The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230).
Attack Complexity
Low
AC
The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Privileges Required
None
PR
The attacker is unauthenticated prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction
None
UI
The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges
Scope
Unchanged
S
An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances.
Confidentiality
High
C
There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data.
Integrity
High
I
There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system.
Availability
High
A
There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Below is a copy: Sangoma SBC 2.3.23-119-GA Authentication Bypass
## Introduction
### Description
A remotely exploitable vulnerability exists in the 2.3.23-119-GA version of Sangoma SBC that would allow an unauthenticated user to bypass authentication and login as a non-existen user but with complete access to the dashboard including additional privileged user creation capabilities.
### Vulnerability Type
- Argument Injection or Modification (https://cwe.mitre.org/data/definitions/88.html)
## Product Overview
A Sangoma SBC protects both your data and voice network and is designed to handle every aspect of phone calls that travel over the internet (or voice-over-ip phone calls).
## Background
The Sangoma SBC web application heavily relies on the python script `/usr/local/sng/bin/sng-user-mgmt` for various user operations including authenticating the user that is supplied on the login screen of the web application.
When a username and password is provided to the application, it is processed by `/var/webconfig/gui/Webconfig.inc.php` which uses the `Execute` function from `/var/webconfig/api/ShellExec.class.php` to pass the credentials to `/usr/local/sng/bin/sng-user-mgmt` as arguments. The `Execute` function applies the `escapeshellcmd` function to convert any shell characters as literals, however there is no verification that the variables passed do not contain strings that can be interpreted as additional arguments to `/usr/local/sng/bin/sng-user-mgmt`.
The `/var/webconfig/gui/Webconfig.inc.php` calls the `WebSetSessionAuthenticated()` function if the return value of the `$shell->Execute($cmd, $args, true, array('log','escape'=>true))` is 0 as shown below.
```
$rc = $shell->Execute($cmd, $args, true, array('log','escape'=>true));
if(0 == $rc){
...
...
WebSetSessionAuthenticated();
}else{
Logger::SysLog("webconfig", "login - ${username} login failed");
...
...
}
```
The Operating System returns a 0 if the `/usr/local/sng/bin/sng-user-mgmt` program exits successfully.
This is true for all arguments of the program unless an explicit status code is sent back to the Operating System. Invoking the help menu, for example is also a successful execution of the program as can be seen from the below two commands
```
# /usr/local/sng/bin/sng-user-mgmt -h
Usage: sng-user-mgmt [options] arg
Options:
-h, --help show this help message and exit
-a ACTION, --action=ACTION
Action to perform.
-u USER, --user=USER User Name
-s, --syslog Log to syslog
-p PASSWORD, --password=PASSWORD
Password
-f FORCE, --force=FORCE
Force to remove a user
-n NAME, --name=NAME User Name
-e ENCRYPTEDPASSWORD, --encrypted-password=ENCRYPTEDPASSWORD
Encrypted Password
-d HASHEDPASSWORD, --hashed-password=HASHEDPASSWORD
Hashed Password
-l ACCESS, --access=ACCESS
Toggle user login access, ie. Enable / Disable
-o, --sudoer Add to sudoer list
root@sangoma-test ~
# echo $?
0
```
As the status code is 0, the check in `/var/webconfig/gui/Webconfig.inc.php` passes and a new user session is created.
Passing additional arguments through the username field that would cause the `sng-user-mgmt` to return a 0 would result in a session being created without any valid credentials being supplied. This session provides complete access to the application, including the ability to create additional sudo privilged users.
## Proof of Concept Exploit
1. Pass a username with the value `adam -h`
2. The password field can be set to anything as this will be ignored
3. Click login
4. The `-h` invokes the help menu for `sng-user-mgmt`, returning a 0 and causing `Webconfig.inc.php` to create a new session.
5. You are now logged in
## Versions Tested
- 2.3.23-119-GA
## Vendor Response
This issue has been responsibly disclosed to the vendor for which a patch has been released in version 2.3.24
https://wiki.sangoma.com/display/SBC/SBC+Downloads
## Credits
Appsecco Security Team
http://www.appsecco.com
## Timeline
18th May 2019: Discovered and reported to vendor
21st May 2019: Vendor confirmation
23rd July 2019: Fixed version (2.3.24) released
## Reference
- [https://www.sangoma.com/products/sbc/](https://www.sangoma.com/products/sbc/)
Riyaz Walikar
+91 9886042242
<http://www.appsecco.com/>www.appsecco.com<http://www.appsecco.com/>
Appsecco is a registered trademark of Appsecco Ltd. Appsecco Limited: Registration Number: 9500721. Registered office: Kemp House, 152 to 160 City Road, London EC1V 2NX, United Kingdom. This email message is intended for the named recipient only. It may be privileged and/or confidential. If you are not the named recipient of this email please notify us immediately and do not copy it or use it for any purpose, nor disclose its contents to any other person.
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum