lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 30 Jan 2020 08:37:54 +0100
From: Błażej Adamczyk <blazej.adamczyk@...il.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: Re: [FD] Multiple vulnerabilities in TOTOLINK and other Realtek SDK
 based routers

UPDATE:
As there is no response from direct vendors (TOTOLINK and other) and
because the vulnerablity has a big impact (CVSSv3: 9.6, 70k vulnerable
devices on Internet) I decided to publish the exploit code:
https://sploit.tech/files/CVE-2019-19822-19825-exploit.sh

I kindly ask to spread information about the threat to make the users
aware of the problem and maybe force vendors to reconsider patching
their products..

Video: https://youtu.be/6PtbTvagcD4
More info: https://sploit.tech/2019/12/16/Realtek-TOTOLINK.html

-- 
Kind regards,
Blazej Adamczyk


-------- Original Message ----------
From: Błażej Adamczyk <blazej.adamczyk@...il.com>
To: fulldisclosure@...lists.org <fulldisclosure@...lists.org>
Topic: Multiple vulnerabilities in TOTOLINK and other Realtek SDK based
routers
Date: Thu, 23 Jan 2020 23:35:05 +0100

           ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
             MULTIPLE VULNERABILITIES IN SEVERAL SERIES OF
              REALTEK SDK BASED ROUTERS (TOTOLINK AND MANY
                                 OTHER)


                          Blazej Adamczyk (br0x)
                        blazej.adamczyk@...il.com
                          https://sploit.tech/
           ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━


                               11.12.2019





1 Sensitive data disclosure and incorrect access control in several
series
of Realtek SDK based routers
═══════════════════════════════════════════════════════════════════════
═══

  CVE: CVE-2019-19822

  SDK vendor: Realtek

  Device vendor: TOTOLINK, Sapido, CIK Telecom, Fibergate Inc.,
  MAX-C300N, T-BROAD and possibly others..

  Product: Realtek SDK based routers backed by Boa HTTP server (and
  possibly others) and using apmib library for memory management.

  Boa Version: <= Boa/0.94.14rc21 SDK Version: < 2020/02/15

  Description: Realtek SDK based routers which use form based instead
  HTTP Basic authentication (that includes Realtek APMIB 0.11f and Boa
  HTTP server 0.94.14rc21) allows remote attackers to retrieve the
  configuration, including sensitive data (usernames and passwords).

  This affects:
  • TOTOLINK A3002RU through 2.0.0,
  • TOTOLINK 702R through 2.1.3,
  • TOTOLINK N301RT through 2.1.6,
  • TOTOLINK N302R through 3.4.0,
  • TOTOLINK N300RT through 3.4.0,
  • TOTOLINK N200RE through 4.0.0,
  • TOTOLINK N150RT through 3.4.0, and
  • TOTOLINK N100RE through 3.4.0;
  • Rutek RTK 11N AP through 2019-12-12;
  • Sapido GR297n through 2019-12-12;
  • CIK TELECOM MESH ROUTER through 2019-12-12;
  • KCTVJEJU Wireless AP through 2019-12-12;
  • Fibergate FGN-R2 through 2019-12-12;
  • Hi-Wifi MAX-C300N through 2019-12-12;
  • HCN MAX-C300N through 2019-12-12;
  • T-broad GN-866ac through 2019-12-12;
  • Coship EMTA AP through 2019-12-12; and
  • IO-Data WN-AC1167R through 2019-12-12; and
  • possibly others.

  Technical details: The apmib library at some point of initialization
  dumps the whole memory contents the file /web/config.dat. This folder
  is actually used by the boa http server as index directory.
  Additionally if the router is configured for form-based
authentication
  the access control verifies credentials only for some URLs but ".dat"
  files are not restricted. This issue does not affect routers which
use
  HTTP Basic authentication to secure all URLs.

  PoC:
  ┌────
  │ $ curl http://routerip/config.dat
  └────


2 Password stored in plaintext in Realtek SDK based routers
═══════════════════════════════════════════════════════════

  CVE: CVE-2019-19823

  SDK vendor: Realtek

  Device vendor: TOTOLINK, Sapido, CIK Telecom, Fibergate Inc.,
  MAX-C300N, T-BROAD and possibly others..

  Product: Realtek SDK based routers backed by Boa HTTP server (and
  possibly others) and using apmib library for memory management.

  Boa Version: <= Boa/0.94.14rc21 SDK Version: < 2020/02/15

  Description: Realtek SDK based routers (that includes Realtek APMIB
  0.11f and Boa HTTP server 0.94.14rc21) store passwords in plaintext.

  This affects:
  • TOTOLINK A3002RU through 2.0.0,
  • TOTOLINK 702R through 2.1.3,
  • TOTOLINK N301RT through 2.1.6,
  • TOTOLINK N302R through 3.4.0,
  • TOTOLINK N300RT through 3.4.0,
  • TOTOLINK N200RE through 4.0.0,
  • TOTOLINK N150RT through 3.4.0, and
  • TOTOLINK N100RE through 3.4.0;
  • Rutek RTK 11N AP through 2019-12-12;
  • Sapido GR297n through 2019-12-12;
  • CIK TELECOM MESH ROUTER through 2019-12-12;
  • KCTVJEJU Wireless AP through 2019-12-12;
  • Fibergate FGN-R2 through 2019-12-12;
  • Hi-Wifi MAX-C300N through 2019-12-12;
  • HCN MAX-C300N through 2019-12-12;
  • T-broad GN-866ac through 2019-12-12;
  • Coship EMTA AP through 2019-12-12; and
  • IO-Data WN-AC1167R through 2019-12-12; and
  • possibly others.

  Technical details: Data stored in memory in COMPCS (apmib library)
  format contains device administration and other passwords in
  plaintext. The apmib library additionally at some point of
  initialization dumps the whole memory contents the file
  /web/config.dat which might be used to easily retrieve user
passwords.


3 Code execution in several TOTOLINK routers
════════════════════════════════════════════

  CVE: CVE-2019-19824

  Vendor: TOTOLINK

  Product: TOTOLINK Realtek SDK based routers

  Boa Version: <= Boa/0.94.14rc21

  Description: On several Realted SDK based TOTOLINK routers, an
  authenticated attacker may execute arbitrary OS commands via the
  sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI
  (syscmd.htm) is not available. This allows for full control over the
  device's internals.

  This affects:
  • A3002RU through 2.0.0,
  • A702R through 2.1.3,
  • N301RT through 2.1.6,
  • N302R through 3.4.0,
  • N300RT through 3.4.0,
  • N200RE through 4.0.0,
  • N150RT through 3.4.0,
  • N100RE through 3.4.0, and
  • possibly others.

  PoC:
  ┌────
  │ $ curl 'http://routerip/boafrm/formSysCmd' --user "admin:password" 
  │   --data 'submit-url=%2Fsyscmd.htm&sysCmdselect=5&sysCmdselects=0&
 
│   save_apply=Run+Command&sysCmd=cp%20%2Fetc%2Fpasswd%20%2Fweb%2Fxxxx.
dat'
  └────


4 Incorrectly implemented captcha protection in TOTOLINK routers
════════════════════════════════════════════════════════════════

  CVE: CVE-2019-19825

  Vendor: TOTOLINK

  Product: TOTOLINK Realtek SDK based routers

  Boa Version: <= Boa/0.94.14rc21

  Description: Guessable captcha vulnerability (CWE-804) in several
  series of TOTOLINK routers allows a remote attacker to automatically
  login to the router without reading and providing real captcha.

  The following command returns captcha in plain text:
  ┌────
  │ $ curl 'http://routerip/boafrm/formLogin' --data
'{"topicurl":"setting/getSanvas"}'
  └────

  Additionally by using the HTTP Basic in a HEADER the attacker can
  execute router actions without providing captcha at all.

  This affects:
  • A3002RU through 2.0.0,
  • A702R through 2.1.3,
  • N301RT through 2.1.6,
  • N302R through 3.4.0,
  • N300RT through 3.4.0,
  • N200RE through 4.0.0,
  • N150RT through 3.4.0,
  • N100RE through 3.4.0, and
  • possibly others.


5 Exploiting all together on TOTOLINK routers
═════════════════════════════════════════════

  CVSS v3 socre: 9.6 AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (assuming
  Administrative Access on WAN is enabled the score is 10.0)

  Exploiting all the vulnerabilities together allows a remote
  unauthenticated attacker to execute any code with root permissions
and
  reveal administration password.

  The only thing that is needed is the access to router administration
  interface (either access to local network or Administrative Access on
  WAN enabled)

  Description, video and possibly an exploit:
  https://sploit.tech/2019/12/16/Realtek-TOTOLINK.html

  Timeline:
  • 17.12.2019 - Contacted all identified vendors, i.e. TOTOLINK, CIK
    Telecom, Sapido, Fibergate and Coship.
  • 18.12.2019 - received TOTOLINK first line support response totally
    not related to my message and showing me how to log into my router.
    I responded right away and asked to forward the message to
    technical/security team.
  • 19.12.2019 - received response from CIK Telecom stating that the
    routers support encryption (SIC!). I replied asking to forward the
    message to technical/security team.
  • 19.12.20219 - CIK Telecom responded that for further assistance I
    should contact them over the phone. I replied that I need to
explain
    the details as a written message as this is technical.
  • 27.12.2019, 06.01.2020 - I resent the messages to TOTOLINK and CIK
    Telecom but none have replied till the date of disclosure.
  • 06.01.2020 - I finally contacted Realtek as the Supplier of the
SDK.
  • 10.01.2020 - I got a response and I replied with encrypted details
    on the bugs.
  • 14-15.01.2020 - Realtek replied that the issue with dumping
    configuration by apmib exists but it is not directly exploitable in
    the defualt SDK configuration becuase it uses HTTP Basic
    authentication which protects all URLs. They agreed however that
    most of the Vendors modify the software including authentication
    mechanism thus making it vulnerable.
  • 23.01.2020 - Realtek responded that they are goining to fix the
    issue with dumping configuration to the config.dat file in version
    released on 15.02.2020. They also said that after fixing the issue
    the impact of storing password in plaintext is less significant
thus
    they will not fix the CVE-2019-19823 yet but will try to fix it in
    the future.

  Temporary workaround: Unfortunately I did not get any good
information
  from real vendors like TOTOLINK and for now I would suggest to
disable
  administration interface from WAN and restricting LAN router
  administration interface access using some kind of firewall if
  possible.

  Credit: Blazej Adamczyk | blazej.adamczyk@...il.com | http://sploit.t
ech/
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists