Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass Vulnerability

Title: Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass Advisory ID: ZSL-2018-5500 Type: Local/Remote Impact: Security Bypass, System Access Risk: (5/5) Release Date: 17.11.2018 Summary: - netBooter™ NP-02B and NP-02BH offer independent control of one or two outlets in a compact, rugged design. These devices can be managed via TCP/IP network or direct serial connection, and include optional 1U brackets for mounting. They enable power control for your devices and are designed to fit in almost any environment. - netBooter™ NP-0801DU and NP-0801DUH PDUs provide secure remote power management for eight independent outlets. They feature true RMS AC current measurement and environment temperature monitoring via TCP/IP networks or local direct connection. Description: - netBooter is vulnerable to an authentication bypass due to missing control checks when calling the script during user creation. This allows an unauthenticated attacker to create an admin user account, bypass authentication, and gain control over power supply to critical resources. Vendor: - Synaccess Networks Inc. - https://www.synaccess-net.com Affected Version: - NP-0201D (ver 6.8C) - NP-02 (ver 6.5C) - NP-02 (ver 6.4BC) - NP-0801D (ver 6.4A4) - NP-08 (ver 6.10) - NP-02 (ver 5.53BC) Tested On: - Synaccess server Vendor Status: - [05.11.2018] Vulnerability discovered. - [06.11.2018] Vendor contacted. - [16.11.2018] No response from vendor. - [17.11.2018] Public security advisory released. PoC: - netbooter_auth.txt Credits: - Vulnerability discovered by Gjoko Krstic - References: - [1] https://packetstormsecurity.com/files/150396 - [2] https://exchange.xforce.ibmcloud.com/vulnerabilities/153124 - [3] https://cxsecurity.com/issue/WLB-2018110158 - [4] https://www.exploit-db.com/exploits/45920 Changelog: - [17.11.2018] - Initial release - [20.11.2018] - Added reference [1] and [2] - [23.11.2018] - Added reference [3] - [01.12.2018] - Added reference [4] Contact**: - Zero Science Lab - Web: http://www.zeroscience.mk - e-mail: lab@zeroscience.mk

Goal Reached Thanks to every supporter — we hit 100%!

Synaccess netBooter NP-02x/NP-08x 6.8 Authentication Bypass Vulnerability