Message-ID: <f3c6b03099184178aaddeba1dbb57e86@sec-consult.com>
Date: Mon, 5 Oct 2020 15:07:22 +0000
From: SEC Consult Vulnerability Lab <research@...-consult.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] SEC Consult SA-20201005-0 :: Multiple Critical Vulnerabilities
 in RocketLinx Series

SEC Consult Vulnerability Lab Security Advisory < 20201005-0 >
=======================================================================
              title: Multiple Critical Vulnerabilities
            product: RocketLinx Series
 vulnerable version: See "Vulnerable / tested versions"
      fixed version: 1.3.1 (partial fix)
         CVE number: CVE-2020-12500, CVE-2020-12501, CVE-2020-12502,
                     CVE-2020-12503, CVE-2020-12504
             impact: Critical
           homepage: https://www.pepperl-fuchs.com
              found: 2020-04-06
                 by: T. Weber (Office Vienna)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult
                     Europe | Asia | North America

                     https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"Automation is our world. Perfect application solutions are our goal.

In 1945, Walter Pepperl and Ludwig Fuchs founded a small radio workshop in
Mannheim, Germany, based on the principles of inventiveness, entrepreneurial
foresight, and self-reliance. The experience they acquired was transformed into
new ideas, and they continued to enjoy developing products for customers. The
eventual result was the invention of the proximity switch. This innovation
represented the starting point of the company's success story.

Today, Pepperl+Fuchs is known by customers around the world as a pioneer and an
innovator in electrical explosion protection and sensor technology. Our main
focus is always on your individual requirements: With a passion for automation
and groundbreaking technology, we are committed to working in partnership with
you now and in the future. We understand the demands of your markets,
developing specific solutions, and integrating them into your processes."

Source: https://www.pepperl-fuchs.com/usa/en/25.htm


Business recommendation:
------------------------
SEC Consult recommends to update the devices to the newest firmware (1.3.1),
which is available for the following devices:
 * ICRL-M-8RJ45/4SFP-G-DIN
 * ICRL-M-16RJ45/4CP-G-DIN
According to the vendor, this update only resolves issue 5). The other devices
and vulnerabilities can be mitigated by the measures described by Pepperl+Fuchs
in their security advisory, see "Workaround".


Vulnerability overview/description:
-----------------------------------
As the vulnerabilities are completely intersecting with the vulnerabilities of
the actual OEM, which did not respond at the time of disclosure, some details
were removed from "Vulnerability overview/description".

1) Unauthenticated Device Administration (CVE-2020-12500)
Pepperl+Fuchs Comtrol devices can be managed via a Windows client program
called "Jet View".
This program communicates in plaintext via UDP. All messages that are sent to
the device are broadcasted in the whole subnet and the answers from the devices
are send back via broadcast too.

Actions that can be done via this daemon, listening on UDP port 5010, are:
 * Modifying networking settings (IP, netmask, gateway)
 * Initiating self tests and blink LEDs on the device
 * Triggering download and upload of configuration files (via TFTP)
 * Triggering uploads of new firmware and bootloader files (via TFTP)

The device can also be bricked via this daemon so that it is necessary to press
the reset button and re-configure the settings. This was tested on a physical
device.

2) Backdoor Accounts (CVE-2020-12501)
Multiple different backdoor accounts were found during quick security checks
of different firmware files. Some accounts were just read-only users according
to the vendor.

3) Cross-Site Request Forgery (CSRF) (CVE-2020-12502)
The web interface that is used to set all configurations is vulnerable to
cross-site request forgery attacks. An attacker can change settings by luring
the victim to a malicious website.

4) Multiple Authenticated Command Injections (CVE-2020-12503)
Multiple command injection vulnerabilities were found on the RocketLinx devices
and devices using the same firmware.

Due to the lack of CSRF protection, an attacker can execute arbitrary commands
on the device by luring the victim to click on a malicious link.

5) Arbitrary Unauthenticated TFTP Actions (CVE-2020-12504)
A TFTP service is present on a broad range of devices for firmware-,
bootloader-, and configuration-uploads/downloads. This TFTP server can be
abused to read all files from the system as the daemon runs as root which
results in a password hash exposure via the file /etc/passwd. Write access
is restricted to certain files (configuration, certificates, boot loader,
firmware upgrade) though.

By uploading malicious Quagga config-files an attacker can modify e.g.
IP-settings of the device. Malicious firmware and bootloader uploads are
possible too.


Proof of concept:
-----------------
As the vulnerabilities are completely intersecting with the vulnerabilities of
the actual OEM, which did not respond at the time of disclosure, the complete
section "Proof of concept" was removed from this advisory.


Vulnerable / tested versions:
-----------------------------
Comtrol ES7510                 / <=1.4
Comtrol ES7510-XT              / <=2.1b
Comtrol ES7506                 / <=2.1b
Comtrol ES8509-XT              / <=2.1a
Comtrol ES8510                 / <=3.1a
Comtrol ES8510-XT              / <=3.1a
Comtrol ES9528-XTv2            / <=2.1a

The following devices are just prone to 3), 4) and 5):
ICRL-M-8RJ45/4SFP-G-DIN        / <=1.2.3
ICRL-M-ICRL-M-16RJ45/4CP-G-DIN / <=1.2.3


Vendor contact timeline:
------------------------
2020-04-14: Contacting CERT@VDE through info@...t.vde.com and requested support
            for the disclosure process due to the involvement of multiple ven-
            dors.
2020-04-15: Security contact responded, that the products were developed by
            <OEM-name redacted>.
2020-04-30: Security contact informed us, that some vulnerabilities were con-
            firmed by Pepperl+Fuchs.
2020-07-30: Call with Pepperl+Fuchs contact.
2020-07-31: Meeting with Pepperl+Fuchs technicians regarding vulnerabilities.
2020-09-29: Call with Pepperl+Fuchs and CERT@VDE regarding status. Set release
            date to 2020-10-05.
2020-10-05: Coordinated release of advisory.


Solution:
---------
Upgrade to firmware version 1.3.1 for ICRL-M devices for a partial solution.


Workaround:
-----------
According to Pepperl+Fuchs, the following two mitigation steps should be taken:

For vulnerability CVE-2020-12502 "Cross-Site Request Forgery (CSRF)" and CVE-
2020-12503 "Multiple Authenticated Command Injections":

An external protective measure is required.

1) Traffic from untrusted networks to the device should be blocked by a fire-
wall. Especially traffic targeting the administration webpage.

2) Administrator and user access should be protected by a secure password and
only be available to a very limited group of people.

For vulnerability CVE-2020-12504 "Active TFTP-Service":
Step 1) Update following products to the respective Firmware Version:
ICRL-M-8RJ45/4SFP-G-DIN 1.3.1
ICRL-M-16RJ45/4CP-G-DIN 1.3.1

Step 2) Deactivate TFTP-Service"

Pepperl+Fuchs advisory page:
https://www.pepperl-fuchs.com/germany/de/29079.htm


Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/contact/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF T. Weber / @2020

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists