ReQuest F3 Media Server Unauthenticated RCE via File Upload (ZSL-2020-5602)

Critical Vulnerability Information Title: ReQuest Serious Play F3 Media Server 7.0.3 Unauthenticated Remote Code Execution Advisory ID: ZSL-2020-5602 Type: Local/Remote Impact: System Access, DoS Risk: 5/5 Release Date: 18.10.2020 Summary: F3 combines all the features of ReQuest's multi-zone Serious Play servers into a compact digital media library. With the ability to add unlimited NAS devices, F3 can easily manage your entire family's media collection. Description: The web server in ReQuest ARQ F3 contains an unauthenticated remote code execution vulnerability. By abusing the hidden ReQuest Internal Utilities page (/tools), attackers can exploit the quick file uploader page (/tools/upload.html) to upload PHP executable files, resulting in remote code execution under the web server user context. Vendor: ReQuest Serious Play LLC - http://www.request.com Affected Versions: 7.0.3.4968 (Pro) 7.0.2.4954 6.5.2.4954 6.4.2.4681 6.3.2.4203 2.0.1.823 Tested On: ReQuest Serious Play® OS v7.0.1 ReQuest Serious Play® OS v6.0.0 Debian GNU/Linux 5.0 Linux 3.2.0-4-686-pae Linux 2.6.36-request+lenny5 Apache/2.2.22 Apache/2.2.9 PHP/5.4.45 PHP/5.2.6-1 Vendor Status: [01.08.2020] Vulnerability discovered. [16.08.2020] Vendor contacted. [17.10.2020] No response from vendor. [18.10.2020] Public security advisory released. Proof of Concept: request_rce.py Acknowledgments: Vulnerability discovered by Gjoko Krstic - References: [1] https://packetstormsecurity.com/files/159607/ [2] https://cxsecurity.com/issue/WLB-2020100116 [3] https://exchange.xforce.ibmcloud.com/vulnerabilities/190033 [4] https://www.exploit-db.com/exploits/48952 Change Log: [18.10.2020] - Initial release [20.10.2020] - Added references [1] and [2] [26.10.2020] - Added references [3] and [4] Contact: Zero Science Lab Web: https://www.zeroscience.mk e-mail: lab@zeroscience.mk

Goal Reached Thanks to every supporter — we hit 100%!

ReQuest F3 Media Server Unauthenticated RCE via File Upload (ZSL-2020-5602)