Vulnerabilities > CVE-2013-3055 - Permissions, Privileges, and Access Controls vulnerability in Lexmark Markvision

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(66325);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");

  script_cve_id("CVE-2013-3055");
  script_bugtraq_id(59513);

  script_name(english:"Groovy Shell Unauthenticated Remote Command Execution");
  script_summary(english:"Checks for unprotected Groovy Shell");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an unprotected shell listening that allows for
remote command execution.");
  script_set_attribute(attribute:"description", value:
"The remote host has an unprotected Groovy Shell bound to a TCP port
that is listening and allows for commands to be executed by an
unauthenticated, remote attacker.  This shell is known to be included
with Lexmark Markvision.");
  script_set_attribute(attribute:"see_also", value:"http://groovy.codehaus.org/Groovy+Shell");
  # http://support.lexmark.com/index?page=content&id=TE530&locale=en&userlocale=EN_US
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?db169a54");
  script_set_attribute(attribute:"solution", value:
"Disable or restrict access to the shell.  If running Lexmark
Markvision, upgrade to version 1.8.0 or higher.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-3055");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_publication_date", value:"2013/05/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:codehaus:groovy");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("find_service2.nasl", "os_fingerprint.nasl");
  script_require_ports("Services/groovy_shell", 9789);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("byte_func.inc");
include("telnet2_func.inc");
include("data_protection.inc");

global_var rcvdata, n, commands, command_index, port, groovy_detected;

groovy_detected = FALSE;

os = get_kb_item("Host/OS");
if (os && report_paranoia < 2)
{
  if ("Windows" >< os)
  {
    commands = make_array(
      "ipconfig", "Windows IP Configuration"
    );
  }
  else
  {
    commands = make_array(
      "id", "uid=",
      "ifconfig", "inet"
    );
  }
}
else
{
  commands = make_array(
    "ipconfig", "Windows IP Configuration",
    "ifconfig", "inet",
    "id", "uid="
  );
}

n = 0;
command_index = 0;

appname = "Groovy Shell";

function local_telnet_callback()
{
  local_var substring, data, report, start, end, command, command_res, command_keys;

  data = _FCT_ANON_ARGS[0];
  if (isnull(data)) return NULL;

  if (command_index >= max_index(keys(commands)))
    return NULL;

  command_keys = keys(commands);
  command = command_keys[command_index];
  substring = commands[command];

  if (data[0] != '\0') rcvdata += data[0];

  if (n == 0)
  {
    if ("groovy> " >< rcvdata && "Groovy Shell" ><rcvdata)
    {
      groovy_detected = TRUE;
      telnet_write('println "' + command + '".execute().text\n');
      n = 1;
      rcvdata = '';
    }
  }
  else if (n == 1)
  {
    if ("groovy> " >< rcvdata)
    {
      telnet_write('go\n');
      n = 2;
      rcvdata = '';
    }
  }
  else if (n == 2)
  {
    if ("groovy> " >< rcvdata)
    {
      if (substring >< rcvdata && 'go' >< rcvdata && '===>' >< rcvdata)
      {
        start = stridx(rcvdata, 'go');
        end = stridx(rcvdata, '===>');

        command_res = substr(rcvdata, start + 2, end - 1);

        if (report_verbosity > 0)
        {
          report = '\nNessus was able to execute the "' + command +
                   '" and got the' +
                   '\nfollowing results : \n' + data_protection::sanitize_uid(output:chomp(command_res)) + '\n';
          security_hole(extra:report, port:port);
        }
        else security_hole(port);
        exit(0);
      }
      else
      {
        n = 1;
        rcvdata = '';
        command_index++;
        command = command_keys[command_index];
        telnet_write('println "' + command + '".execute().text\n');
      }
    }
  }
  return NULL;
}

port = NULL;

port = get_service(svc:"groovy_shell", default:9789, exit_on_fail:TRUE);

if (!get_tcp_port_state(port)) audit(AUDIT_PORT_CLOSED, port);

if (! telnet2_init(port: port, timeout: 3 * get_read_timeout()))
  audit(AUDIT_SOCK_FAIL, port);

telnet_loop(telnet_callback_fn:@local_telnet_callback);

if (groovy_detected)
  audit(AUDIT_LISTEN_NOT_VULN, appname, port);
else
  audit(AUDIT_NOT_LISTEN, appname, port);

#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(66328);
  script_version("1.3");
  script_cvs_date("Date: 2019/11/27");

  script_cve_id("CVE-2013-3055");
  script_bugtraq_id(59513);

  script_name(english:"Lexmark Markvision Enterprise Remote Command Execution");
  script_summary(english:"Checks version of Lexmark Markvision Enterprise");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server has a web application that is affected by a
remote command execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Lexmark Markvision installed on the remote host is
earlier than 1.8.0 and gets installed with a Groovy Shell (intended for
diagnostic purposes) that binds to TCP port 9789. This could allow
for commands to be executed by an unauthenticated, remote attacker.

Note that this plugin does not verify that Groovy Shell is listening and
instead only does a version check of Lexmark Markvision install.");
  # http://support.lexmark.com/index?page=content&id=TE530&locale=en&userlocale=EN_US
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?db169a54");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Lexmark Markvision 1.8.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-3055");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/04/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/04/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/05/06");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:lexmark:markvision");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("lexmark_markvision_enterprise_detect.nasl");
  script_require_keys("www/lexmark_markvision_enterprise");
  script_require_ports("Services/www", 9788);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");

port = get_http_port(default:9788);

appname = "Lexmark Markvision Enterprise";

install = get_install_from_kb(appname:'lexmark_markvision_enterprise', port:port, exit_on_fail:TRUE);
version = install['ver'];

url = build_url(port:port, qs:install['dir']);

if (version == UNKNOWN_VER) audit(AUDIT_UNKNOWN_WEB_APP_VER, appname, url);

ver = split(version, sep:".", keep:FALSE);
for(i=0; i<max_index(ver); i++)
  ver[i] = int(ver[i]);

if (max_index(ver) < 2)
  exit(1, "Version information from server on " + port + " is not verbose enough to determine if host is vulnerable.");

if (
  ver[0] < 1 ||
  (ver[0] == 1 && ver[1] < 8)
)
{
  if (report_verbosity > 0)
  {
    report = '\n  Installed version : ' + version +
             '\n  Fixed version     : 1.8.0\n';
    security_hole(port:port, extra:report);
  }
  else security_hole(port);
  exit(0);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, appname, url, version);