Calamp.com Incorrect privilege assignment could lead to full user and vehicle compromise

[Vangelis Stykas <evstykas () gmail com>]

There is also a full write up on https://medium.com/@evstykas/remote-smart-car-hacking-with-just-a-phone-2fe7ca682162 
<https://medium.com/@evstykas/remote-smart-car-hacking-with-just-a-phone-2fe7ca682162>

Vulnerability Security Advisory < 20180501 >
=======================================================================
              title: Incorrect Privilege Assignment
            product: lenderoutlook on colt.calamp-ts.com <http://colt.calamp-ts.com/>
 vulnerable version: latest
      fixed version:  -
         CVE number: -
             impact: critical
              found: 2018-04-31
                 by: Vangelis Stykas & George Lavdanis

=======================================================================

Vendor description:
-------------------
Calamp is a telematics pioneer on M2M that manages more than 1.5M IoT devices.


Vulnerability overview/description:
-----------------------------------
1) Incorrect Privilege Assignment

When a user is logged in https://colt.calamp-ts.com/dashboard/login <https://colt.calamp-ts.com/dashboard/login> , a 
service that is being used by many vendors (such as viper smartstart and directed smartstart) it makes a request to
https://reporting.calamp.com/jasperserver-pro/ <https://reporting.calamp.com/jasperserver-pro/> to login with the same 
user.This server is used to generate reports regarding users vehicles using TIBCO jaspersoft server.
When the reports are run from the dashboard they are limited to user owned vehicles but this is not the case when 
accessing the jaspersoft server directly.
Any report on any user vehicle can run, making location / past whereabouts of vehicles and users available.A lot of 
financial data reports are also available.
Data sources are also viewable / editable / exportable .After exporting clear text passwords of data sources are 
available.
As data sources are editable a ddos can be caused just by editing them.
As data sources are correctly firewalled no direct access is possible.
We can manipulate by editing existing reports , adhoc views and queries to access all the data on the underlying data 
sources and using it to lead to a full compromise of the platform.
Exploiting this also gives access to connect.calamp.com <http://connect.calamp.com/> database.


Proof of concept:
-----------------
1) Incorrect Privilege Assignment:

### Details
* Attack Vector:                HTTP GET
* Prerequisites:                None
* CWE:                          CWE-266: Incorrect Privilege Assignment
* Technical Impact:             View reports of any user / vehicle / iot device, query about any user / vehicle / iot 
device, access underlying data sources.
* Vulnerable query URL:         /



Vulnerable / tested versions:
-----------------------------
https://colt.calamp-ts.com/ <https://colt.calamp-ts.com/>
https://connect.calamp.com/ <https://connect.calamp.com/>

Vendor contact timeline:
------------------------
2018–05–01: Sent support request requesting proper disclosure steps
2018–05–01: Asked via twitter dm on @calamp for an email to sent report
2018–05–02: Reached out via linkedin to a cybersecurity employee at calamp for direction on proper disclosure
2018–05–02: Reached out to CERT which guided us to the proper communication channel
2018–05–02: Calamp answered and acknowledged issue
2018–05–03: Calamp updated us that their are working on a fix
2018–05–12: Calamp notified us that is is patched and after verification we are releasing this.

Attachment: signature.asc
Description: Message signed with OpenPGP

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/