
protected from viewing by authenticated users. This can give an
attacker additional system information about the system, or change
system/software configuration.
Software was conducted on a live production system, therefore the
pages themselves were tested, forms within these pages were not.
This is also not an exhaustive list of improperly protected pages:
cgi-bin/dna/configuration.cgi cgi-bin/dna/createCoInfo.cgi
cgi-bin/dna/configSystem.cgi
cgi-bin/dna/combineAcctsN.cgi" [1]
MITIGATION
"Risk Mitigation
To reduce the exposure, encourage customers to restrict access to
the device from authorized hosts only. Vendor Fix
Properly protect all administrative pages to only those with
administrative privileges Implement a proper authentication
mechanism that uses cookies with session IDs per OWASP guidance:
https://www.owasp.org/index.php/Session_Management_Cheat_Sheet
Cross site scripting and directory traversal attacks are due to
insufficient input validation. User content should be properly
escaped to prevent abuse of functionality or attacks against clients
per the OWASP XSS prevention cheat sheet:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
Cryptographic functionality should utilize strong algorithms per the
OWASPguidance:
https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet#Secure_Cryptographic_Storage_Design
Our recommendation is to isolate this web application as much as
possible to reduce the exposure – most definitely remove it from the
Internet." [1]
REFERENCES
[1] Product Security Advisory – PSA0002 – dnaLIMS
https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/
AusCERT has made every effort to ensure that the information contained
in this document is accurate. However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWMIgeIx+lLeg9Ub1AQhJnQ//TE7alZwAffZ1ORMbTPXLMImV9vYifORF
Y3U3lEYbyqLVkl3Y/W7lRhGtHxurYjL9Jmj5SVQJw2FaUumZi3fG+ne3/VCi3Yio
vGxLyXG7+e00mRktuGlx5ciHwRznJxIGlcw5BCnZTtosrIRS61oEcjIcHY4G7ADA
C0cWPEr6NW0zgJbAIkoJy1Swu86SR+7Cnw03g3q4C7KO24aQWpV4xDGVofw99WIW
nvbcdRQyhmvAJJNIzODHVsnef8/65yBvUWoFhjWAwdHMwA2XIDpv1qounVAG4hUm
GcXeQdnFiMbA/9BD+RZCCc4WG2nxV9pCfN369oO+0cNVzC8hOKoW24w8HB5OhuFK
spIkZrHD/7OrIdQtDGwbfL2daWnKEXwwk7nB9PABNy0VA8YisE5SML8bHnPtKyIU
UyB9PQfUdfdOdE/OreFpz4oHplRzftAt4wWzTYdAFReYBSUNZA+YF7Jl5qzOBzag
aV7uhDubkgOl7q3u0AxS5gr98U3gYfvgmkiMDoCXohZHffkd1gfgaXHEPPzyEZzY
cu6P8TIk4bN/2vT0ipDEEUoRcK5rIKvbY6okjuXNQrYkVJ9w/bYLYSR7xM6bvHvZ
nSq0byghqrWyjHDz6HnUHG3KpZkktzZ5x1tXZDfOubLBRhRfWR9t/u6phHVAsZEb
0pk/l7oxvOs=
=1nZy
-----END PGP SIGNATURE-----