SEC Consult Vulnerability Lab Security Advisory < 20150514-0 >

          title: Multiple vulnerabilities
        product: Loxone Smart Home

vulnerable version: Firmware version <6.4.5.12
fixed version: 6.4.5.12
impact: Critical
homepage: http://www.loxone.com
found: 2015-03-12
by: Johannes Greil (Office Vienna)
SEC Consult Vulnerability Lab

                 An integrated part of SEC Consult
                 Berlin - Frankfurt/Main - Montreal - Singapore
                 Vienna (HQ) - Vilnius - Zurich

                 https://www.sec-consult.com

=======================================================================

Vendor & product description:

"Loxone Electronics was founded in 2009. Our focus is the development and
production of control solutions for all homes. Our aim is to make home
automation interesting, affordable and accessible for everyone."

URL: http://www.loxone.com/enus/company/about-us.html

Business recommendation:

Most of the issues previously identified (see SEC Consult security advisory
SA-20150227-0) seem not to have been fixed properly and are still exploitable
either directly or by easily bypassing implemented measures. A very short
crash-test of only a few hours even resulted in new vulnerabilities.

The Loxone smart home has multiple design and implementation flaws which
combined could be used by an attacker to:
1) remotely cause a denial of service condition which renders the smart
home unusable which would effectively disable any Loxone-controlled
alarm system,
2) steal the user's credentials for the management interface and fully
control the smart home,
3) execute JavaScript code in the user's browser for further attacks,
4) control arbitrary devices connected to the system, e.g. switch on/off
lights, remotely open doors or garages, disable alarm system, etc.,
5) gain access to admin passwords of Loxone partners (e.g. electricians
who are implementing the smart home solution at customers) and
completely take over other smart homes of the same Loxone partner!

It is recommended by SEC Consult not to use this smart home system until a
thorough security analysis (white box) of all components has been performed by
security professionals, as a very short crash test (Blackbox) already resulted
in critical vulnerabilities.

Vulnerability overview/description:

1) Cross-site request-forgery (XSRF)
The system is vulnerable to XSRF attacks. If an attacker is able to lure a user
into clicking a crafted link or by embedding such a link within web pages (e.g.
discussion forums) he could control arbitrary functions within the smart home
system.
All functions can be controlled via web based commands, e.g. in order to switch
on lights, remotely open doors or garages, disable the alarm system, etc.

This can still be exploited in the current Loxone version and it does not seem
to be fixed properly.

2) HTTP Response Splitting / Header injection
The web server of the Loxone smart home system is vulnerable to HTTP response
splitting attacks. If an attacker is able to lure a user into clicking a
crafted link (e.g. just by clicking a URL in a discussion forum or
phishing email) he could arbitrarily manipulate the server's response (e.g.
injection of JavaScript code).

This can still be exploited in the current Loxone version and it does not seem
to be fixed properly. The implemented measures/filters can be easily bypassed
using double-encoded payloads.

This attack is not limited to the admin interface, it can be exploited in any
path of the webserver.

SEC Consult has verified this attack in the most current versions of Mozilla
Firefox and Google Chrome web browsers.

3) Reflected cross-site scripting (XSS) vulnerability
The web interface of Loxone smart home is vulnerable to reflected cross-site
scripting attacks. If an attacker is able to lure a user into
clicking a crafted link (e.g. just by clicking a URL in a discussion forum or
phishing email) he could execute arbitrary JavaScript code in the user's
browser. Thereby he could steal the user's credentials or control arbitrary
devices within the smart home system. To exploit this vulnerability it isn't
mandatory for the user to be authenticated. Unauthenticated XSS vulnerabilities
exist as well (by exploiting the HTTP Response Splitting vulnerability
described in 2) as authenticated ones.

SEC Consult has verified this attack in the most current versions of Mozilla
Firefox and Google Chrome web browsers.

4) Denial of service
An attacker could perform a denial of service attack with simple measures, such
as synflood attacks. During such an attack the system isn't accessible via the
network and can't be controlled anymore which also means that alarm systems
won't work!

This can still be exploited in the current Loxone version and it does not seem
to be fixed properly. The miniserver was not reachable during the attack and
rebooted after a short while (a few seconds) when running the attack (depending
on the bandwidth).

Furthermore, other new DoS attack vectors have been identified, which crash the
web interface and are not related to the bandwidth network attacks.

5) Decrypted Loxone config passwords in memory
The "Loxone Config" programming software for the Loxone smart home allows saving
the whole configuration into a XML file for backup or for user support (e.g. via
ticketing system or discussion forum). This XML config file contains usernames
and passwords of all configured users (admin or non-admin with different access
levels).

Loxone partners (e.g. electricians who are implementing the smart home at
customers) may also send such config files to their customers or provide end
users admin level access with different admin user accounts. The password of
the Loxone partner's admin account is usually not shared and should be kept
a secret.

The passwords are stored encrypted (not hashed!) within the config file and are
immediately decrypted in memory upon opening such a config file by the Loxone
Config software. Access to the Loxone miniserver is not needed!

An attacker exploiting this issue is able to gain access to the admin password
of the Loxone partner! This is especially critical if the same password is being
used in different customer installations. Attackers (e.g. one customer of the
Loxone partner) can then directly manipulate or control other Loxone smart homes
of the same Loxone partner!

Proof of concept:

1) Cross site request forgery (XSRF)

This can still be exploited in the current Loxone version and it does not seem
to be fixed entirely. As an example, the alarm system of the Loxone "demo case"
can be disabled via this XSRF payload in case the admin has previously been
authenticated for the web services and is surfing with the same web browser:
<html>
<img src=http://$ip/dev/sps/io/Alarmanlage/off&gt;&lt;/img&gt;
</html>

2) HTTP Response Splitting / Header injection

The following payload only works by accessing the web interface when a user is
not authenticated which will be most of the time in regular use cases. This
makes successful exploitation more easy.

The WWW-Authenticate header is not properly sanitized and uses the URI for the
"Basic realm" input. Any payload within the URL will be added to the realm. It
is possible to inject new headers or manipulate the response body in order to
inject arbitrary HTML/JavaScript code (Response splitting / Header injection).

The following URL demonstrates this issue and injects some HTML/JavaScript code
(combined XSS attack) that generates a popup as an example:

http://$ip/%2522%250aContent-Type:%20text%252fhtml%250a%250a%253chtml%253e%253cscript%253ealert%28123%29%253c%252fscript%253e%253c%252fhtml%253e

An attacker who is able to trick a user into clicking this link (e.g. phishing
email or discussion forum) will for example be able to re-create the login page
of the Loxone miniserver device and trick a user into sending username/password
to an attacker-controlled server.

3) Reflected cross-site scripting (XSS) vulnerability

To reproduce this behavior it is sufficient to open the following URL as an
authenticated user (or social engineer the victim to enter the credentials when
prompted), which will show a popup message and turn on the LED light of the
Loxone demo case. The payload uses double-encoded values in order to bypass the
previously incorrectly implemented filters:

http://$ip/dev/sps/io/%2522%253E%253Cscript%2520xmlns=%2527http:%25
26%2523x2f%253B%2526%2523x2f%253Bwww.w3.org/1999/xhtml%2527%253Ealert%2528%2527
you%2520got%2520p0wned%2520again%2527%2529%253b%2520r=new%2520XMLHttpRequest
%2528%2529;%2520r.open%2528%2527GET%2527,%2527/dev/sps/io/MK_T5/on%2527,true%2529;%2520r.send%2528%2529;%253C/script%253E

4) Denial of service

Running the following command will keep the miniserver in a non-responsive state
after a few seconds (depending on the bandwidth) and it will not recover until
the attack is stopped (it will reboot afterwards). During this attack, nothing
can be controlled anymore (no switch of the demo case worked):
hping3 -S --flood -p 80 $ip

Furthermore, the following HTTP request (sometimes it is necessary to send it a
few times) renders the web interface itself unusable. It is not possible
anymore to control the smart home as the web interface does not work properly
anymore, e.g. afterwards connection reset/unreachable errors or login errors
occur although the password has been correctly entered in the web interface,
etc.):

GET /index.html HTTP/1.1
Host: foo
Sec-WebSocket-Key1: foo

A reboot is necessary in order to make the web interface work again.

5) Decrypted Loxone config passwords in memory
This vulnerability can be easily verified when dumping the memory of the
attacker's system which every local attacker has access to if he wants to gain
access to passwords of his Loxone partner or other configuration files
published by users on the Internet!

It has been verified by installing Loxone Config in a virtual environment
(VirtualBox) and using the following command to gain access to the memory:

VBoxManage debugvm $vmname dumpguestcore --filename dump

Upon opening the config file (e.g. of any Loxone partner or other end user who
has published his configuration at the discussion forum) the Loxone Config
software will immediately decrypt the passwords and keep them unencrypted in
memory. The encryption key is suspected to be the same for all Loxone Config
installations, but this has not been verified (no reverse engineering of
Loxone Config has been performed). Access to the miniserver is not needed, it
is simply enough to open the configuration file.

The decrypted passwords of all users can be easily found in the dumped memory
when searching for the username.

Vulnerable / tested versions:

The vulnerabilities have been verified to exist in firmware version 6.3.3.11 of
the Loxone smart home, which was the most recent version at the time of discovery.

It is assumed that all previous firmware versions are affected as well.

Vendor contact timeline:

2015-03-13: Contacting vendor through email, sending responsible disclosure
policy, defining release deadline (4th May), asking for encryption keys
2015-03-13: Vendor: no encryption available; sending advisory unencrypted
2015-03-19: Answering question of Loxone regarding CSRF attacks
2015-04-16: Asking for status update: Vendor asks to delay disclosure until
14th May
2015-05-13: Updated firmware v6.4.5.12 available
2015-05-14: SEC Consult releases security advisory

Solution:

According to the vendor the firmware version v6.4.5.12 fixes the identified
security issues.

It can be downloaded at the following URL and should be installed immediately
in order to increase the level of security:
http://www.loxone.com/tl_files/loxone/downloads/config/Loxone-Config-6.4.5.12.zip

Workaround:

Only connect to your miniserver via secure VPN and disable any port forwardings.
Use an isolated PC (browser) to control the smart home and do not surf on the
web while being logged in to the miniserver web interface.
Use different passwords for all installations and don't reuse them.

Advisory URL:

https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm

SEC Consult Vulnerability Lab

SEC Consult
Berlin - Frankfurt/Main - Montreal - Singapore - Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/Career.htm

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/About/Contact.htm

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF Johannes Greil / @2015