Penetration Test Report (Enable Security): opensips audit technical report full

ConfidentialDocument
OpenSIPS security audit
Technical Report (full version)
Preparedby: SandroGauci,SeniorConsultantandDirector,EnableSecurityGmbH
Preparedfor: Bogdan-AndreiIancu,FounderandDeveloper,OpenSIPSProject
Date: 17Mar2023
ENABLESECURITY • EnableSecurityGmbHNeuburgerStraße101b,94036Passau,Germany
[PII_REDACTED]664 • contact@enablesecurity.com • enablesecurity.com
Contents
1. Changelog 3
2. Introduction 4
2.1. PurposeandLimitations ....................................................................... 4
2.2. Scope ....................................................................................... 4
3. Findingsandrecommendations 6
3.1. SegmentationfaultduetoinvalidContent-Lengthheader(CVSS:8.6) ............................. 6
3.2. CrashwhenspeciallycraftedREGISTERmessageischallengedforauthentication(CVSS:8.6) ......... 8
3.3. Bufferover-readinfunctiondelete_sdp_lineleadstoDoSorundefinedbehaviour(CVSS:8.6) ...... 12
3.4. Bufferover-readinthefunctionparse_param_nameleadstoDoSorundefinedbehaviour(CVSS:8.6) .. 15
3.5. Bufferover-readinthefunctionextract_fieldleadstoDoSorundefinedbehaviour(CVSS:8.6) ..... 19
3.6. Bufferover-readinfunctionextract_rtpmapleadstoDoSorundefinedbehaviour(CVSS:8.6) ....... 23
3.7. Bufferover-readinthefunctionextract_fmtpleadstoDoSorundefinedbehaviour(CVSS:8.6) ....... 26
3.8. Off-by-oneerrorinthefunctionappend_hfleadstoacrash(CVSS:8.6) ............................. 30
3.9. Segmentationfaultinthefunctionbuild_res_buf_from_sip_reqmightleadtoDoS(CVSS:6.2) ... 32
3.10.Segmentationfaultwhencallingthefunctioncalc_tag_suffixleadstoDoS(CVSS:8.6) ............ 35
3.11.Crashinthefunctiont_reply_matchingmayleadtoDoS(Info) .................................. 38
3.12.Heap-buffer-overflowinfunctionparse_hname2leadstoAddressSanitizerfalsepositives(Info) ....... 40
3.13.Segmentationfaultinthefunctionrewrite_rurileadstoDoS(CVSS:8.6) ......................... 43
3.14.Memoryleakinparse_mi_requestmightleadtoDenialofService(CVSS:7.1) ..................... 46
3.15.Bufferover-readinfunctionstream_processleadstoDoS(CVSS:8.6) ............................. 49
4. Conclusion 54
5. Appendix 55
5.1. Methodology ................................................................................. 55
2 OpenSIPSsecurityaudit
5.2. Detailedanalysis .............................................................................. 66
3 OpenSIPSsecurityaudit
1. Changelog
▶ 2021-11-03:statusreportproduced
▶ 2022-02-24:statusreportupdated
▶ 3morefindings
▶ additionalmethodology+coverage
▶ 2022-03-30:minimizedreportcreated
▶ 2023-03-16:missingversiondetailsadded
4 OpenSIPSsecurityaudit
2. Introduction
ThePenetrationTestwasperformedbySandroGauciandAlfredFarrugiaofEnableSecurityonthe
OpenSIPSserver.Intermsofmethodology,awhiteboxapproachwastakenespeciallysincethesource
codewasavailableduetotheopensourcenatureoftheproject.Thisgavethetesterstheadvantageof
beingabletoanalyseandinstrumentthecodeforvulnerabilitydiscovery.Additionally,asaresult,the
testershadfurtherinsightintothevulnerabilitiesthatwerediscoveredandthesolutionsthatwere
consequentlyapplied.TheversionofOpenSIPSontestwas3.2.2.Thesecuritytestsweredoneinlab
environmentonvarioustestenvironmentstovalidatethefindings.
Thefollowingisareportonthefindingsandfixesthatcanbeappliedtolimitexposuretoattack.
2.1 PurposeandLimitations
ThepurposeofthissecurityauditwastofindsecurityvulnerabilitieswithintheOpenSIPSserversothatthey
canbeaddressedbeforeadversariesabusetheseloopholes.Securityfixeswereappliedacrossvarious
OpenSIPSversions,buttheversionsthatincludedallfixeswereOpenSIPS3.1.9and3.2.6.
2.2 Scope
▶ OpenSIPSparser1including:
▶ parser
▶ parser/digest
▶ parser/contact
▶ parser/sdp
▶ OpenSIPSauthmodule2
▶ OpenSIPStmmodule3
▶ OpenSIPSdialogmodule4
▶ Thefollowingmodules:
▶ UDP5
▶ TCP6
1 https://github.com/OpenSIPS/opensips/tree/master/parser
2 https://github.com/OpenSIPS/opensips/tree/master/modules/auth
3 https://github.com/OpenSIPS/opensips/tree/master/modules/tm
4 https://github.com/OpenSIPS/opensips/tree/master/modules/dialog
5 https://opensips.org/html/docs/modules/devel/proto_udp.html
6 https://opensips.org/html/docs/modules/devel/proto_tcp.html
5 OpenSIPSsecurityaudit
▶ TLS1
▶ WS2
▶ TheOpenSIPSManagementInterface
▶ FocusonexposedinternalIDs
▶ Topologyhiding
1 https://opensips.org/html/docs/modules/devel/proto_tls.html
2 https://opensips.org/html/docs/modules/devel/proto_ws.html
6 OpenSIPSsecurityaudit
3. Findingsandrecommendations
Thefollowingsectionslisteachsecurity-relevantfindingidentifiedduringthesecurityaudit.
3.1 SegmentationfaultduetoinvalidContent-Lengthheader(CVSS:8.6)
▶ Affects:core
▶ CVSSv3.1
▶ CVSSBaseScore:7.5
▶ ImpactSubscore:3.6
▶ ExploitabilitySubscore:3.9
▶ CVSSTemporalScore:7.0
▶ CVSSEnvironmentalScore:8.6
▶ ModifiedImpactSubscore:5.4
▶ OverallCVSSScore:8.6
▶ Vector:link1
3.1.1 Description
AmalformedSIPmessagecontainingalargeContent-LengthvalueandaspeciallycraftedRequest-URI
causesasegmentationfaultinOpenSIPS.Thisissueoccurswhenalargeamountofsharedmemoryusing
the-mflagwasallocatedtoOpenSIPS,suchas10GbofRAM.Onthetester’ssystemthisissueoccurred
whensharedmemorywassetto2362orhigher.
Thefollowingbacktracewasobtainedfromthecoredumpthatwasgeneratedafterthecrash:
(gdb) bt
#0 0x00005642bf7cc521 in memcpy (__len=<optimized out>, __src=<optimized out>,
__dest=<optimized out>) at msg_translator.c:2285
#1 apply_msg_changes (max_offset=<optimized out>, sock=0xff9d2204,
orig_offs=0x7ffc84e55950, new_offs=0x7ffc84e5594c,
new_buf=0x7f72a50d0da0 "REGISTER sip:2.17.0.2 SIP/2.1\r\nVia: SIP/2.0/UDP
172.17.0.2:5...
at msg_translator.c:1916
#2 apply_msg_changes (max_offset=<optimized out>, sock=0xff9d2204,
orig_offs=0x7ffc84e55950, new_offs=0x7ffc84e5594c,
new_buf=0x7f72a50d0da0 "REGISTER sip:2.17.0.2 SIP/2.1\r\nVia: SIP/2.0/UDP
172.17.0.2:5...
at msg_translator.c:1902
#3 build_req_buf_from_sip_req (msg=msg@entry=0x7f7524fafd68,
1 https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:
U/C:N/I:N/A:H/E:F/RL:O/RC:C/CR:X/IR:X/AR:H/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:N/MI:N/MA:
H&version=3.1
7 OpenSIPSsecurityaudit
returned_len=returned_len@entry=0x7ffc84e55a34,
send_sock=send_sock@entry=0x7f7524d65fe0, proto=<optimized out>,
via_params=via_params@entry=0x0, flags=flags@entry=1) at msg_translator.c:2333
#4 0x00007f72a4cea379 in print_uac_request (proto=<optimized out>,
send_sock=0x7f7524d65fe0, len=0x7ffc84e55a34, i_req=0x7f7524fafd68) at t_fwd.c:240
#5 update_uac_dst (uac=0x7f72a50cdce0, request=0x7f7524fafd68) at t_fwd.c:337
#6 add_uac (t=t@entry=0x7f72a50cdb08, request=request@entry=0x7f7524fafd68,
uri=uri@entry=0x7ffc84e55b30, next_hop=next_hop@entry=0x7ffc84e55b20,
bflags=<optimized out>, path=path@entry=0x7f7524fafff0, proxy=0x7f7524fb17c8,
proxy@entry=0x0) at t_fwd.c:456
#7 0x00007f72a4ceea5a in t_forward_nonack (t=t@entry=0x7f72a50cdb08,
p_msg=p_msg@entry=0x7f7524fafd68, proxy=proxy@entry=0x0,
reset_bcounter=reset_bcounter@entry=0, locked=locked@entry=0) at t_fwd.c:763
#8 0x00007f72a4ce92e9 in t_relay_to (p_msg=p_msg@entry=0x7f7524fafd68,
proxy=proxy@entry=0x0, flags=flags@entry=0) at t_funcs.c:260
#9 0x00007f72a4d1e072 in w_t_relay (p_msg=0x7f7524fafd68, flags=0x0,
#10 0x00005642bf761561 in do_action (a=0x7f7524d72918, msg=0x7f7524fafd68) at action.c:961
...
#30 main (argc=<optimized out>, argv=<optimized out>) at main.c:916
OpenSIPSdevelopersidentifiedthattheproblemoccurredinthefollowingcodeblock:
Source:parser/parse_content.c
243 while (p<end && *p>='0' && *p<='9') {
244 number = number*10 + (*p)-'0';
245 if (number<0) {
246 LM_ERR("number overflow at pos %d in len number [%.*s]\n",
247 (int)(p-buffer),(int)(end-buffer), buffer);
248 return 0;
249 }
250 size ++;
251 p++;
252 }
Thiscodeblockincorrectlyassumesthatanintegeroverflowofthevariablenumberisdetectedby
checkingifthevalueislessthanzero.However,itwasobservedthatthischeckreturnedfalsewhen
compiledwithoptimizations,eventhoughthevalueoverflowedtoanegativenumber.
3.1.2 Impact
ThisissuecausesOpenSIPStoshutdownduetoasegmentationfault.Noauthenticat