Serviio PRO REST API Unauthenticated RCE Vulnerability (ZSL-2017-5408) Analysis

Critical Vulnerability Information Vulnerability Type: Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Code Execution CVE ID: ZSL-2017-5408 Risk Level: 5/5 Impact: System Access Release Date: May 3, 2017 Vulnerability Description A remote code execution vulnerability exists in Serviio versions installed on remote Windows hosts, due to improper implementation of access control for the REST API and lack of input sanitization when invoking cmd.exe via FFMPEGWrapper to execute system commands. Remote attackers can exploit this flaw by crafting malicious requests and escape sequences to gain system access with SYSTEM privileges. Affected Versions 1.8.0.0 PRO 1.7.1 1.7.0 1.6.1 Test Environment Restlet-Framework v2.2 Windows 7, UPnP 1.0 DLNADOC 1.50, Serviio 1.8 Mac OS X, UPnP 1.0 DLNADOC 1.50, Serviio 1.8 Linux, UPnP 1.0 DLNADOC 1.50, Serviio 1.8 Vendor Status December 12, 2016: Vulnerability discovered. May 2, 2017: Communicated to vendor via Beyond Security’s SecuriTeam Security Disclosure Program. PoC serviio_rce.py Discoverer Gjoko Krstic - Reference Links 1. https://blogs.securiteam.com/index.php/archives/3094 2. https://www.exploit-db.com/exploits/41967/ 3. https://www.exploit-db.com/exploits/420024/ 4. https://packetstormsecurity.com/files/142387/ 5. http://www.securitylab.ru/news/48046.php 6. http://seclists.org/fulldisclosure/2017/May/32 7. https://www.rapid7.com/db/modules/exploit/windows/http/serviio_checkstreamurl_cmd_exec 8. https://exchange.xforce.ibmcloud.com/vulnerabilities/125643

Goal Reached Thanks to every supporter — we hit 100%!

Serviio PRO REST API Unauthenticated RCE Vulnerability (ZSL-2017-5408) Analysis