Security advisory: multiple vulnerabilities including Authenticated RCE (property injection), Hardcoded credentials, Pre-authentication root RCE in CatDV Server 10.7.8 (Square Box Systems)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing 3 vulnerabilities in CatDV Server 10.7.8 (Square Box Systems). The 
research is published and a proof-of-concept is available.

Vulnerability 1: Pre-authentication root RCE (CVSS 9.8, pre-authentication)

A three-defect chain turns any deployment into an unauthenticated root RCE. An RMI connect(null) path makes the server 
mint a ClientID using its own internal client.regcode system property (zero attacker credentials). A saveSettings 
method gated only by that ClientID with no admin check writes an attacker-controlled catdv.aaftoolPath into the JVM 
system properties. An AAFExportHandler ProcessUtils.exec sink runs that path as root on every AAF export request. The 
factory-default empty admin password closes the chain by supplying the admin session needed to reach the AAF trigger. 
Dynamic verification produced uid=0(root).

Impact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); the attacker holds no 
product license key and no user credentials.

Advisory: https://0day-rubbish.com/blog/catdv-server-unauth-rmi-root-rce

Vulnerability 2: Hardcoded credentials (CVSS 9.8, pre-authentication)

The factory-default database seed creates the built-in admin user with password=0 and passwordHash=NULL. The password 
verification routine skips the PBKDF2 path when passwordHash is null and falls back to a legacy simpleMD5Hash path, 
where simpleMD5Hash('') returns 0 and 0 == 0 evaluates to true. Anyone who can reach the CatDV web login endpoint can 
authenticate as the administrator using admin with an empty password, as long as the factory default has not been 
changed. This grants full administrator control of the MAM server and is the credential prerequisite for the 
authenticated root RCE chain.

Impact: Full administrator takeover of the CatDV server using the well-known built-in admin username with an empty 
password; the admin session can read or alter any catalog data, server configuration, or user account.

Advisory: https://0day-rubbish.com/blog/catdv-server-admin-factory-default-empty-password

Vulnerability 3: Authenticated RCE (property injection) (CVSS 7.6, authenticated)

An authenticated administrator can turn any running deployment into a root RCE by injecting the catdv.aaftoolPath JVM 
system property to point at an attacker-controlled script and then triggering an AAF export. The type-23 
'server-config' setting is applied verbatim as System.setProperty(key, value) pairs with no property whitelist, and 
AAFExportHandler runs that property via ProcessUtils.exec as root on every AAF export request. The injected property is 
auto-applied on the next request (1s throttle), so no server restart is needed. Dynamic verification produced 
uid=0(root).

Impact: Full compromise of the CatDV server and arbitrary command execution as root (uid=0); an admin session on the 
web API is required.

Advisory: https://0day-rubbish.com/blog/catdv-server-aaftoolPath-root-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/