[FD] Security advisory: multiple vulnerabilities including Authenticated RCE (property injection), Hardcoded credentials, Pre-authentication root RCE in CatDV Server 10.7.8 (Square Box Systems)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing 3 vulnerabilities in CatDV 
Server 10.7.8 (Square Box Systems). The research is published and a 
proof-of-concept is available.

Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)

A three-defect chain turns any deployment into an unauthenticated root RCE. An 
RMI connect(null) path makes the server mint a ClientID using its own internal 
client.regcode system property (zero attacker credentials). A saveSettings 
method gated only by that ClientID with no admin check writes an 
attacker-controlled catdv.aaftoolPath into the JVM system properties. An 
AAFExportHandler ProcessUtils.exec sink runs that path as root on every AAF 
export request. The factory-default empty admin password closes the chain by 
supplying the admin session needed to reach the AAF trigger. Dynamic 
verification produced uid=0(root).

Impact: Full compromise of the CatDV server and arbitrary command execution as 
root (uid=0); the attacker holds no product license key and no user credentials.

Advisory: https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce

Vulnerability 2: Hardcoded credentials (CVSS 9.8, pre-authentication)

The factory-default database seed creates the built-in admin user with 
password=0 and passwordHash=NULL. The password verification routine skips the 
PBKDF2 path when passwordHash is null and falls back to a legacy simpleMD5Hash 
path, where simpleMD5Hash('') returns 0 and 0 == 0 evaluates to true. Anyone 
who can reach the CatDV web login endpoint can authenticate as the 
administrator using admin with an empty password, as long as the factory 
default has not been changed. This grants full administrator control of the MAM 
server and is the credential prerequisite for the authenticated root RCE chain.

Impact: Full administrator takeover of the CatDV server using the well-known 
built-in admin username with an empty password; the admin session can read or 
alter any catalog data, server configuration, or user account.

Advisory: 
https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password

Vulnerability 3: Authenticated RCE (property injection) (CVSS 7.6, 
authenticated)

An authenticated administrator can turn any running deployment into a root RCE 
by injecting the catdv.aaftoolPath JVM system property to point at an 
attacker-controlled script and then triggering an AAF export. The type-23 
'server-config' setting is applied verbatim as System.setProperty(key, value) 
pairs with no property whitelist, and AAFExportHandler runs that property via 
ProcessUtils.exec as root on every AAF export request. The injected property is 
auto-applied on the next request (1s throttle), so no server restart is needed. 
Dynamic verification produced uid=0(root).

Impact: Full compromise of the CatDV server and arbitrary command execution as 
root (uid=0); an admin session on the web API is required.

Advisory: https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/