D-Link Plain-Text Password Storage / Code Execution / Directory Traversal

` aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  
MULTIPLE VULNERABILITIES IN D-LINK ROUTERS  
  
  
Blazej Adamczyk (br0x)  
[email protected]  
http://sploit.tech/  
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  
  
  
12.10.2018  
  
  
1 Directory Traversal in httpd server in several series of D-Link  
routers  
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  
aa  
  
CVE: CVE-2018-10822  
  
CVSS v3: 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)  
  
Directory traversal vulnerability in the web interface on D-Link  
routers:  
aC/ DWR-116 through 1.06,  
aC/ DIR-140L through 1.02,  
aC/ DIR-640L through 1.02,  
aC/ DWR-512 through 2.02,  
aC/ DWR-712 through 2.02,  
aC/ DWR-912 through 2.02,  
aC/ DWR-921 through 2.02,  
aC/ DWR-111 through 1.01,  
aC/ and probably others with the same type of firmware  
  
allows remote attackers to read arbitrary files via a /.. or // after  
"GET /uir" in an HTTP request.  
  
NOTE: this vulnerability exists because of an incorrect fix for  
CVE-2017-6190.  
  
PoC:  
aaaaa  
a $ curl http://routerip/uir//etc/passwd  
aaaaa  
  
The vulnerability can be used retrieve administrative password using  
the other disclosed vulnerability - CVE-2018-10824  
  
This vulnerability was reported previously by Patryk Bogdan in  
CVE-2017-6190 but he reported it is fixed in certain release but  
unfortunately it is still present in even newer releases. The  
vulnerability is also present in other D-Link routers and can be  
exploited not only (as the original author stated) by double dot but  
also absolutely using double slash.  
  
  
2 Password stored in plaintext in several series of D-Link routers  
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  
  
CVE: CVE-2018-10824  
  
An issue was discovered on D-Link routers:  
aC/ DWR-116 through 1.06,  
aC/ DIR-140L through 1.02,  
aC/ DIR-640L through 1.02,  
aC/ DWR-512 through 2.02,  
aC/ DWR-712 through 2.02,  
aC/ DWR-912 through 2.02,  
aC/ DWR-921 through 2.02,  
aC/ DWR-111 through 1.01,  
aC/ and probably others with the same type of firmware.  
  
NOTE: I have changed the filename in description to XXX because the  
vendor leaves some EOL routers unpatched and the attack is too  
simple.  
  
The administrative password is stored in plaintext in the /tmp/XXX/0  
file. An attacker having a directory traversal (or LFI) can easily  
get  
full router access.  
  
PoC using the directory traversal vulnerability disclosed at the same  
time - CVE-2018-10822  
  
aaaaa  
a $ curl http://routerip/uir//tmp/XXX/0  
aaaaa  
  
This command returns a binary config file which contains admin  
username and password as well as many other router configuration  
settings. By using the directory traversal vulnerability it is  
possible to read the file without authentication.  
  
  
3 Shell command injection in httpd server of a several series of D-Link   
routers  
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  
aaaaaaaa  
  
CVE: CVE-2018-10823  
  
CVSS v3: 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)  
  
An issue was discovered on D-Link routers:  
aC/ DWR-116 through 1.06,  
aC/ DWR-512 through 2.02,  
aC/ DWR-712 through 2.02,  
aC/ DWR-912 through 2.02,  
aC/ DWR-921 through 2.02,  
aC/ DWR-111 through 1.01,  
aC/ and probably others with the same type of firmware.  
  
An authenticated attacker may execute arbitrary code by injecting the  
shell command into the chkisg.htm page Sip parameter. This allows for  
full control over the device internals.  
  
PoC:  
1. Login to the router.  
2. Request the following URL after login:  
aaaaa  
a $ curl http://routerip/chkisg.htm%3FSip%3D1.1.1.1%20%7C%20cat%20  
%2Fetc%2Fpasswd  
aaaaa  
3. See the passwd file contents in the response.  
  
  
4 Exploiting all together  
aaaaaaaaaaaaaaaaaaaaaaaaa  
  
CVSS v3: 10 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)  
  
Taking all the three together it is easy to gain full router control  
including arbitrary code execution.  
  
Description with video: [http://sploit.tech/2018/10/12/D-Link.html]  
  
  
5 Timeline  
aaaaaaaaaa  
  
aC/ 09.05.2018 - vendor notified  
aC/ 06.06.2018 - asked vendor about the status because of long vendor  
response  
aC/ 22.06.2018 - received a reply that a patch will be released for  
DWR-116 and DWR-111, for the other devices which are EOL an  
announcement will be released  
aC/ 09.09.2018 - still no reply from vendor about the patches or  
announcement, I have warned the vendor that if I will not get a  
reply in a month I will publish the disclosure  
aC/ 12.10.2018 - disclosing the vulnerabilities  
`