Security advisory: multiple vulnerabilities including Authenticated RCE (property injection), Hardcoded credentials, Pre-authentication root RCE in CatDV Server 10.7.8 (Square Box Systems)
disclosure via Fulldisclosure ·
0day Rubbish Research Team is publicly disclosing 3 vulnerabilities in CatDV Server 10.7.8 (Square Box Systems). The
research is published and a proof-of-concept is available.
Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)
A three-defect chain turns any deployment into an unauthenticated root RCE. An RMI connect(null) path makes the server
mint a ClientID using its own internal client.regcode system property (zero attacker credentials). A saveSettings
method gated only by that ClientID with no admin check writes an attacker-controlled catdv.aaftoolPath into the JVM
system properties. An AAFExportHandler ProcessUtils.exec sink runs that path as root on every AAF export request. The
factory-default empty admin password closes the chain by supplying the admin session needed to reach the AAF trigger.
Dynamic verification produced uid=0(root).
Impact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); the attacker holds no
product license key and no user credentials.
Advisory: https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce
Vulnerability 2: Hardcoded credentials (CVSS 9.8, pre-authentication)
The factory-default database seed creates the built-in admin user with password=0 and passwordHash=NULL. The password
verification routine skips the PBKDF2 path when passwordHash is null and falls back to a legacy simpleMD5Hash path,
where simpleMD5Hash('') returns 0 and 0 == 0 evaluates to true. Anyone who can reach the CatDV web login endpoint can
authenticate as the administrator using admin with an empty password, as long as the factory default has not been
changed. This grants full administrator control of the MAM server and is the credential prerequisite for the
authenticated root RCE chain.
Impact: Full administrator takeover of the CatDV server using the well-known built-in admin username with an empty
password; the admin session can read or alter any catalog data, server configuration, or user account.
Advisory: https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password
Vulnerability 3: Authenticated RCE (property injection) (CVSS 7.6, authenticated)
An authenticated administrator can turn any running deployment into a root RCE by injecting the catdv.aaftoolPath JVM
system property to point at an attacker-controlled script and then triggering an AAF export. The type-23
'server-config' setting is applied verbatim as System.setProperty(key, value) pairs with no property whitelist, and
AAFExportHandler runs that property via ProcessUtils.exec as root on every AAF export request. The injected property is
auto-applied on the next request (1s throttle), so no server restart is needed. Dynamic verification produced
uid=0(root).
Impact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); an admin session on the
web API is required.
Advisory: https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce
PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish
--
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/