Message-ID: <4a656aba-afa3-a5b6-d7b4-3312d4713bb3@sec-consult.com>
Date: Tue, 7 Jun 2022 07:33:57 +0000
From: "SEC Consult Vulnerability Lab,
 Research via Fulldisclosure" <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] SEC Consult SA-20220607-0 :: Multiple Vulnerabilities in
 Infiray IRAY-A8Z3 thermal camera

SEC Consult Vulnerability Lab Security Advisory < 20220607-0 >
=======================================================================
               title: Multiple Vulnerabilities
             product: Infiray IRAY-A8Z3 thermal camera
  vulnerable version: V1.0.957
       fixed version: None
          CVE number: CVE-2022-31208, CVE-2022-31209, CVE-2022-31210,
                      CVE-2022-31211
              impact: Critical
            homepage: http://www.infiray.com/
               found: 2021-02
                  by: S. Robertz (Office Vienna)
                      F. Lienhart
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult, an Atos company
                      Europe | Asia | North America

                      https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"IRay Technology Co., Ltd. is a wholly-owned subsidiary of Raytron Technology
Co., Ltd. (SSE: 688002). As a high-tech enterprise, IRay Technology develops
and manufactures infrared FPA detectors, thermal imaging modules, and other
products, with completely independent intellectual property rights. We are
committed to providing global customers with professional thermal imaging
products and solutions. The main products include IRFPA detectors, thermal
imaging cores, and terminal products for application."

Source: http://www.infiray.com/about.html


Business recommendation:
------------------------
The vendor was unresponsive during the disclosure process. Hence it is unclear
whether patches are available. Customers are urged to approach their vendor
contact and request security reviews and updates.

SEC Consult recommends to perform a thorough security review of these
products conducted by security professionals to identify and resolve all
security issues.


Vulnerability overview/description:
-----------------------------------
1) Hardcoded Web Credentials (CVE-2022-31210)
The binary file "/usr/local/sbin/webproject/set_param.cgi" contains hardcoded
credentials to the web application. As these accounts cannot be deactivated
or change their passwords, they are considered to be backdoor accounts.

2) Authenticated Remote Code Execution (CVE-2022-31208)
The webserver contains an endpoint that can execute arbitrary commands by
manipulating the "cmd_string" URL parameter. The user can login using one
of the backdoor accounts from issue 1.

3) Potential Buffer Overflow (CVE-2022-31209)
The firmware contains a potential buffer overflow by calling strcpy() without
checking the string length beforehand.

4) Telnet Root Shell without Password (CVE-2022-31211)
The camera offers a shell through a telnet connection. The root user does not
require a password per default. Thus, anyone on the local network can
execute arbitrary commands as root on the camera.

5) Multiple Outdated Software Components
Multiple outdated software components containing vulnerabilities were found by
the IoT Inspector (ONEKEY) firmware analysis platform.


Proof of concept:
-----------------
1) Hardcoded Web Credentials (CVE-2022-31210)
The following cgi program will be executed during the login process:

http://<my_ip>:8080/set_param.cgi?&group_tag=hash_param_bridge
&set_cmd=loading&length=35&name=<user>&password=<password>&access=0
&0.3543773172371312

The following de-compilation shows the code flow with the hardcoded passwords:
-------------------------------------------------------------------------------
[ PoC removed ]
-------------------------------------------------------------------------------
The authentication works by comparing the URL supplied username with the string
"[removed]". Afterwards it will compare the password parameter to "[removed]" as well. If both
string parameters match, a message will be removed from the messaging queue.
Otherwise the function will just return. The same comparison holds for the admin account.

Furthermore, string comparisons are made without checking the case. Hence,
drastically improving the chances of brute-force attacks.


2) Authenticated Remote Code Execution (CVE-2022-31208)
The web application offers an option to view the device log. Opening following URL while
logged in as admin (e.g. with hardcoded password from section 1) will trigger the request:

http://<my_ip>:8080/cmd.cgi?cmd_tag=cmd_passthrough&cmd_string=[removed]

By changing the "cmd_string" parameter, arbitrary commands can be executed with
the rights of the webserver (www-data). The de-compiled code can be seen in following
snippet:
-------------------------------------------------------------------------------
[ PoC removed ]
-------------------------------------------------------------------------------
The "cmd_string" parameter is directly passed into popen() and hence executed.


3) Potential Buffer-Overflow (CVE-2022-31209)
The firmware contains a potential buffer overflow vulnerability:
-------------------------------------------------------------------------------
[ PoC removed ]
-------------------------------------------------------------------------------
A pointer to the "next_url" parameter is supplied. A buffer of 64 bytes is
allocated and the parameter value copied to it without checking the string
length. Hence, a "next_url" parameter with more than 64 bytes could be
supplied in order to overflow the buffer.
Please note that this vulnerability is only based on firmware analysis and thus
was not tested in a live scenario.


4) Telnet Root Shell without Password (CVE-2022-31211)
The camera has a telnetd server running on port 23 per default. The root
password is empty. If the telnet port is exposed to the internet, an attacker
could easily connect to the device and gain root access. The telnet server
cannot be deactivated and the root password cannot be changed through the
web interface.


5) Multiple Outdated Software Components
IoT Inspector (ONEKEY) recognized multiple outdated software components
with known vulnerabilities:

BusyBox 1.25.0:                                  6 CVEs
curl 7.54.0:                                    13 CVEs
Dnsmasq 2.76:                                    9 CVEs
lighttpd 1.4.41:                                 2 CVEs
Linux Kernel 3.10.104:                        1004 CVEs
hostapd 2.5:                                    22 CVEs
wpa_supplicant 2.5-devel_rtw_r17190.20160415:   12 CVEs


Vulnerable / tested versions:
-----------------------------
The following product/firmware version has been tested:
* Infiray IRAY-A8Z3 V1.0.957

It has to be assumed that further products or firmware versions are affected as well.


Vendor contact timeline:
------------------------
2021-02-24: Contacting vendor through email address found on their website
             (sales@...iray.com)
2021-03-11: Contacted vendor again through sales@...iray.com
2021-04-12: Contacting vendor through sales@...iray.com and InfiRay.CS@...ytek.com
2021-04-12: Response from Sales Director, does not understand what to do with the information
2021-04-12: Requesting a contact to the product owner or developer
2021-04-13: Sending unencrypted security advisory to two provided email addresses.
2021-04-29: Requesting status from vendor, no reply.
2022-04-05: Requested status from vendor, no reply.
2022-06-07: Release of security advisory.


Solution:
---------
The vendor was unresponsive during the disclosure process. Hence it is unclear
whether patches are available. Customers are urged to approach their vendor
contact and request security reviews and updates.


Workaround:
-----------
None


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult, an Atos company
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos company. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult


EOF S. Robertz, F. Lienhart / @2022
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists