OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack

Overview

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint frontend/api-mdm.php verifies the signed enrollment-request plist with openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...). PKCS7_NOVERIFY disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the SERIAL field taken from the unverified payload, anyone who knows a registered device's serial number can sign a forged plist (SERIAL = victim device, attacker-chosen UDID) with an arbitrary self-signed certificate; POST it unauthenticated to /api-mdm.php/profile (Content-Type: application/pkcs7-signature); and receive the victim device's freshly minted MDM identity: a certificate with CN=<serial> issued by the server's internal MDM device CA, bundled with its private key in a PKCS#12 payload inside the returned .mobileconfig enrollment profile. Additionally, the victim's mobile_device database row is silently overwritten with the attacker-supplied UDID (device-record hijack). With the stolen certificate and key, the attacker can impersonate the victim device on all subsequent MDM traffic (/checkin, /mdm, /parameters), which authenticate callers by the certificate CN (the serial number) via checkSignature() in the same file. This yields control over the victim device's MDM relationship: reading its management data, replacing its push token, and disrupting or redirecting its enrollment. Version 1.2.3 fixes the issue.

Affected

• OCO-Server < 1.2.3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.