[0day-rubbish] Cambium cnMatrix EX3024F 6.2.1-r4 SSL CSR COMMON_NAME command injection to root RCE (7.2)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in the Cambium
cnMatrix EX3024F managed switch, firmware 6.2.1-r4.

Type: OS command injection (CWE-78, with CWE-20 bearing on it because
percent-decoding is the only processing applied; CWE-250/CWE-269 bear on
remediation priority). The COMMON_NAME form field submitted to
POST /iss/specific/ssl_digitalcert.html is extracted by HttpGetValuebyName,
percent-decoded by issDecodeSpecialChar, copied with strncpy(buf, COMMON_NAME,
100) and interpolated unfiltered into the double-quoted -subj "%s" argument of an
openssl req command string that the management daemon ISS.exe hands to system().
Five functions stand between the HTTP parser and the sink and none validate the
data. A subject of ";id;echo " closes the quote and injects a statement; the
daemon runs as root, so the injected command does too.

Scoring. This finding is dual-scored, with the deployment-conditional upper
bound published alongside the verified baseline:
- PRIMARY baseline, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. A
  valid administrative session is required; the page is gated by a server-side
  session table plus an administrator privilege check that is on by default.
- CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A
  deployment-conditional upper bound where an installation retains a default,
  weak or publicly known administrator password, a common condition for network
  switches; the privilege prerequisite collapses in practice while the technical
  chain is unchanged.

The advisory does not adopt the recorded vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
with its paired 8.8, because the analysis documents an administrator-only check
rather than any-low-privilege-user access, so PR:H (7.2) is the faithful metric.
A 9.1 scope-changed reading is also rejected: the compromised OS and the daemon
sit inside one authorization domain, the daemon being already root over that OS.

Impact: root command execution on a managed switch, a forwarding-plane device
rather than only a management plane: full compromise of configuration and keys,
installation of a persistent backdoor that survives reboot, a pivot into adjacent
segments, and live manipulation or denial of the traffic it carries.

Authentication: post-authentication administrator.

Verification boundary, stated plainly. Confirmation used an extracted firmware
image under qemu-aarch64-static user-mode emulation. Because the daemon cannot
complete initialisation without the Marvell switch ASIC driver and never binds an
HTTP port in emulation, the real shipped sink function (SslGenCertRequest) was
invoked directly under debugger control with the payload an HTTP POST would
deliver; it returned 0 and wrote a 36-byte root-owned marker containing
uid=0(root) gid=0(root). End-to-end HTTP exploitation against a device was NOT
performed and no physical hardware was used. The five-handler HTTP-to-sink path
is proven statically by decompilation and cross-reference, not by an observed
network request. Any model or firmware revision beyond EX3024F 6.2.1-r4 is
inference and unconfirmed.

Full technical analysis and a reproducible proof-of-concept:
  https://0day-rubbish.com/blog/cambium-cnmatrix-ssl-csr-command-injection

Project archive (ongoing disclosure series):
  https://github.com/Exploit-Garbage/0day-Rubbish

The vendor has been notified through its published security contact. No vulnerability identifier has been assigned to
this finding yet.

--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/