[FD] [0day-rubbish] Lantronix SGX5150 9.13.0.0R7 Authenticated FsBrowseClean command injection to root RCE (7.2)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Lantronix
SGX5150, firmware 9.13.0.0R7, an IT/OT device server.

Type: authenticated OS command injection (CWE-78) in the FsBrowseClean AJAX
handler (0x5eea0) of /bin/ltrx_evo. A per-character filter blocks & | < ; ! $
backslash backtick and > but permits single quote, hash and newline. The path
POST parameter is concatenated into /sbin/ltrx_usb_umount '%s' and run through
/bin/sh -c as root. Sending path=x'%0a<cmd>%20%23 closes the quoted argument,
opens a new shell line carrying the attacker's command, and comments out the
trailing quote. The sink is blind.

Scoring. This finding is dual-scored, and the conditional figure is NOT
verified, which is stated rather than glossed:
- PRIMARY, adopted, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
  PR:H rests on a genuine privileged web session being required.
- CONDITIONAL, NOT verified, 9.8 Critical,
  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Applies only if the device
  serial number is obtainable, which would make the factory administrator
  password (recorded as serial-derived) no secret and the chain effectively
  unauthenticated. Serial recovery was NOT verified, and neither was the
  derivation itself.
- SEPARATE secondary defect, 9.8 Critical, 
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reachable only where Digest 
authentication is configured: the
  Digest username extractor at 0xff838 verifies no nonce, realm or response, so 
a
  forged Authorization: Digest username="admin" header alone sets the identity 
to
  admin. This is independent of, and not additive to, the primary finding.

Scoring note. The research record attached 8.8 to the PR:H vector. That vector
computes to 7.2, not 8.8 under CVSS 3.1; this advisory recomputes from the 
vector
printed beside it and reports 7.2, keeping 8.8 only as a labelled PR:L
hypothetical (no lower-privileged account passing the filesystem write test was
enumerated, so it is not claimed).

Impact: root execution on an industrial gateway (ltrx_evo runs as root), giving
full read of configuration and serial traffic, arbitrary root modification,
persistent implantation, total availability loss and a pivot into segmented
networks.

Authentication: an authenticated web session satisfying
IsGroupListWritable(identity, "filesystem"); the session precondition is static
analysis, not dynamically verified.

Verification boundary, stated plainly. No physical SGX5150 hardware was used at
any point; verification is sink-faithful rather than full-stack. The character
filter, the IseUSB gate and the sink construction were replicated in a chroot of
the extracted ARM rootfs under qemu-arm-static, and the injected newline vector
passed the product's own filter and ran as root via the product's own /bin/sh 
and
marker owned by root:root. End-to-end HTTP against a live daemon was not
achievable, because ltrx_evo requires NVRAM state, the encrypted factory.xcr
device-serial material and a ZMQ IPC stack that could not be reconstructed
outside the device.

Full technical analysis and a reproducible proof-of-concept:
  
https://0day-rubbish.com/blog/lantronix-sgx5150-fsbrowseclean-command-injection

Project archive (ongoing disclosure series):
  https://github.com/Exploit-Garbage/0day-Rubbish

The vendor has been notified through its published security contact. No 
vulnerability identifier has been assigned to
this finding yet.

--
0day Rubbish Research Team
disclosure@xxxxxxxxxxxxxxxx
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/