CVE-2018-3879

An attacker sends a POST request to http://127.0.0.1:3000/credentials with a JSON body where string values use single quotes instead of double quotes. Because the json-c library was compiled with JSON_TOKENER_STRICT=0, single-quoted strings are accepted. When the parameters are later re-serialized via sprintf into a new JSON string, the unsanitized single-quoted content can break out of the JSON string context and inject arbitrary JSON keys. These injected keys become column names in the generated SQL UPDATE query, and because sqlite3_exec allows stacked queries, a semicolon in an injected key lets the attacker execute arbitrary SQL statements. The request can be delivered by anyone who can impersonate the remote SmartThings servers (relayed through hubCore), by a malicious SmartApp running inside hubCore (which can make localhost connections), or potentially through the SmartThings mobile application if the attacker possesses a valid OAuth bearer token [ref_id=1].

The vulnerability resides in the credentials handler of the video-core HTTP server, specifically in function sub_3E4EC which parses the JSON POST body for the "/credentials" path. The JSON string is parsed with json_tokener_parse, then parameters are extracted and later re-serialized via sprintf into a new JSON string using format string [8] without any sanitization. The resulting JSON is passed to db_add (sub_28874) which generates and executes a SQL UPDATE query via sqlite3_exec.

The advisory states the vendor patched the vulnerability on 2018-07-17, but no patch diff is included in the bundle. The root cause is the lack of sanitization on user-controlled JSON parameters throughout the parsing and re-serialization logic. To close the vulnerability, the vendor would need to either (a) properly escape or validate all parameter values before inserting them into the sprintf format string, (b) enforce strict JSON parsing (JSON_TOKENER_STRICT=1) to reject single-quoted strings, or (c) use parameterized queries instead of building SQL statements via string concatenation from JSON input [ref_id=1].

The following proof of concept from the advisory demonstrates the vulnerability by crashing the video-core process [ref_id=1]:

``` # using curl from inside the hub, but the same request could be sent using a SmartApp $ sInj='","_id=0 where 1=2;insert into camera values (123,replace(substr(quote(zeroblob((10000 + 1) / 2)), 3, 10000), \"0\", \"A\"),1,1,1,1,1,1,1,1,1,1,1,1,1,1);--":"' $ curl -X POST 'http://127.0.0.1:3000/credentials' -d "{'s3':{'accessKey':'','secretKey':'','directory':'','region':'','bucket':'','sessionToken':'${sInj}'},'videoHostUrl':'127.0.0.1/'}" $ curl -X DELETE "http://127.0.0.1:3000/cameras/123" ```

The first curl injects a SQL query via the sessionToken field using single quotes to break out of the JSON string. The injected SQL creates a camera record with an oversized locationId column. The second curl triggers a stack-based buffer overflow when reading that oversized field (TALOS-2018-0557).