🛡️ CVE-2019-7711: Green Hills INTEGRITY RTOS Information Leak

📌 Repository for technical documentation and resources on the Format String vulnerability in the Telnet server of Green Hills INTEGRITY RTOS (v5.0.4).

---

📖 General Description

The vulnerability affects the IPCOMShell (Telnet) server from Interpeak in Green Hills INTEGRITY RTOS 5.0.4, where an undocumented command interpreter allows setting the command input value. This value is used directly as input to printf functions without validation, enabling the execution of malicious format strings.

---

🔍 Impact

✅ Critical information leak: A remote attacker can read system memory addresses. ✅ Attack vector: Exploitation via a standard Telnet session. ✅ Additional risk: Facilitates bypassing protections like ASLR for more advanced attacks (e.g., Return-Oriented Programming).

---

🛠️ Technical Details

🔹 Classification: Format String Vulnerability (CWE-134). 🔹 Exploitation:

• Send sequences such as %x, %p, or %n in the configured command.
• The system returns stack values, registers, or memory instead of literal text. 🔹 Affected components:
• Operating System: Green Hills INTEGRITY RTOS 5.0.4.
• Service: IPCOMShell / Telnet.
• CWE: CWE-134 (Use of unchecked format string).

---

🚀 PoC: Proof of Concept

⚠️ WARNING! This code is for educational and research purposes only. Using it on systems without authorization is illegal.

Steps to reproduce:

1. Connect to the vulnerable device via Telnet:
   root@kitploit:~

   telnet <device-IP>
   

2. Access the undocumented shell:
   root@kitploit:~

   > shell_config_cmd "%p %p %p %p"
   

3. Observe the memory leak: The server will respond with memory addresses (e.g., 0xdeadbeef 0xcafebabe).

---

🛡️ Mitigation and Solutions

To protect affected systems, the following is recommended:

✅ Update the system:

• Apply official patches from Green Hills Software for INTEGRITY RTOS.

✅ Disable Telnet:

• Migrate to secure protocols like SSH (if hardware permits).

✅ Network segmentation:

• Restrict access to Telnet port (23/TCP) via firewalls or Access Control Lists (ACLs).

✅ Security audits:

• Review Telnet service configurations and apply hardening.

---

📚 References and Sources

🔗 Official:

• NVD NIST - CVE-2019-7711
• MITRE CVE Record
• Green Hills Software - Advisory

🔗 Third-party:

• GitHub - GHS-Bugs (bl4ckic3)
• INCIBE-CERT - Alert CVE-2019-7711

---

📊 Risk Metrics (CVSS v3.0)

---

💡 Additional notes:

• The vulnerability was fixed in versions after 5.0.4.
• For more technical details, refer to CWE-134.