Authenticated Command Injection

Vulnerability overview/description:

1. Command Injection in Admin Interface

A command injection vulnerability was found in "pingtest_action.cgi".
This script is vulnerable since it is possible to inject a value of a
variable. One of the reasons for this behaviour is the used PHP version
(PHP/FI 2.0.1 from 1997).

The vulnerability can be exploited by luring an attacked user to click
on a crafted link or just surf on a malicious website. The whole attack
can be performed via a single GET-request and is very simple since there
is no CSRF protection.

An attacker can open a port binding or reverse shell to connect to the
device and is also able to change the "passwd" since the web service
runs with root privileges!

Furthermore, low privileged read-only users, which can be created in the web
interface, are also able to perform this attack.

If the Ubiquiti device acts as router or even as firewall, the attacker
can take over the whole network by exploiting this vulnerability.

Proof of concept:

1. Command Injection in Admin Interface

The following link can be used to open a reverse shell to the attacker's
IP address. There are two possibilities for the different firmware
versions.
Reverse root shell - firmware: v1.3.3 (SW)
[ PoC removed - no patch available ]

Reverse root shell - firmware: v5.6.9/v6.0 (XM)
[ PoC removed - no patch available ]

A video is available here: https://youtu.be/oU8GNeP_Aps

Vulnerable / tested versions:
The following devices and firmware versions have been tested/verified:
TS-8-PRO                     - v1.3.3 (SW)
(Rocket) M5                  - v5.6.9/v6.0 (XM)
(PicoStationM2HP) PICOM2HP   - v5.6.9/v6.0 (XM)
(NanoStationM5) NSM5         - v5.6.9/v6.0 (XM)

Based on information embedded in the firmware of other Ubiquiti products
gathered from our IoT Inspector tool we believe the following devices are
affected as well:

Ubiquiti Networks AF24 (Version: AF24 v3.2)
Ubiquiti Networks AF24HD (Version: AF24 v3.2)
Ubiquiti Networks AF-2X (Version: AF2X v3.2 )
Ubiquiti Networks AF-3X (Version: AF3X v3.2)
Ubiquiti Networks AF5 (Version: AF5 v3.2)
Ubiquiti Networks AF5U (Version: AF5 v3.2)
Ubiquiti Networks AF-5X (Version: AF5X v3.2.1)
Ubiquiti Networks AG-PRO-INS (Version: AirGWP v1.1.7)
Ubiquiti Networks airGateway (Version: AirGW v1.1.7)
Ubiquiti Networks airGateway-LR (Version: AirGW v1.1.7)
Ubiquiti Networks AMG-PRO (Version: AirGWP v1.1.7)
Ubiquiti Networks LBE-5AC-16-120 (Version: WA v7.2.4)
Ubiquiti Networks LBE-5AC-23 (Version: WA v7.2.4)
Ubiquiti Networks LBE-M5-23 (Version: XW v5.6.9/v6.0)
Ubiquiti Networks NBE-5AC-16 (Version: WA v7.2.4)
Ubiquiti Networks NBE-5AC-19 (Version: XC v7.2.4)
Ubiquiti Networks NBE-M2-13 (Version: XW v5.6.9/v6.0)
Ubiquiti Networks NBE-M5-16 (Version: XW v5.6.9/v6.0)
Ubiquiti Networks NBE-M5-19 (Version: XW v5.6.9/v6.0)
Ubiquiti Networks PBE-5AC-300 (Version: XC v7.2.4)
Ubiquiti Networks PBE-5AC-300-ISO (Version: XC v7.2.4)
Ubiquiti Networks PBE-5AC-400 (Version: XC v7.2.4)
Ubiquiti Networks PBE-5AC-400-ISO (Version: XC v7.2.4)
Ubiquiti Networks PBE-5AC-500 (Version: XC v7.2.4)
Ubiquiti Networks PBE-5AC-500-ISO (Version: XC v7.2.4)
Ubiquiti Networks PBE-5AC-620 (Version: XC v7.2.4)
Ubiquiti Networks PBE-M2-400 (Version: XW v5.6.9/v6.0)
Ubiquiti Networks PBE-M5-300 (Version: XW v5.6.9/v6.0)
Ubiquiti Networks PBE-M5-300-ISO (Version: XW v5.6.9/v6.0)
Ubiquiti Networks PBE-M5-400 (Version: XW v5.6.9/v6.0)
Ubiquiti Networks PBE-M5-400-ISO (Version: XW v5.6.9/v6.0)
Ubiquiti Networks PBE-M5-620 (Version: XW v5.6.9/v6.0)
Ubiquiti Networks R5AC-Lite (Version: XC v7.2.4)
Ubiquiti Networks R5AC-PRISM (Version: XC v7.2.4)
Ubiquiti Networks R5AC-PTMP (Version: XC v7.2.4)
Ubiquiti Networks R5AC-PTP (Version: XC v7.2.4)
Ubiquiti Networks RM2-Ti (Version: XW v5.6.9/v6.0)
Ubiquiti Networks RM5-Ti (Version: XW v5.6.9/v6.0)