Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute (ZSL-2023-5780)

Key Information Advisory ID: ZSL-2023-5780 Title: Anevia Flamingo XL 3.2.9 (login) Remote Root Jailbreak Type: Local/Remote Impact: System Access, DoS, Security Bypass Risk: 4/5 Release Date: 11.06.2023 Summary Flamingo XL is a new modular and high-density IPTV head-end product designed for hospitality and corporate markets. It captures live TV and radio content from satellite, cable, digital terrestrial, and analog sources, then streams it over IP networks to STBs, PCs, or other IP-connected devices. The Flamingo XL is built on a modular 4U rack hardware platform, enabling hospitality and corporate video service providers to deliver a mix of channels from various sources over internal IP networks. Description Once an administrator establishes a secure shell session, they are placed in a sandboxed environment using the login binary, which restricts access to a specific set of commands. One of these commands, , can be exploited to escape the jailed shell. A remote attacker can exploit this vulnerability to break out of the restricted environment and gain full root access to the device. Vendor Ateme - https://www.ateme.com Affected Version 3.2.9 Hardware revision 1.0 SoapLive 2.0.3 Tested On GNU/Linux 3.1.4 (x86_64) Apache/2.2.15 (Unix) mod_ssl/2.2.15 OpenSSL/0.9.8g DAV/2 PHP/5.3.6 Vendor Status [13.04.2023] Vulnerability discovered. [13.04.2023] Vendor contacted. [10.06.2023] No response from the vendor. [11.06.2023] Public security advisory released. PoC anevia_jailbreak.txt Credits Vulnerability discovered by Gjoko Krstic - References 1. https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5777.php 2. https://exchange.xforce.ibmcloud.com/vulnerabilities/259062 3. https://packetstormsecurity.com/files/172879/Anevia-Flamingo-XL-3.2.9-Remote-Root-Jailbreak.html 4. https://www.exploit-db.com/exploits/51516 Changelog [11.06.2023] - Initial release [26.07.2023] - Added reference [2], [3] and [4] Contact Zero Science Lab Web: https://www.zeroscience.mk e-mail: lab@zeroscience.mk

Goal Reached Thanks to every supporter — we hit 100%!

Anevia Flamingo XL 3.2.9 Remote Root Jailbreak via Traceroute (ZSL-2023-5780)