Vulnerabilities > CVE-2016-10370 - Improper Access Control vulnerability in Oneplus Oxygenos

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
HIGH
Availability impact
NONE
network
low complexity
oneplus
CWE-284

Summary

An issue was discovered on OnePlus devices such as the 3T. The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850, and CVE-2017-8851.

Vulnerable Configurations

Part Description Count
OS
Oneplus
1
Hardware
Oneplus
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Signature Spoofing by Key Theft
    An attacker obtains an authoritative or reputable signer's private signature key by theft and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Seebug

  • bulletinFamilyexploit
    description#### Summary The OnePlus OTA Updater pushes the signed-OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs (due to the digital signature), it unnecessarily increases the attack surface, and allows for remote exploitation of other vulnerabilities such as CVE-2017-5948, CVE-2017-8850 & CVE-2017-8851. #### Technical Details OxygenOS & HydrogenOS send the following JSON request to `http://otac.h2os.com/post/Query_Update` or to `http://i.ota.coloros.com/post/Query_Update` in order to check if a new OTA is available: ``` { "beta": "0", "imei": "<IMEI>", "isOnePlus": "1", "language": "en", "mobile": "ONEPLUS A3010", "mode": "0", "ota_version": "<CURRENT_VERSION>", "type": "1", "version": "1" } ``` For example, on a OnePlus 3T device running OxygenOS 4.1.1 this results in the following response, announcing that a 4.1.3 OTA is available: ``` { "active_url": "http://otafsc1.h2os.com/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "description": "https://otafsc.h2os.com/html/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011_version_EN_1492072442240.html", "down_url": "http://otafsc.h2os.com/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "extract": "#OS Version: OnePlus3TOxygen_28_170411\n##WHAT'S NEW\n\\\n\u2022 Upgraded Android 7.1.1 \n\\\n\u2022 Added expanded screenshots \n\\\n\u2022 Improved picture taking of moving objects\n with blur reduction \n\\\n\u2022 Improved video stability when recording\n\\\n\u2022 Improved WiFI connectivity \u00a0\n\\\n\u2022 Improved bluetooth connectivity \n\\\n\u2022 Fixed Instagram swiping bug\n\\\n\u2022 Fixed hardware buttons\u00a0malfunction\u00a0bug\n\\\n\u2022 Increased system stability\n\\\n\u2022 General bug fixes\n [www.oneplus.net](http://www.oneplus.net/)", "new_version": "OnePlus3TOxygen_28.A.51_GLO_051_1704112011", "patchFilePath": "/patch/amazone2/GLO/OnePlus3TOxygen/OnePlus3TOxygen_28.A.51_GLO_051_1704112011/OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "patch_md5": "031507863135b7008c2651ea461d0e9e", "patch_name": "OnePlus3TOxygen_28_OTA_051_all_1704112011_d6f79637e1c.zip", "patch_size": "1461187808", "recommend": "100", "share": "\u8bf7\u7528\u82f1\u8bed\u8bbe\u7f6e\u5206\u4eab\u5185\u5bb9", "type": "1", "version_name": "OnePlus3TOxygen_28_1704112011", "wipe": "0" } ``` Man-in-the-Middle attackers can therefore spoof this response in order to exploit CVE-2017-5948, CVE-2017-8850 & CVE-2017-8851. ### POC `https://github.com/alephsecurity/research/tree/master/OnePlusOTA` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2016-10370 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017022. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported.
    idSSV:93109
    last seen2017-11-19
    modified2017-05-12
    published2017-05-12
    reporterRoot
    titleOnePlus OTA Lack of TLS Vulnerability(CVE-2016-10370)
  • bulletinFamilyexploit
    description#### Products * OnePlus 3T * OnePlus 3 * OnePlus 2 * OnePlus X * OnePlus One #### Vulnerable Version * All OnePlus OxygenOS & HydrogenOS OTAs #### Technical Details Due to lenient updater-script in the OnePlus OTA images (see below), and the fact both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use adb sideload to push the OTA (on OnePlus 3/3T ‘Secure Start-up’ must be off). updater-script of the OnePlus 3T OxygenOS 4.1.3 OTA: ``` getprop("ro.display.series") == "OnePlus 3T" || abort("E3004: This package is for \"OnePlus 3T\" devices; this is a \"" + getprop("ro.display.series") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") || abort("E1001: Failed to update system image."); show_progress(0.050000, 10); [...] ``` updater-script of the OnePlus 3T HydrogenOS 3.0.0 OTA: ``` getprop("ro.display.series") == "OnePlus 3T" || abort("E3004: This package is for \"OnePlus 3T\" devices; this is a \"" + getprop("ro.display.series") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/bootdevice/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat") || abort("E1001: Failed to update system image."); show_progress(0.050000, 10); [...] ``` #### PoC ``` https://github.com/alephsecurity/research/tree/master/OnePlusOTA ``` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2017-8850 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017020. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported.
    idSSV:93107
    last seen2017-11-19
    modified2017-05-12
    published2017-05-12
    reporterRoot
    titleOnePlus OTA OxygenOS/HydrogenOS Crossover Vulnerability(CVE-2017-8850)
  • bulletinFamilyexploit
    description#### Products * OnePlus X * OnePlus One #### Vulnerable Version * All OnePlus OxygenOS & HydrogenOS OTAs #### Technical Details Due to lenient updater-script on the OnePlus One & X’s OTA images (see below), the fact both products use the same OTA verification keys, and the fact both products share the same ro.build.product system property, attackers can install OTAs of one product over the other, even on locked bootloaders. That could theoretically allow for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. Moreover, the vulnerability may result in having the device unusable until a Factory Reset is performed. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use adb sideload to push the OTA. updater-script of the latest OnePlus X OxygenOS OTA: ``` getprop("ro.build.product") == "OnePlus" || abort("This package is for \"OnePlus\" devices; this is a \"" + getprop("ro.build.product") + "\"."); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); block_image_update("/dev/block/platform/msm_sdcc.1/by-name/system", package_extract_file("system.transfer.list"), "system.new.dat", "system.patch.dat"); ``` updater-script of the OnePlus One OxygenOS OTA: ``` getprop("ro.build.product") == "OnePlus" || getprop("ro.build.product") == "ONE" || abort("This package is for \"OnePlus\" devices; this is a \"" + getprop("ro.build.product") + "\"."); ifelse(is_mounted("/system"), unmount("/system")); mount("ext4", "EMMC", "/dev/block/platform/msm_sdcc.1/by-name/system", "/system", ""); unmount("/system"); show_progress(0.750000, 0); ui_print("Patching system image unconditionally..."); ``` #### PoC ``` https://github.com/alephsecurity/research/tree/master/OnePlusOTA ``` #### Timeline * 11-May-17: Public disclosure. * 10-May-17: Deadline Extension. * 08-May-17: CVE-2017-8851 assigned. * 08-May-17: CVE ID requested. * 08-May-17: Added as ALEPH-2017021. * 26-Apr-17: Deadline. * 09-Apr-17: 14-day Deadline Extension Offered (no reply). * 26-Jan-17: Reported.
    idSSV:93108
    last seen2017-11-19
    modified2017-05-12
    published2017-05-12
    reporterRoot
    titleOnePlus OTA One/X Crossover Vulnerability(CVE-2017-8851)

The Hacker News

idTHN:51F38064616715ED3D71C32EC64BFB0F
last seen2018-01-27
modified2017-05-12
published2017-05-11
reporterSwati Khandelwal
sourcehttps://thehackernews.com/2017/05/oneplus-mobile-vulnerabilities.html
titleAll OnePlus Devices Vulnerable to Remote Attacks Due to 4 Unpatched Flaws