[0day-rubbish] Leostream Connection Broker 9.1.37.0 two vulnerabilities (SQLi to root RCE, unauth SSRF)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing two vulnerabilities in Leostream Connection Broker 9.1.37.0.

Vulnerability 1 — Authenticated SQL injection to webshell to root RCE (CVSS 9.1, 
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-89)

call_back.pl?action=user concatenates the unsigned _where parameter into a PostgreSQL WHERE clause; the default 
installation grants SUPERUSER, runs postgres as the webroot owner, and configures NOPASSWD sudo, so lo_export writes a 
webshell and /welcome.pl?c= triggers commands as root.

Vulnerability 2 — Unauthenticated rogue-agent registration + SSRF (CVSS 7.0, 
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-306)

Server.Register is dispatched without the session gate and its token check is optional, letting an anonymous caller 
inject VM records and drive broker outbound TLS connections to attacker-controlled hosts.

Authentication: Vulnerability 1 authenticated (requires valid session); Vulnerability 2 unauthenticated / pre-auth.

Full technical analyses and reproducible proofs-of-concept:
  https://0day-rubbish.com/blog/leostream-postauth-sqli-lo-export-webshell-rce
  https://0day-rubbish.com/blog/leostream-unauth-server-register-ssrf

Project archive (ongoing disclosure series):
  https://github.com/Exploit-Garbage/0day-Rubbish

Vendor has been notified. CVE IDs are pending.

--
0day Rubbish Research Team
disclosure () 0day-rubbish com
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/