Promise NAS NS4300N GUI bug

List,

There is a bug in the Promise NAS NS4300N web GUI (firmware version 1.1.0.5) which allows an authenticated (admin) user to change the password of the
'root' account.

The user management portion of the web interface allows the admin user to change user's passwords. The PHP script that handles this does not check to see if the admin is changing a user account or system accounts such as
'root'.

By changing the value of the 'user' parameter to 'root' (from whatever user id whose password is being changed, e.g. 'admin' if you have not defined any users) in the POST request to /usercp.php, we can provide a known password for the root account and thereby login to the NAS (which is normally not possible because Promise has not divulged root's password).

The vendor has not been notified, but this is hardly a critical issue..?

Tor

moonshade:~$ telnet 192.168.5.16 2380
Trying 192.168.5.16...
Connected to 192.168.5.16.
Escape character is '^]'.
NS4300N R1.1 A10 (Version 01.01.0000.05) - Promise Technology, INC. nas login: root
Password:

BusyBox v1.00-rc2 (2006.11.07-01:55+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

root is allowed to login.
[root@nas]# dmesg
Linux version 2.6.11SR1_1_2 (root@localhost.localdomain) (gcc version 3.4.1) #2 Tue Apr 3 15:43:13 CST 2007 On node 0 totalpages: 32768
  DMA zone: 32768 pages, LIFO batch:8
  Normal zone: 0 pages, LIFO batch:1
  HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=/dev/ram rw console=ttyS0,115200 IPIC (128 IRQ sources, 8 External IRQs) at fe000700 PID hash table entries: 1024 (order: 10, 16384 bytes) Console: colour dummy device 80x25
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Memory: 123936k available (2276k kernel code, 660k data, 312k init, 0k highmem) Calibrating delay loop... 265.21 BogoMIPS (lpj=132608)

--
http://www.bogus.net/~torh