Message-ID: <ZR0P278MB015336CC27C35DF01E68FA04BA129@ZR0P278MB0153.CHEP278.PROD.OUTLOOK.COM>
Date: Thu, 17 Mar 2022 16:39:01 +0000
From: Emanuel DUSS <emanuel.duss@...pass-security.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] CVE-2021-45490: Missing Certificate Verification in 3CX Client
 for Windows (legacy), Android & iOS

#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product:  3CX Client for Windows (legacy), Android & iOS
# Vendor:   3CX
# CSNC ID:  CSNC-2021-021
# CVE ID:   CVE-2021-45490
# Subject:  Missing Certificate Verification
# CWE-ID:   CWE-295 (Improper Certificate Validation)
# Severity: Medium
# Effect:   Network Traffic Decryption and Manipulation
# Author:   Emanuel Duss <emanuel.duss@...pass-security.com>
# Date:     2022-03-17
#
#############################################################

Introduction
------------

3CX is an open-platform office phone system that runs on premise on Windows or
Linux. 3CX was built for mobility, with remote work apps that offer secured
communication for the whole team. With the Android, iOS and Windows apps,
business communication is no longer tied to the office building. [1]

During a customer project, we identified a security vulnerability in the 3CX
clients for Windows (legacy), Android and iOS. These applications do not verify
the TLS certificate of the 3CX server.


Affected
--------

- All versions of the 3CX application for Windows (legacy), Android and iOS are
  affected.
- There is no fix from the vendor at the moment.
- The new Electron based 3CX Desktop App is not affected.


Description
-----------

The 3CX clients for Windows (legacy), Android, and iOS do not verify the TLS
certificate of the 3CX server.

This allows an attacker between the 3CX application and the 3CX server to split
the TLS traffic and therefore read and manipulate the transmitted data.

For example, the data required for provisioning a new device can be read every
time when the app is started. This data can then be used to provision another
app.

Thus, attackers can provision an own device and use the entire functionality of
the app. This includes:

- List companies in the phone book
- Make phone calls
- Listen to voice box
- etc.

This attack can for example be reproduced by performing an ARP spoofing attack
in the network against the target client and by using Burp Suite as a
transparent HTTP proxy.


Vulnerability Classification
----------------------------

CVSS v3.1 Metrics [2]:

- CVSS Base Score: 6.5 (Medium)
- CVSS Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N


Workaround / Fix
----------------

# 3CX Vendor

The app should correctly verify the server's certificate using the system CA
store or implement certificate pinning in the apps.

# 3CX Users

There is no security update for this vulnerability at the moment. According to
the 3CX, the vulnerability will be tackled in future redesigns of the mobile
apps.

Users of the legacy Windows client can switch to the new Electron based 3CX
Desktop App which is not affected.


Timeline
--------

2021-12-16: Vulnerability discovered
2021-12-17: Discussed vulnerability with our customer
            Asked 3CX for security contact on Twitter, community forum, support
            email and contact form.
            Got response via support mail. Security contact was dpo@....com
            Provided details
            Requested CVE ID @ MITRE
2021-12-25: Assigned CVE-2021-45490
2022-01-03: Asked vendor if they understood the vulnerability.
            Answer: Report was distributed internally.
2022-01-18: Asked vendor for any updates.
2022-02-02: Asked vendor for any updates.
2022-02-10: Asked vendor for any updates. 3CX can't tell when the issue will
            be fixed.
2022-03-11: Asked vendor for any updates. 3CX thanked for the report.
            Issues will be tackled in future redesigns of the mobile apps.
2022-03-17: Coordinated public disclosure


Acknowledgement
---------------

Thanks 3CX for the coordinated dicslosure.


References
----------

[1] https://www.3cx.com/
[2] https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N&version=3.1

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists