=====================================================================
 BEGIN      Foofus.net Security Advisory: foofus-20120817      BEGIN
=====================================================================
Title: IOServer "Root Directory" Trailing Backslash Web Server Vuln
Allows: Arbitrary File Access, Directory Listing, Directory Traversal
CVSS Base / Temporal / Overall Scores: 7.8 / 6.4 / 6.4
Advisory Version: 2 (first publicly released version is 2)
Advisory Release Date: 2012-08-17
Advisory Last Updated: 2012-08-17
Vendor: IOServer Pty Ltd.  http://www.ioserver.com/
Affected Product: IOServer 1.0.18.0 (and earlier?)
Issue Status: fixed version and workarounds available
Link: http://www.foofus.net/?page_id=616
=====================================================================

1. Summary
== =======

IOServer is a piece of industrial control software that runs on Windows.
It contains a built-in web server to support the "XML Server" feature.
This web server can be abused to download any file on the file system
without authentication, if the "Root Directory" setting does not contain
a trailing backslash. Note that a sample configuration provided with the
product exhibits a vulnerable configuration.

2. Description
== ===========

The vendor's web site describes IOServer thusly:

"OPC (OLE for Process Control) Server for Windows NT 4.0 / 95 / 98 /
ME / 2000 / 2003 / XP / 2008 / 7. Interface to multiple protocols
through a single OPC Server. This software allows OPC clients such as
HMI (Human Machine Interface) and SCADA (Supervisory Control and Data
Acquisition) systems to exchange plant floor data with PLC (Programmable
Logic Controllers)."

If the "XML Server" feature is turned on (apparently by configuring a
valid "Root Directory" on the "XML Server" tab), the integrated web
server listens on the configured port (81 by default). If the "Root
Directory" configuration value does not contain a trailing backslash,
then these issues exist.

A directory traversal vulnerability exists such that the web server can
be tricked to serve up any file on the server, outside of the configured
"Root Directory". On Windows, one common thing to do with an issue like
this is to download the backup copy of the SAM, in order to retrieve
password hashes and mount an offline attack on them. Any other
potentially sensitive file on the server can be accessed this way as
well, if the attacker knows the path to it.

Note that directory traversal is only needed if you want to break out of
the "Root Directory". The web server will serve up files inside the
"Root Directory" just by asking it for them. This may or may not be
considered a vulnerability, depending on the expectations of the
administrator.

Also, the web server allows directory listings in some cases, whether
inside or outside the "Root Directory". Again, this may or may not be
considered a vulnerability depending on expectations.

Note also that the "XML Server Settings" tab contains fields for a "Read
Password" and "Write Password", which are apparently intended to only
restrict access to the devices via the XML web interface (they are not
intended to restrict access to other content served by the web server).
By default, they are set to blank. But due to their intended use of
resticting device access, they do nothing to stop access to the file
system as described here even if they are set to some value.

3. Proof of Concept / Steps to Reproduce
== ===== == ======= = ===== == =========

Install the software and use the sample Modbus Web Server configuration
from http://www.ioserver.com/mbtcp.io to get it working. This sample
configuration uses the "Root Directory" value of "C:\Program Files
\IOServer\Docs" (note the lack of a trailing backslash). This directory
does not exist unless you install the documentation package (isodoc.exe,
available from the vendor web site). You can get to a vulnerable
configuration if you leave the "Root Directory" alone and install the
documentation package, or just modify the "Root "Directory" value to
something valid (but lacking a trailing backslash) like "C:\Program
Files\IOServer". Note that the software or server may need to be
restarted, then you will see a web server listening on the configured
port (81 by default).

Note that more recent versions of the software default to "C:\IOServer"
rather than "C:\Program Files\IOServer". This does not affect the issues
discussed here.

To request files within the "Root Directory", just ask for them with a
browser or command-line tool like wget:

wget http://target-server:81/modbus.dll

To get a directory listing, just ask:

wget http://target-server:81/

To request files outside of the "Root Directory", use a standard
directory traversal trick with a client or browser that supports it.
Note that IE probably will not allow this type of malfeasance:

wget http://target-server:81/.../.../.../windows/repair/sam

To get a directory listing outside of the "Root Directory", ask for it
with the directory traversal trick:

wget http://target-server:81/.../.../.../windows/

Note that it is only this directory traversal issue that was fixed in
version 1.0.19.0. Accessing files and directory listings inside the
"Root Directory" is apparently intended operation.

4. Impact
== ======

Unexpected arbitrary access to the file system can lead to the
disclosure of sensitive information. Worst case, disclosure of the
system's password hashes can lead to compromise of the passwords, and
therefore, of the server.

5. CVSS Scoring
== ==== =======

Using http://nvd.nist.gov/cvss.cfm?calculator&version=2

CVSS Base Score: 7.8
Impact Subscore: 6.9
Exploitability Subscore: 10
CVSS Temporal Score: 6.4
Overall CVSS Score: 6.4

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality Impact: Complete
Integrity Impact: None
Availability Impact: None
Exploitability: Functional exploit exists
Remediation Level: Official fix
Report Confidence: Confirmed

Note that the CVSS calculation was based only on the directory traversal
issue, since it is the most obvious and serious vulnerability addressed
here.

6. Affected Products
== ======== ========

IOServer 1.0.18.0 (earlier versions are also assumed vulnerable)

This was downloaded from http://www.ioserver.com/driver18.exe, which was
the current version as of 23 April 2012. Older versions were not
available, but are assumed vulnerable.

(you can check your version in the IOServer GUI using Help, About
IOServer)

7. Workarounds / Solutions
== =========== = =========

Ensure that the "Root Directory" value has a trailing backslash. This
eliminates most of the issues, although you can still get a directory
listing of the "Root Directory" itself (but not subdirs) even with this
in place.

Of course, limit access to the web server port to only trusted
hosts/networks. Even a fixed version should probably not be exposed to
the Internet or other untrusted networks.

The directory traversal issue was fixed in version 1.0.19.0
(http://www.ioserver.com/driver19.exe), released on 2012-06-20. However,
arbitrary file access and directory listings inside the "Root Directory"
and its subdirs are still possible in this version, unless the trailing
backslash is in place. Note that even with the trailing backslash,
directory listing of the "Root Directory" itself is still possible.

It is recommended that all three of the above actions (use the trailing
backslash, limit access to trusted networks/hosts only, and upgrade to
1.0.19.0 or later) be taken in order to secure this web server as much
as possible.

8. Timeline
== ========

2012-04-23: First vendor contact
2012-04-23: Vendor sends proposed fix (that was fast!)
2012-04-27: Proposed fix found incomplete, feedback to vendor
2012-05-04: Vendor sends second proposed fix
2012-05-17: Verified that second proposed fix resolves all known
directory traversal issues
2012-05-17: Vendor informs that directory listing and arbitrary file
access issues inside the Root Directory are intended functionality
2012-05-18: This issue put on the back burner due to urgent project; I
then completely forget about it (oops, my bad)
2012-06-20: Vendor releases fixed version (1.0.19.0, aka "driver19.exe")
2012-08-08: I remember about this; recheck all information and retest
current version 1.0.19.0; edits to advisory; contact vendor about public
release date
2012-08-17: Public release

9. Credit
== ======

hinge, hinge@foofus.net

Well, actually, this vulnerability was found by Nessus, plugin ID 10297
(which looks for generic web server directory traversal issues, not
specific to IOServer of course). All I did was see it in the scan
results, verify it, reproduce it for testing, report it to the vendor
and write this advisory.

Thanks to my friends at foofus.net, and to IOServer for being very
responsive and open.

=====================================================================
 END        Foofus.net Security Advisory: foofus-20120817        END
=====================================================================