{"id":55807,"date":"2020-01-29T00:00:00","date_gmt":"2020-01-28T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root"},"modified":"2020-02-18T14:03:57","modified_gmt":"2020-02-18T11:03:57","slug":"uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","title":{"rendered":"Vulnerabilitate \u00een OpenSMTPD care permite execu\u021bia de cod de la distan\u021b\u0103 cu drepturi root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen proiectul \u00een dezvoltare OpenBSD pentru servere de email , multiplexorul de terminal text (similar cu GNU screen)<\/a><\/noindex> a fost identificat\u0103 o vulnerabilitate critic\u0103<\/a><\/noindex> (CVE-2020-7247), care permite executarea de comenzi shell de la distan\u021b\u0103 pe server cu drepturile utilizatorului root. Vulnerabilitatea a fost descoperit\u0103 \u00een timpul unui audit suplimentar realizat de compania Qualys Security (auditul anterior pentru OpenSMTPD a fost efectuat<\/a><\/noindex> \u00een 2015, iar noua vulnerabilitate este prezent\u0103 din mai 2018). Problema remediat\u0103<\/a><\/noindex> este \u00een versiunea OpenSMTPD 6.6.2. To\u021bi utilizatorii sunt sf\u0103tui\u021bi s\u0103 instaleze urgent actualizarea (pentru OpenBSD, corec\u021bia poate fi instalat\u0103 prin syspatch).<\/p>\n

Sunt propuse dou\u0103 variante de atac. Prima variant\u0103 func\u021bioneaz\u0103 \u00een configura\u021bia implicit\u0103 a OpenSMTPD (accept\u00e2nd doar cereri de la localhost) \u0219i permite explozionarea problemei local, atunci c\u00e2nd atacatorul are acces la interfa\u021ba de re\u021bea local\u0103 (loopback) pe server (de exemplu, \u00een sistemele de g\u0103zduire). A doua variant\u0103 apare \u00een cazul configur\u0103rii OpenSMTPD pentru a accepta cereri externe de re\u021bea (server de email care accept\u0103 emailuri externe). Cercet\u0103torii au preg\u0103tit un prototip de exploit, care func\u021bioneaz\u0103 cu succes at\u00e2t cu varianta OpenSMTPD din OpenBSD 6.6, c\u00e2t \u0219i cu versiunea portabil\u0103 pentru alte sisteme de operare (testat\u0103 \u00een Debian Testing).<\/p>\n

Problema este cauzat\u0103 de o eroare \u00een func\u021bia smtp_mailaddr(), apelat\u0103 pentru a verifica corectitudinea valorilor din c\u00e2mpurile «MAIL FROM» \u0219i «RCPT TO», care definesc expeditorul\/recipientul \u0219i sunt transmise \u00een timpul conexiunii cu serverul de po\u0219t\u0103. Pentru a verifica partea adresei de po\u0219t\u0103 care precede simbolul «@», se apeleaz\u0103 func\u021bia smtp_mailaddr()
\nvalid_localpart(), care consider\u0103 permise (MAILADDR_ALLOWED) simbolurile «!#$%&’*\\\/\\?^`{|}~+-=_», conform cerin\u021belor RFC 5322. <\/p>\n

\u00centre timp, procesarea direct\u0103 a \u0219irului este realizat\u0103 \u00een func\u021bia mda_expand_token(), care \u00eenlocuie\u0219te doar simbolurile «!#$%&’*?`{|}~» (MAILADDR_ESCAPE). Ulterior, \u0219irul preg\u0103tit \u00een mda_expand_token() este utilizat la apelul agentului de livrare (MDA) prin comanda ‘execle(«\\\/bin\\\/sh», «\\\/bin\\\/sh», «-c», mda_command,…’. \u00cen cazul \u00een care se pune o scrisoare \u00een mbox prin \\\/bin\\\/sh, se porne\u0219te \u0219irul «\\\/usr\\\/libexec\\\/mail.local -f %%{mbox.from} %%{user.username}», unde valoarea «%{mbox.from}» include datele escapate din parametrul «MAIL FROM».<\/p>\n

Esenta vulnerabilit\u0103\u021bii este c\u0103 smtp_mailaddr() are o eroare logic\u0103, care face ca \u00een cazul \u00een care un domeniu gol este transmis \u00een email, func\u021bia s\u0103 returneze un cod de verificare de succes, chiar \u0219i atunci c\u00e2nd partea adresei de dinainte de «@» con\u021bine simboluri nepermise. Ulterior, \u00een procesarea \u0219irului de c\u0103tre func\u021bia mda_expand_token(), nu sunt escapate toate simbolurile speciale posibile ale shell-ului, ci doar simbolurile speciale permise \u00eentr-o adres\u0103 de po\u0219t\u0103. Astfel, pentru a rula comanda proprie este suficient s\u0103 se foloseasc\u0103 \u00een partea local\u0103 a emailului simbolul «;» \u0219i un spa\u021biu, care nu fac parte din setul MAILADDR_ESCAPE \u0219i nu sunt escapate. De exemplu:<\/p>\n

$ nc 127.0.0.1 25<\/p>\n

HELO professor.falken
\n MAIL FROM:<;sleep 66;>
\n RCPT TO:<root>
\n DATA
\n .
\n QUIT<\/p>\n

Dup\u0103 aceast\u0103 sesiune, OpenSMTPD va lansa comanda prin shell la livrarea c\u0103tre mbox <\/p>\n

\/usr\/libexec\/mail.local -f ;sleep 66; root<\/p>\n

\u00cen acest context, posibilit\u0103\u021bile de atac sunt limitate prin faptul c\u0103 partea local\u0103 a adresei nu poate dep\u0103\u0219i 64 de caractere, iar simbolurile speciale ‘$’ \u0219i ‘|’ sunt \u00eenlocuite cu «:» \u00een procesul de escapare. Pentru a ocoli aceast\u0103 limitare, s-a folosit faptul c\u0103 corpul scrisorii este transmis dup\u0103 pornirea \\\/usr\\\/libexec\\\/mail.local prin fluxul de intrare, adic\u0103 prin manipul\u0103ri cu adresa se poate lansa doar interpretul de comenzi sh \u0219i se poate folosi trupul scrisorii ca un set de instruc\u021biuni. Deoarece la \u00eenceputul scrisorii sunt indicate anteturile SMTP de serviciu, pentru a le s\u0103ri se propune utilizarea apelului comenzii read \u00eentr-un ciclu. Exploatul func\u021bional arat\u0103 aproximativ astfel:<\/p>\n

$ nc 192.168.56.143 25<\/p>\n

HELO professor.falken
\n MAIL FROM:<;for i in 0 1 2 3 4 5 6 7 8 9 a b c d;do read r;done;sh;exit 0;>
\n RCPT TO:<root@example.org>
\n DATA
\n #0
\n #1
\n \u2026
\n #d
\n for i in W O P R; do
\n echo -n «($i) » && id || break
\n done > \\\/root\\\/x.»`id -u`».»$$»
\n .
\n QUIT<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-7247), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c shell-\u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0432 \u0445\u043e\u0434\u0435 \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0433\u043e \u0430\u0443\u0434\u0438\u0442\u0430, \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Qualys Security (\u043f\u0440\u043e\u0448\u043b\u044b\u0439 \u0430\u0443\u0434\u0438\u0442 OpenSMTPD \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0441\u044f \u0432 2015 \u0433\u043e\u0434\u0443, \u0430 \u043d\u043e\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 \u043c\u0430\u044f 2018 \u0433\u043e\u0434\u0430). \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 OpenSMTPD 6.6.2. \u0412\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-55807","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een OpenSMTPD, care permite execu\u021bia de cod de la distan\u021b\u0103 cu privilegii root | ProHoster","description":"Proiectul dezvoltat OpenBSD, serverul de email OpenSMTPD, a identificat","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSMTPD, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c OpenBSD \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u0435 OpenSMTPD \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-opensmtpd-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-28T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55807","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:36:30","updated":"2022-10-09 15:09:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55807","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=55807"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/55807\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=55807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=55807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=55807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}