Ubiquiti UniFi Video 3.7.3 (Windows) Local Privilege Escalation
Posted on 24 December 2017
RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Ubiquiti UniFi Video (Windows) Vendor URL: https://www.ubnt.com Type: Improper Handling of Insufficient Permissions or Privileges [CWE-280] Date found: 2016-05-24 Date published: 2017-12-20 CVSSv3 Score: 7.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) CVE: CVE-2016-6914 2. CREDITS ========== This vulnerability was discovered and researched by Julien Ahrens from RCE Security. 3. VERSIONS AFFECTED ==================== UniFi Video 3.7.3 (Windows), UniFi Video 3.7.0 (Windows), UniFi Video 3.2.2 (Windows), older versions may be affected too. 4. INTRODUCTION =============== UniFi Video is a powerful and flexible, integrated IP video management surveillance system designed to work with Ubiquitias UniFi Video Camera product line. UniFi Video has an intuitive, configurable, and featureapacked user interface with advanced features such as motion detection, autoadiscovery, user-level security, storage management, reporting, and mobile device support. (from the vendor's homepage) 5. VULNERABILITY DETAILS ======================== Ubiquiti UniFi Video for Windows is installed to "C:ProgramDataunifi-video" by default and is also shipped with a service called "Ubiquiti UniFi Video". Its executable "avService.exe" is placed in the same directory and also runs under the NT AUTHORITY/SYSTEM account. However the default permissions on the "C:ProgramDataunifi-video" folder are inherited from "C:ProgramData" and are not explicitly overridden, which allows all users, even unprivileged ones, to append and write files to the application directory: c:ProgramData>icacls unifi-video unifi-video NT AUTHORITYSYSTEM:(I)(OI)(CI)(F) BUILTINAdministrators:(I)(OI)(CI)(F) CREATOR OWNER:(I)(OI)(CI)(IO)(F) BUILTINUsers:(I)(OI)(CI)(RX) BUILTINUsers:(I)(CI)(WD,AD,WEA,WA) Upon start and stop of the service, it tries to load and execute the file at "C:ProgramDataunifi-video askkill.exe". However this file does not exist in the application directory by default at all. By copying an arbitrary "taskkill.exe" to "C:ProgramDataunifi-video" as an unprivileged user, it is therefore possible to escalate privileges and execute arbitrary code as NT AUTHORITY/SYSTEM. 6. RISK ======= To successfully exploit this vulnerability, an attacker must already have access to a system running a vulnerable installation of UniFi video using a low-privileged user account (i.e. through a password compromise). The vulnerability allows local attackers to escalate privileges and execute arbitrary code as NT AUTHORITY/SYSTEM, which basically means a complete loss of the system's confidentiality, integrity as well as availability. 7. SOLUTION =========== Update to v3.8.0 8. REPORT TIMELINE ================== 2016-05-24: Discovery of the vulnerability 2016-05-24: Reported to vendor via HackerOne (#140793) 2016-05-24: Vendor acknowledges the vulnerability 2016-08-22: Request for status update 2016-08-22: Vendor states that there is no update so far 2016-08-23: MITRE assigns CVE-2016-6914 2016-11-08: Request for status update 2016-11-08: Vendor states that there is no update so far 2016-12-08: Request for status update 2016-12-08: Vendor states that project team is working on it 2017-02-23: Request for status update 2017-03-23: No response from vendor 2017-03-23: Request for status update 2017-03-23: Vendor states that fix is scheduled for v3.7.0 2017-05-23: v3.7.0 was released, but vulnerability is still exploitable, vendor notified again 2017-06-07: Vendor states that fix is actually delayed 2017-08-26: Vendor provides beta versions of 3.7.3 and 3.8.0-beta3, which should fix the issue 2017-08-31: While v3.7.3 is still vulnerable, the issue was fixed in 3.8.0-beta3 2017-09-18: v3.8.0 released publicly 2017-12-20: Public disclosure 9. REFERENCES ============= http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2016-6914 https://hackerone.com/reports/140793
