【漏洞预警】 SHADOWSOCKS-LIBEV 命令执行漏洞

BaCde 2629天前

OVERVIEW

Severity Rating: High

Confirmed Affected Versions: 3.1.0

Confirmed Patched Versions: N/A

Vendor: Shadowsocks

Vendor URL: https://github.com/shadowsocks/shadowsocks-libev

Vector: Local

Credit: X41 D-Sec GmbH, Niklas Abel

Status: Public

CVE: Not yet assigned

Advisory-URL: https://www.x41-dsec.de/lab/advisories/x41-2017-010-shadowsocks-libev/

SUMMARY AND IMPACT

ShadowSocks-libev offers local command execution per configuration file or/and additionally, code execution per UDP request on 127.0.0.1.

The configuration file on the file system or the JSON configuration received via UDP request is parsed and the arguments are passed to the "add_server" function. The function calls "construct_command_line(manager, server);" which returns a string from the parsed configuration. The string gets executed at line 486 "if (system(cmd) == -1) {", so if a configuration parameter contains "||evil command&&" within the "method" parameter, the evil command will get executed.

The ss-manager uses UDP port 8830 to get control commands on 127.0.0.1. By default no authentication is required, although a password can be set with the '-k' parameter.

PRODUCT DESCRIPTION

Shadowsocks-libev is a lightweight secured SOCKS5 proxy for embedded devices and low-end boxes. The ss-manager is meant to control shadowsocks servers for multiple users, it spawns new servers if needed.

It is a port of shadowsocks created by @clowwindy, and maintained by @madeye and @linusyang.

PROOF OF CONCEPT

As passed configuration requests are getting executed, the following command will create file "evil" in /tmp/ on the server:

nc -u 127.0.0.1 8839
    add: {"server_port":8003, "password":"test", "method":"||touch /tmp/evil||"}

The code is executed through shadowsocks-libev/src/manager.c. If the configuration file on the file system is manipulated, the code would get executed as soon as a shadowsocks instance is started from ss-manage, as long as the malicious part of the configuration has not been overwritten.

WORKAROUNDS

There is no workaround available, do not use ss-manage until a patch is released.

ABOUT X41 D-SEC GMBH

X41 D-Sec is a provider of application security services. We focus on application code reviews, design review and security testing. X41 D-Sec GmbH was founded in 2015 by Markus Vervier. We support customers in various industries such as finance, software development and public institutions.