Vulnerabilities > CVE-2017-15655 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Asus Asuswrt
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits several pages.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 1 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Seebug
| bulletinFamily | exploit |
| description | ### 1 ASUSWRT <= 3.0.0.4.382.18495 >3.0.0.4.376 - multiple vulnerabilities in httpd server (all versions of AsusWRT at the time of report to vendor, for previous 376 version see next section) #### 1. Highly predictable session tokens The session token is generated for an authenticated user using stdlib rand function. The token generation code looks as follows: ``` ┌──── │ char *generate_token(void){ │ int a=0, b=0, c=0, d=0; │ //char create_token[32]={0}; │ memset(gen_token,0,sizeof(gen_token)); │ srand (time(NULL)); //VULNERABLE │ a=rand(); │ b=rand(); │ c=rand(); │ d=rand(); │ snprintf(gen_token, sizeof(gen_token),"%d%d%d%d", a, b, c, d); │ return gen_token; │ } └──── ``` The code initializes the random number generator each time a token is generated with router epoch time. An attacker can guess a token knowing more or less the time the administrator has logged in. CVE: CVE-2017-15654 Suggested CVSS v3: 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H (Attacker needs administrator interaction and a way to overcome administrator IP check - see next point) Timeline: • 17.09.2017 - vendor notified • 07.11.2017 - vendor releases a fixed version 3.0.0.4.382.18495 #### 2. Not sufficient logged user IP validation An attacker who knows the session token can walkaround the IP verification mechanism by sending requests with a special useragent. The following PoC will download current router configuration even if issued from a different than the logged user IP address: ``` curl "http://ROUTERADDRESS/s.CFG"; -H "Cookie: asus_token=TOKEN" -H 'User-Agent: asusrouter-asusrouter-asusrouter-asusrouter' ``` CVE: CVE-2017-15653 Suggested CVSS v3: 8.3 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H (Attacker needs the session token to execute any action without IP check - see point above) Timeline: • 17.09.2017 - vendor notified • 07.11.2017 - vendor releases a fixed version 3.0.0.4.382.18495 Note to vendor/mitre: for clarity please assign separate CVE to this vulnerability #### 3. Password stored in plain text Asus routers store password in plain text in NVRAM memory. Executing nvram show, or downloading the backup file and decoding it allows anyone to read the administrator password. Having access to telnet (shell) one can execute: ``` nvram show ``` For reading password from backup file see the exploit below. CVE: CVE-2017-15656 Timeline: • 17.09.2017 - vendor notified • 03.01.2018 - vendor stated that the NVRAM will be crypted in February this year #### 4. Logged-in information disclousure An unauthenticated attacker can retrieve information about a logged-in session (if and who [IP address] is currently logged in). This itself is not a vulnerability but together with the two previous it allows for a easy exploit. ``` curl "http://ROUTERADDRESS/Nologin.asp"; ``` Taking all the four together it is easy to gain router access by waiting for an administrator login and retrieving the login/password using his token. Finally it is possible to download the backup file and read the administrator login and password. A ready script is attached to this message. Suggested CVSS v3 for all three (1-3): 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H ### 2 ASUSWRT <=3.0.0.4.376.* This vulnerability affects new Asus routers with not up-to-date firmware, as well as some older end-of-life routers (e.g. RT-N65R, RT-N65U) #### 1. Heap buffer overflow in multiple HTTP headers allows for an unauthenticated remote code execution. Multiple buffer overflow vulnerabilities in HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest so are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits serveral pages. For example the "Host:" header is vulnerable and allows to override the SystemCmd variable which then allows for RCE when the administrator visits serveral pages (for example the network tools router tab). PoC (after running this script, when the administrator visists one of several pages which trigger commands e.g. the network tools tab, the script is being run and outputs the contents of nvram to a css file which can be retrived without authentication) ``` curl 'http://routerIP:8080' -H "Host: xxxxxxxxxxxxxx $(for i in $(seq 1 9700); do echo -n " "; done) \$(nvram show > /www/user/nvram.css )" ``` CVE: CVE-2017-15655 Suggested CVSS v3: 9.6 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (Administrator needs to login and visit certain page at the router website) Timeline: • 17.09.2017 - vendor notified • 18.09.2017 - vendor REFUSED to fix the vulnerability as the routers using the vulnerable firmware are already EOL ALERT: Users having routers not upgradable from 3.0.0.4.376.* or less should CLOSE the http from WAN and should restrict the access to management port from LAN as well! |
| id | SSV:97086 |
| last seen | 2018-01-18 |
| modified | 2018-01-17 |
| published | 2018-01-17 |
| reporter | Root |
| title | Multiple vulnerabilities in all versions of ASUS routers |
References
- http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html
- http://packetstormsecurity.com/files/145921/ASUSWRT-3.0.0.4.382.18495-Session-Hijacking-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2018/Jan/63
- http://seclists.org/fulldisclosure/2018/Jan/63
- http://sploit.tech/2018/01/16/ASUS-part-I.html
- http://sploit.tech/2018/01/16/ASUS-part-I.html