Hash: SHA256

                         AUSCERT Security Bulletin

               Product Security Advisory – PSA0002 – dnaLIMS
                               10 March 2017


        AusCERT Security Bulletin Summary

Product:              dnaLIMS
Operating System:     Mac OS
Impact/Access:        Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                      Access Privileged Data          -- Remote/Unauthenticated      
                      Cross-site Scripting            -- Remote with User Interaction
                      Unauthorised Access             -- Remote with User Interaction
Resolution:           Mitigation
CVE Names:            CVE-2017-6529 CVE-2017-6528 CVE-2017-6527
Member content until: Sunday, April  9 2017


        Multiple vulnerabilities have been identified in dnaLIMS from 
        "Shorebreak Security penetration testers discovered seven serious 
        vulnerabilities in the dnaLIMS web application during the course of
        a blackbox penetration test for a customer. This was by no means a 
        comprehensive review of the web application, and it should be 
        assumed that many other vulnerabilities exist in the application.
        Shorebreak notified the vendor, who appears to have no interest in 
        fixing his flawed software that is in use on the Internet at several
        other organizations." [1]


        The researcher has provided the following summary regarding the 
        "An unauthenticated attacker has the ability to execute system 
        commands in the context of the web server process, hijack active 
        user sessions, retrieve system files (including the plaintext 
        password file), and inject untrusted html or JavaScript into the 
        dnaLIMS application. An attacker could use these vulnerabilities 
        together in order to gain control of the application as well as the
        operating system hosting the dnaLIMS software. If this software is 
        being hosted publicly or in a DMZ this could act as a pivot point to
        launch further attacks or move laterally into trusted network(s). 
        Seven individual vulnerabilities were identified. The following is a
        technical description of each individual vulnerability.
        1) Improperly Protected Web Shell [CVE-2017-6526]
        dnaLIMS requires authentication to view cgi-bin/dna/sysAdmin.cgi, 
        which is a web shell included with the software running as the web 
        user. However, sending a POST request to that page bypasses 
        authentication checks, including the UID parameter within the POST 
        request. This finding requires urgent attention as it is possible 
        for any attacker on the internet to remotely control the server with
        only a trivial amount of web traffic.
        sysadmin sysadmin2
        A Metasploit module has been developed to exploit this 
        2) Unauthenticated Directory Traversal [CVE-2017-6527]
        The viewAppletFsa.cgi seqID parameter is vulnerable to a null 
        terminated directory traversal attack. This allows an 
        unauthenticated attacker to retrieve files on the operating system 
        accessible by the permissions of the web server. This page also does
        not require authentication, allowing any person on the Internet to 
        exploit this vulnerability.
        A Metasploit module has been developed to exploit this 
        Additional Information
        For more information about this type of issue, please visit the 
        following URLs:
        3) Insecure Password Storage [CVE-2017-6528]
        An option, which is most likely the default, allows the password 
        file (/home/dna/spool/.pfile) to store clear text passwords. When 
        combined with the unauthenticated directory traversal vulnerability,
        it is possible to gain the username and password for all users of 
        the software and gain complete control of the software.
        A more secure option, which was not tested, allows for the hashing 
        of passwords, which we believe uses an insecure MD5 algorithm. If 
        true, this option should be upgraded to PBKDF2 or stronger (bcrypt 
        or Argon2).
        Additional Information
        For more information about this type of issue, please visit the 
        following URLs
        4) Session Hijacking [CVE-2017-6529]
        Each user of the dnaLIMS software is assigned a unique four-digit 
        user identification number(UID) upon account creation. These numbers
        appear to be assigned sequentially. Multiple pages of the dnaLIMS 
        application require that this UID be passed as a URL parameter in 
        order to view the content of the page. Consider the following 
        The URL ‘http://<SERVER NAME 
        REDACTED>/cgi-bin/dna/seqreq2N.cgi?username=61685578,2410’ is a 
        valid URL to view the page for sequencing requests for the user with
        the UID of 2410.
        The username parameter of the URL is the mechanism for 
        authentication to the system. The first eight-digit number of the 
        username parameter appears to be a session identifier as it changes
        every time the user logs in from the password.cgi page, however this
        value is not checked by the seqreq2N.cgi page. This allows an 
        attacker to guess the four-digit UID of valid user accounts that 
        have an active session. The user with the UID of 2419 currently has
        an active session, so we can simply hijack this user’s session by 
        requesting this page and specifying the UID 2419.
        This allows an attacker to guess UID’s and hijack active user 
        Additional Information
        For more information about this type of issue, please visit the 
        following URLs:
        5) Cross-Site Scripting
        The seqID parameter of the viewAppletFsa.cgi page is vulnerable to a
        reflected cross site scripting attack via GET request as seen in the
        URL, in the example below.xss_1
        Additional Information
        For more information about this type of issue, please visit the 
        following URLs:
        6) Cross-Site Scripting
        The navUserName parameter of the seqTable*.cgi page is vulnerable to
        a reflected cross site scripting attack via POST request as seen in
        the example below. The * reflects a short name for a client, (ie 
        Shorebreak Security may be seqTableSS.cgi or seqTableshorebreak.cgi)
        and may not be vulnerable for all dnaLIMS installs.xss_2
        Additional Information
        For more information about this type of issue, please visit the 
        following URLs:
        7) Improperly Protected Content
        Many of the pages within the admin interface are not properly 
        protected from viewing by authenticated users. This can give an 
        attacker additional system information about the system, or change 
        system/software configuration.
        Software was conducted on a live production system, therefore the 
        pages themselves were tested, forms within these pages were not.
        This is also not an exhaustive list of improperly protected pages:
        cgi-bin/dna/configuration.cgi cgi-bin/dna/createCoInfo.cgi 
        cgi-bin/dna/combineAcctsN.cgi" [1]


        "Risk Mitigation
        To reduce the exposure, encourage customers to restrict access to 
        the device from authorized hosts only. Vendor Fix
        Properly protect all administrative pages to only those with 
        administrative privileges Implement a proper authentication 
        mechanism that uses cookies with session IDs per OWASP guidance: 
        Cross site scripting and directory traversal attacks are due to 
        insufficient input validation. User content should be properly 
        escaped to prevent abuse of functionality or attacks against clients
        per the OWASP XSS prevention cheat sheet: 
        Cryptographic functionality should utilize strong algorithms per the
        Our recommendation is to isolate this web application as much as 
        possible to reduce the exposure – most definitely remove it from the
        Internet." [1]


        [1] Product Security Advisory – PSA0002 – dnaLIMS

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
Comment: http://www.auscert.org.au/render.html?it=1967