### SummaryAn exploitable vulnerability exists in the torlist update functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause the product to run an attacker-supplied shell script. An attacker can intercept and alter network traffic to trigger this vulnerability.### Tested VersionsCircle with Disney 2.0.1### Product URLshttps://meetcircle.com/### CVSSv3 Score9.6 – CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H### CWECWE-73: External Control of File Name or Path### DetailsCircle with Disney is a network device used to monitor and restrict internet use of children on a given network. When connected to a given network and configured, it immediately begins arp poisoning all other devices on the network, such that it can validate and restrict all traffic as is seen fit by the parent/administrator of the device.Periodically, the device will query outbound towards the meetcircle.co domain, attempting to grab the latest list of known Tor addresses as a gunzipped tarball, shown below in the following snippet:“`#!/bin/shMAC=`cat /tmp/MAC`;TORVER=`cat /tmp/torlist.ver`CIRCLE_ROOT=`cat /tmp/CIRCLE_ROOT`rm -f /tmp/torlist.new.tgz/tmp/wget -t 1 -T 30 -q -O /tmp/torlist.new.tgz "http://download.meetcircle.co/dev/firmware/get_torlist.php? DEVID=$MAC&VER=$TORVER" || exitif [ -s /tmp/torlist.new.tgz ]; then #sanity check tgz file size. size in kbytes gzsize=`du /tmp/torlist.new.tgz | cut -f 1` minsize=5 if [ $gzsize -gt $minsize ]; then cd /tmp tar zxf /tmp/torlist.new.tgz if [ -s /tmp/torlist ]; then $CIRCLE_ROOT/ipsetload torlist /tmp/torlist fi fifirm -f /tmp/torlist.new.tgz“`Unfortunately, since this wget request is not using HTTPS, it becomes trivial for an attacker to supply their own tarball, which would be extracted, allowing an attacker to overwrite any file in the "/tmp" directory. A sample exploit would be to zip up a script named 'wget', such that it would executed in subsequents run of this check_torlist.sh script, (which is scheduled via a cronjob).### Timeline* 2017-08-02- Vendor Disclosure* 2018-10-31 – Public Release
