CVE-2017-9377

Publish date

September 2017

Identifier

CVE-2017-9377

Manufacturer

Barco

Product

ClickShare Base Units

Patched

ClickShare CSM-1 Base Unit Firmware v1.7.0.3
https://www.barco.com/en/Support/software/R33050037 

ClickShare CSC-1 Base Unit Firmware v1.10.0.10
https://www.barco.com/en/support/software/R33050020 

Authors

Claudio Moletta

Description

The Barco ClickShare Base Unit was found to be vulnerable to multiple command injection vulnerabilities in the web API interface.

This may allow an attacker to run commands on the remote system with the privileges of root user. 

When exploiting this issue, Context was able to create an additional local user with maximum privileges, use the SSH service for a full and reliable access to the device and further compromise the ClickShare USB Buttons.

The affected versions are:

• ClickShare CSM-1 Base Unit Firmware older than v1.7.0.3
• ClickShare CSC-1 Base Unit Firmware older than v1.10.0.10
   

Details of Exploitation

The vulnerable code is within a function that manages the PUT HTTP requests. An attacker would need valid credentials to perform this attack, however there is a default user account called “integrator” with password “integrator”. 

As shown in the image below, input from the user is used within an OS system command without being sanitised.

Code execution can be obtained by modifying and then running the following command:

curl -v -i --user integrator:integrator --digest -X PUT 
http://1.1.1.1:4000/v1.0/OnScreenText/MeetingRoomName --data 
"value=TESTDEVICE'; INSERT COMMAND HERE; #"

To gain a shell on the remote system, the security team used the following technique:

• Create a custom reverse PHP shell or using publicly available tools (metasploit or fuzzdb)
• Start a webserver on the attacker’s machine
• Download the PHP shell on the remote system using curl (using the command injection shown above)
• Start the listener on the attacker’s machine
• Run the PHP reverse shell (using the command injection shown above)

The screenshot below shows the shell obtained by following the above steps: