"When functionality and comfort come together, the result is a
state-of-the-art experience that we've dubbed 'comfortphoning'. It's a
secure, scalable digital communication solution that meets every need
and wish. STARFACE is easy to integrate into existing IT systems and
flexibly grows with your requirements."
(from the vendor's homepage)
More Details
============
The image of STARFACE PBX [0] in version 7.3.0.10 can be downloaded from
the vendor's homepage [1]. The included files can be further examined by
either extracting the contents or running the image in a virtual
machine. The web interface of the PBX uses the JavaScript file at the
following path to submit the login form:
The JavaScript object "defaultVals" is included in the web application's
source text. While the value of "defaultVals.k" was found to be the
static hash of the PBX version, the value of "defaultVals.bk" contains a
nonce only valid for the currently used session. Therefore, the form
parameter "ack" is always the same value. For the form value "secret"
the function "createHash()" is called with different arguments. The
value of "defaultVals.isAd" is set to "false" when login via Active
Directory is disabled. The parameters "liv" and "lpv" contain the
username and password entered into the form respectively.
The expression right after the second return statement is the
implementation used when Active Directory login is disabled which is the
default setting. The return value is composed of the username separated
via a colon from a value built using the "forSF()" function. The
"forSF()" function was found to calculate the SHA512 hash value. When
considering the arguments passed to the function, the hash is calculated
as follows:
As can be seen, instead of the cleartext password the SHA512 hash of the
password is used in the calculation. In conclusion, for the form value
"secret" the following value is transmitted:
If the SHA512 hash of a user's password is known, it can be directly
used in the calculation of the "secret" during the login process.
Knowledge of the cleartext password is not required.
This finding was also verified by analysing the decompiled Java code of
the server component. It was also found that the authentication process
of the REST API is vulnerable in a very similar manner.
Proof of Concept
================
The following Python script can be used to perform a login by specifying
a target URL, a username and the associated password hash:
When the password hash is valid for the specified user of the targeted
instance a session ID as well as a REST API token is returned.
Afterwards, these values can be used to interact with the web
application and the REST API.
Workaround
==========
None
Fix
===
On 4 May 2023, version 8.0.0.11 was released. In this version the
vulnerability was addressed with a temporary solution, such that the
password hashes are encrypted before they are saved in the database.
This approach prevents attackers from exploiting this vulnerability in
scenarios where they have only acquired pure database access. However,
attackers with system level access can bypass this temporary measure as
they can extract the encryption key and decrypt the hashes in the
database. A solution that fixes this vulnerability entirely is still in
progress.
Security Risk
=============
The web interface and REST API of STARFACE allow to login using the
password hash instead of the cleartext password. This can be exploited
by attackers who gained access to the application's database where the
passwords are also saved as a SHA512 hash of the cleartext passwords.
While the precondition for this attack could be the full compromise of
the STARFACE PBX, another attack scenario could be that attackers
acquire access to backups of the database stored on another system.
Furthermore, the login via password hash allows attackers for permanent
unauthorised access to the web interface even if system access was
obtained only temporarily. Due to the prerequisites of obtaining access
to password hashes, the vulnerability poses a low risk only.
Timeline
========
2022-12-06 Vulnerability identified
2022-12-13 Customer approved disclosure to vendor
2023-01-11 Vendor notified
2023-05-04 Vendor released new version 8.0.0.11
2023-05-19 CVE ID requested
2023-05-20 CVE ID assigned
2023-06-01 Advisory released
RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.
As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.
More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/
Working at RedTeam Pentesting
=============================
RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:
https://jobs.redteam-pentesting.de/