KL-001-2024-003: Artica Proxy Unauthenticated File Manager Vulnerability

2024-3-6 02:30:23 Author: seclists.org(查看原文) 阅读量:23 收藏

KL-001-2024-003: Artica Proxy Unauthenticated File Manager Vulnerability

Title: Artica Proxy Unauthenticated File Manager Vulnerability
Advisory ID: KL-001-2024-003
Publication Date: 2024.03.05
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-003.txt

1. Vulnerability Details

     Affected Vendor: Artica
     Affected Product: Artica Proxy
     Affected Version: 4.40 and 4.50
     Platform: Debian 10 LTS
     CWE Classification: CWE-288: Authentication Bypass Using an
                         Alternate Path or Channel, CWE-552: Files
                         or Directories Accessible to External
                         Parties
     CVE ID: CVE-2024-2055

2. Vulnerability Description

     The "Rich Filemanager" feature of Artica Proxy provides a
     web-based interface for file management capabilities. When
     the feature is enabled, it does not require authentication by
     default, and runs as the root user.

3. Technical Description

     The Artica Proxy can be installed with a small amount of
     "Features" enabled. Within the administrative web interface,
     additional features can be installed, enabled, and disabled. The
     "Rich Filemanager" feature is disabled by default. Enabling
     this feature will spawn a listener on port 5000/tcp bound to
     0.0.0.0. By default, when this feature is enabled, authentication
     is not required to access the web interface. The "Rich
     Filemanager" runs as the root user. This provides an
     unauthenticated attacker complete access to the file system.

       root@artica:~# ps -efww | grep -i File
       root      1888  1885  0 09:13 ?        00:00:00 php-fpm: pool RICHFILEMANAGER
       root      1889  1885  0 09:13 ?        00:00:00 php-fpm: pool RICHFILEMANAGER

     This can be exploited by an attacker to add entries in to
     /etc/shadow, /etc/passwd, and /etc/ssh/sshd_config to create
     an additional root-level account that has the ability to SSH
     in to the system.

4. Mitigation and Remediation Recommendation

     No response from vendor. Rich Filemanager feature is disabled
     by default. Leave it that way.

5. Credit

     This vulnerability was discovered by Jim Becher of KoreLogic,
     Inc.

6. Disclosure Timeline

     2023.12.18 - KoreLogic requests vulnerability contact and
                  secure communication method from Artica.
     2023.12.18 - Artica Support issues automated ticket #1703011342
                  promising follow-up from a human.
     2024.01.10 - KoreLogic again requests vulnerability contact and
                  secure communication method from Artica.
     2024.01.10 - KoreLogic mail daemon receives SMTP 554 5.7.1 from
                  mail.articatech.com with response
                  "Client host rejected: Go Away!"
     2024.01.11 - KoreLogic requests vulnerability contact and
                  secure communication method via
                  https://www.articatech.com/ 'Contact Us' web form.
     2024.01.23 - KoreLogic requests CVE from MITRE.
     2024.01.23 - MITRE issues automated ticket #1591692 promising
                  follow-up from a human.
     2024.02.01 - 30 business days have elapsed since KoreLogic
                  attempted to contact the vendor.
     2024.02.06 - KoreLogic requests update on CVE from MITRE.
     2024.02.15 - KoreLogic requests update on CVE from MITRE.
     2024.02.22 - KoreLogic reaches out to alternate CNA for
                  CVE identifiers.
     2024.02.26 - 45 business days have elapsed since KoreLogic
                  attempted to contact the vendor.
     2024.02.29 - Vulnerability details presented to AHA!
                  (takeonme.org) by proxy.
     2024.03.01 - AHA! issues CVE-2024-2055 to track this
                  vulnerability.
     2024.03.05 - KoreLogic public disclosure.

7. Proof of Concept

     Step 1: Move /etc/shadow to /tmp/shadow

Full Disclosure mailing list archives

Current thread: